When a data-breach defendant argues the economic loss doctrine, it usually loses. In 24 federal decisions on the doctrine, it did not bar the negligence claim 19 times, barred it 3 times, and wasn't argued twice. But those 19 come from only 11 court orders, and two orders account for 10 of them.
The doctrine
The economic loss doctrine says you usually can't sue in negligence for purely financial losses, with no injury to a person or to property. Defendants argue that a data-breach plaintiff's losses, like credit monitoring and time spent, are exactly that kind of loss.
The number
| What the court decided | Decisions |
|---|---|
| The doctrine does not bar the negligence claim | 19 of 24 |
| The doctrine bars the claim, in full or in part | 3 of 24 |
| The defendant didn't argue it | 2 of 24 |
A decision here is one state's law (or one group of plaintiffs) decided in a court order. The 24 decisions come from 16 orders, as of November 11, 2026.
What the average hides: count the orders as well as the decisions
The 19 decisions where the doctrine failed come from 11 orders. Two orders decided many states' law at once:
- Priddy v. ZOLL Medical Corp., No. 1:23-cv-10575 (D. Mass. 2025), decided six states' law: Massachusetts, Pennsylvania, Illinois, Florida, Texas and New York.
- In re MOVEit Customer Data Security Breach Litigation, No. 1:23-md-03083 (D. Mass. 2026), decided four: California, Indiana, Michigan and Ohio. For Indiana, the court called dismissal premature at that stage.
Together, those two orders supply 10 of the 19. That is still a broad result, since it covers ten states' law. But it is two courts, not nineteen.
Priddy also shows that states take two different routes:
- Some states don't apply the doctrine to these claims at all. For Florida, Texas and New York, the court said: "Because this is not a product liability action, the economic loss rule does not apply under these states’ laws."
- Others ask whether the duty exists apart from any contract. For Massachusetts, the court found a special relationship and held: "Because this special relationship gives rise to a fiduciary duty, the economic loss rule does not bar Plaintiffs’ negligence claim under Massachusetts law." A Pennsylvania court reached the same place in In re Rutter's Inc. Data Security Breach Litigation, No. 1:20-cv-00382 (M.D. Pa. 2021): because "this legal duty exists independently from any contractual obligations between the parties," the doctrine was no bar.
When the defense won
| Order | What happened |
|---|---|
| In re MAPFRE Data Disclosure Litigation, No. 1:23-cv-12059 (D. Mass. 2025) | "The economic loss doctrine bars Plaintiffs’ negligence claim." The court found no physical injury or property damage. |
| In re PowerSchool Holdings, No. 3:25-md-03149 (S.D. Cal. 2026), school-district plaintiffs | Plaintiffs that had their own contracts with the defendant sought purely economic damages. Their tort claims "will be dismissed to the extent they seek such damages." |
| Shea v. American International College, No. 1:24-cv-11449 (D. Mass. 2025) | A partial win. The claim "survives as to emotional distress damages and any economic losses directly resulting from that injury, but is dismissed to the extent it seeks recovery for other purely economic mitigation costs." |
MAPFRE and Priddy came from the same judge, in the same court, on the same day, under the same doctrine. In Priddy, the court found a special relationship that created a duty, and the doctrine did not apply. In MAPFRE, the court found no physical injury or property damage, and it did.
What to do
| If you represent the defendant | If you represent the plaintiff |
|---|---|
| Check whether your state applies the doctrine to data-breach negligence at all. In Florida, Texas and New York, Priddy held it doesn't. | Plead the relationship that creates a duty apart from any contract, such as a fiduciary role. In Priddy, that relationship defeated the doctrine. |
| Press it hardest against a generic complaint that pleads no special relationship, or against plaintiffs who had their own contract with your client. | Plead each damages category separately. In Shea, emotional-distress damages survived even where mitigation costs did not. |
| Brief it category by category. A partial win, as in Shea, still narrows the case. | Don't cite the 19 as nineteen courts. Two orders supply more than half of them. |
Method: 24 federal district court decisions on the economic loss doctrine against a data-breach negligence claim, in 16 orders, in LawSnap's data-breach class-action corpus, as of November 11, 2026. A decision is one state's law, or one plaintiff group, decided in an order. Outcomes are LawSnap's coding of each order, read in full. Shea is counted as barred under LawSnap's convention of coding a split outcome by its main disposition, though the claim survived in part. District court rulings do not bind other courts, and these counts are not odds of winning. Nothing here is legal advice.