Florida Court’s Refusal To Certify The Chili’s Class Action Raises The Evidentiary Bar For Data Breach Cases

According to an article by Alston & Bird, a Florida court’s denial of class certification sets a new hurdle in data breach cases, emphasizing the challenge of proving common harm across victims.

On June 27, 2025, the US District Court for the Middle District of Florida upended a closely watched suit stemming from the 2018 point‑of‑sale intrusion at Brinker International’s Chili’s restaurants. Reversing its 2021 order granting class certification, the court denied a renewed motion after the Eleventh Circuit vacated and remanded, emphasizing that the plaintiffs had to satisfy the strict Article III standing and Rule 23 requirements. 

The appellate panel had already pared back the roster of named plaintiffs, holding that only one could trace her injuries, unauthorized charges, and identity‑theft mitigation to the Chili’s breach, and it instructed the trial court either to tighten the class definition or to revisit predominance altogether.

Electing the first option, the district court narrowed the class to customers who both transacted at a compromised terminal and later suffered fraudulent charges or saw their data sold on the dark web. Once narrowed, common questions evaporated. Determining whether each patron’s card was used on an affected device, whether fraudulent activity occurred, and what mitigation steps were taken would require individual mini-trials. The court further noted that damages evidence, including time and money spent monitoring credit or disputing charges, would likewise be unique to each claimant, overwhelming any common proof and defeating predominance.

The article states that plaintiffs have until July 25 to pursue individual claims or face dismissal. 

For cybersecurity leaders and counsel, the ruling underscores a judicial trend toward demanding concrete, traceable harm before certifying classes in data breach cases. Going forward, meticulous forensic linkage, individualized impact analysis, and clear documentation of losses will be essential to surmount class-action barriers and to inform breach-response, litigation, and insurance strategies.