Plaintiffs Tiffany Troy and Eric John Mata, citizens of New York and Texas, are members of the American Bar Association and made purchases from the American Bar Association, which requires customers to disclose personal identifying information and processes customers’ debit and credit card payments.

Both were among some 1.5 million ABA members affected by a March 2023 data security breach, which plaintiffs alleged stemmed from the ABA’s failure to comply with reasonable security standards.