Staples Sued in Class-Action Lawsuit Over Data Breach from Ransomware Attack.

Staples Inc. is facing a federal lawsuit after a ransomware attack by the group CoinbaseCartel exposed sensitive personal data, including names, addresses, birthdates, and Social Security numbers. The suit, filed on March 19, 2026, in the U.S. District Court for the District of Massachusetts, alleges that Staples failed to adequately protect personally identifiable information (PII) it collected. Former employee Steve Sellin claims the company was negligent in implementing proper cybersecurity measures, such as data encryption and multifactor authentication. The ransomware group, which publicly posted an extortion notice on March 11, demands ransom negotiations, threatening to leak over two terabytes of stolen data. Sellin, represented by Siri & Glimstad LLP and Kopelowitz Ostrow PA, seeks to represent a nationwide class of affected individuals, demanding damages and changes to Staples’ data security practices. The lawsuit accuses Staples of neglecting its duty to notify victims and protect against foreseeable cyber threats, with claims for negligence and unjust enrichment.