Accellion Data Breach Lawsuit Narrowed as California Judge Rejects Expanded Class Certification On July 9, 2026, a federal judge in the U.S. District Court for the Northern District of California denied plaintiffs’ attempt to broaden class certification in a lawsuit against software vendor Accellion over a major data breach. The ruling upheld a prior decision limiting class members to nominal damages, despite the introduction of a new damages expert by the plaintiffs. The case stems from a sprawling cybersecurity incident involving Accellion’s legacy file-transfer software, which exposed sensitive data across multiple organizations. While the plaintiffs sought to expand the scope of recoverable damages, the court determined that the new expert testimony did not sufficiently alter the legal outcome. The decision maintains the existing framework for the lawsuit, restricting compensation to symbolic amounts rather than broader financial or punitive damages. The ruling underscores the challenges plaintiffs face in securing expanded relief in data breach litigation, particularly when nominal damages are the primary avenue for recovery.