Staples Lawsuit: The 2026 Data Breach Class Actions Were Dropped
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
The Staples lawsuit people are searching for is the Staples data breach litigation: three proposed class actions filed in federal court in Massachusetts in March 2026, after a ransomware group claimed an attack on Staples’ network. All three were voluntarily dismissed between May 28 and June 3, 2026. As of October 2026 there is no Staples settlement, no fund, no claim form and no deadline.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What the Lawsuits Said Happened
According to the Sellin complaint, a ransomware group claimed responsibility for an attack on Staples’ network on March 11, 2026 and obtained more than two terabytes of personal information — names, addresses, dates of birth and/or Social Security numbers. Staples has not confirmed those figures in any source we could find, and the size of the affected group was never established in court.
The plaintiffs were former Staples employees. The lawsuits alleged that Staples failed to follow recommended cybersecurity practices despite promising in its privacy policy to keep data safe, and that it was slow to notify the people affected. These were allegations only; no court ruled on them.
Case Details
All three Staples class action cases were filed in the U.S. District Court for the District of Massachusetts:
Carroll v. Staples, Inc., No. 1:26-cv-11336, filed March 18, 2026, assigned to Judge Paul G. Levenson.
Sellin v. Staples, Inc., No. 1:26-cv-11342, filed March 19, 2026, before Judge Allison Dale Burroughs.
Williams v. Staples, Inc., No. 1:26-cv-11513, filed March 31, 2026, also before Judge Burroughs.
Staples appeared through counsel on April 9, 2026. The cases were never consolidated.
Status: All Three Cases Dismissed, No Settlement
The public docket entries do not say why the cases were dropped, and we could not confirm whether the dismissals bar the claims from being refiled. As of October 11, 2026 we found no refiled Staples data breach case in federal court in Massachusetts and no settlement website. Anything advertising a “Staples data breach settlement claim” is describing something that, as far as the public record shows, does not exist.
Who Would Have Been Covered
The Sellin complaint proposed a class of all U.S. residents whose private information was compromised in the March 2026 breach and who received notice of it. Law360 reported the suits as concerning exposed employee data. Because no class was ever certified, nobody is a class member today — there is nothing to join and nothing to opt out of.
If you received a breach notice from Staples, keep it. It states which data was involved and would be your proof if a new case or settlement ever appears.
Is There Any Money?
For general context on what data breach settlements pay when they do happen, see our data breach settlement calculator and the list of open class action settlements — Staples is not on it.
How cases like this one end
Our copy of the federal courts’ own case database covers 16,001 other personal property damage casesclosed in U.S. federal district courts between 2015 and 2026, 11.3% of them filed as class actions:
- 32.5% ended in a settlement recorded by the court. Another 19.5% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 32.5% and 52.1%.
- 5.9% were decided on a motion before any trial.
- 1 in 90 reached a trial (1.1%), after a median of 27.5 months.
- Median time from filing to the end of the case: 8.4 months.
- Only 250 of them (1.6%) record a money award at all; the median of those is $443,000.
These are base rates for this type of case (federal other personal property damage cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
Staples Data Breach Lawsuit Timeline
- 1
March 11, 2026 — Attack Claimed
Per the Sellin complaint, a ransomware group claims an attack on Staples’ network and says it took more than two terabytes of personal data.
- 2
March 18–19, 2026 — First Two Lawsuits
Carroll (No. 1:26-cv-11336) and Sellin (No. 1:26-cv-11342) are filed in federal court in Massachusetts by former employees.
- 3
March 31, 2026 — Third Lawsuit
Williams v. Staples, Inc. (No. 1:26-cv-11513) is filed — the third suit in two weeks.
- 4
April 9, 2026 — Staples Appears
Staples enters appearances and files corporate disclosure statements naming Sycamore Partners II, L.P. and Arch Parent, Inc. as corporate parents.
- 5
May 28 – June 3, 2026 — Cases Dropped
The plaintiffs file notices of voluntary dismissal in Sellin (May 28), Carroll (June 1) and Williams (June 3).
- 6
As of October 2026 — Nothing Pending
No class certified, no settlement, no administrator, no claim form and no deadline.
Three Things to Watch For
A breach that got headlines but never produced a settlement is an easy target for imposters:
“Claim your Staples data breach payment” sites
There is no Staples breach settlement and no claims portal. A page asking for your Social Security number or bank details to “register” for one is collecting data, not filing a claim.
Messages posing as Staples HR
The lawsuits centered on employee data, so former workers are the obvious target. An email or text claiming to be from Staples HR and asking you to “verify” your SSN or direct-deposit details should be checked by contacting the company through a number you look up yourself.
Offers to sell you the stolen data back
Attackers who publish breach data sometimes contact victims claiming they can “delete” it for a fee. There is no way to verify that. Do not pay; freeze your credit instead.
Staples Lawsuit — Questions People Actually Ask
Is there a Staples data breach settlement?
No. The three proposed class actions over the March 2026 breach were voluntarily dismissed between May 28 and June 3, 2026. There is no settlement, no fund, no claim form and no deadline as of October 2026.
Why were the Staples lawsuits dismissed?
The plaintiffs withdrew them by filing notices of voluntary dismissal. The docket entries do not give a reason, and no court ruled on the merits. We have not been able to confirm whether the dismissals allow the claims to be refiled.
What data was exposed in the Staples data breach?
Per the Sellin complaint: names, addresses, dates of birth and/or Social Security numbers, more than two terabytes in total according to the attackers’ claim. Staples has not confirmed those details in any source we found. Your own notice letter, if you got one, is the best record of what applied to you.
I’m a former Staples employee. Do I need to do anything?
There is nothing to file. If you received a breach notice, keep it, freeze your credit at all three bureaus and watch for tax-return fraud, since Social Security numbers were among the data allegedly taken.
Was there a separate Staples class action in 2026?
Yes, an unrelated one. Wilson v. Staples, Inc., No. 1:26-cv-11489, filed March 29, 2026 in Massachusetts, was a proposed class action under the Telephone Consumer Protection Act. After a May 19, 2026 filing referring to a pending settlement, the plaintiff dismissed it with prejudice on May 29, 2026. No class settlement or claim process was created.
Did Staples get bought out?
Staples is privately owned. In its April 2026 court filings, Staples identified Sycamore Partners II, L.P. and Arch Parent, Inc. as its corporate parents. A planned $6.3 billion Staples–Office Depot merger was abandoned on May 19, 2016 after the FTC won a preliminary injunction.
What is the significance of Staples v. United States?
It is a different matter entirely: a 1994 Supreme Court criminal case, 511 U.S. 600, about an unregistered machine gun owned by a man named Staples. The Court held the government had to prove he knew of the features that brought his rifle under the National Firearms Act. It has nothing to do with the company or the data breach.
What is worth doing right now?
Freeze your credit at Equifax, Experian and TransUnion — free and reversible. Consider an IRS Identity Protection PIN to block fraudulent tax returns. Ignore anyone offering to file a Staples settlement claim for you.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Settlements currently accepting claims, with deadlines
Data Breach Settlement Calculator
What breach settlements typically pay per person
Class Action Payout Calculator
Estimate a per-person share of a settlement fund
Carhartt Data Breach Lawsuit
Another retailer breach case and where it stands