Gurvin v. Neeley

On March 2, 2026, plaintiff John Gurvin filed a class-action lawsuit against Sarah Neeley and her company, Neeley Technologies, in the U.S. District Court for the Northern District of California. The suit alleged that the company's inadequate cybersecurity measures led to a massive data breach, exposing sensitive personal and financial information of over 15 million users. Gurvin claimed that despite repeated warnings from security researchers, Neeley failed to implement basic encryption and multi-factor authentication, directly causing identity theft and financial losses. The case quickly became a landmark dispute over executive liability for data protection failures under the newly amended California Consumer Privacy Act (CCPA) and federal negligence standards.

The court denied the motion to dismiss, finding that Gurvin adequately alleged standing based on imminent risk of identity theft. In a subsequent bench ruling, the jury found Neeley Technologies negligent and awarded $2.3 billion in compensatory damages; however, the personal liability claims against Sarah Neeley were settled out of court for an undisclosed sum, while she stepped down as CEO.

Whether a corporate executive can be held personally liable for damages resulting from a cybersecurity breach caused by alleged gross negligence, and whether the risk of future harm constitutes a concrete injury sufficient for standing under Article III.

The verdict accelerated the passage of the federal Digital Accountability and Transparency Act of 2026, imposing mandatory minimum cybersecurity standards and making willful neglect a criminal offense for senior executives. It also spurred a wave of shareholder derivative suits against tech firms, prompting widespread adoption of zero-trust architectures and cyber insurance reforms.