Defendant accused of data breach

A proposed class action lawsuit involving a significant data breach has been dismissed by the Court of Claims of Ohio. The case, filed by Terri Gales and others against the Ohio Lottery Commission (OLC), alleged that a cybersecurity incident on December 24, 2023, compromised plaintiffs’ personal identifying information. On October 31, 2025, Judge David E. Cain granted the defendant’s motion to dismiss the consolidated amended complaint.

The lawsuit stemmed from an unauthorized data breach that potentially exposed non-public personal identifying information (PII) of individuals who participated in or received payments for winning lottery prizes through OLC’s online digital games. Plaintiffs argued that OLC failed to secure their PII adequately and did not promptly detect or inform them about the breach. They claimed this failure resulted in identity theft and other injuries.

Plaintiffs contended that OLC had violated several laws and duties, including breach of implied contract, unjust enrichment, negligence, negligence per se, breach of fiduciary duty, and invasion of privacy. They asserted that OLC’s privacy policy promised reasonable precautions to prevent unauthorized access to personal information but failed to uphold these standards. “The occurrence of the Data Breach indicates that Defendant failed to adequately implement one or more [reasonable security measures] to prevent cyberattacks,” stated the complaint.

In response, OLC argued it was entitled to sovereign immunity and that plaintiffs lacked standing due to insufficient allegations of concrete injury. Furthermore, OLC maintained that no claim upon which relief could be granted was stated by the plaintiffs. The court agreed with OLC’s position and found it lacked subject-matter jurisdiction over tort claims against state agencies for money damages unless explicitly authorized by statute.

Judge Cain noted that while the Court of Claims generally has jurisdiction over contract claims against state entities like OLC, plaintiffs failed to demonstrate an enforceable contract existed between them and OLC based on its privacy policy. The court also dismissed claims for unjust enrichment as plaintiffs did not allege any failure by OLC to provide services paid for nor any bad faith or fraud in collecting payments.

Ultimately, all claims were dismissed: tort claims under Civ.R. 12(B)(1) due to lack of jurisdiction; contract-related claims under Civ.R. 12(B)(6) due to insufficient factual allegations supporting a contractual relationship; and equitable claims for unjust enrichment under Civ.R. 12(B)(6) as no set of facts suggested OLC was unjustly enriched at plaintiffs’ expense.

Representing Terri Gales and other plaintiffs were attorneys whose names were not disclosed in this document. Judge David E. Cain presided over the case identified as Case No. 2024-00434JD.