District of Massachusetts Allows Higher-Ed Student Data Breach Claims to Survive

**Executive summary:** The report reviews the Shea v. American International College litigation arising from a late-2023 cyberattack that allegedly exfiltrated over 5,000 GB of unencrypted data belonging to more than 11,000 current and former students over a 19-day period; AIC discovered the intrusion, engaged forensics, and issued notices in May 2024, and the putative class action alleges negligence, breach of implied contract, unjust enrichment, invasion of privacy, and other claims while the court denied a threshold standing challenge.