BUTTE, Mont. — Credit unions and other financial institutions have won a significant legal victory in litigation stemming from the massive Snowflake data breach, with a federal judge allowing claims for negligence, negligence per se and unjust enrichment to move forward against the cloud-computing company and Ticketmaster.
Chief U.S. District Judge Brian Morris of the District of Montana rejected key arguments by Snowflake Inc., Ticketmaster LLC and Live Nation Entertainment Inc. that the financial institutions’ claims should be dismissed.
The Oct. 29, 2025, decision came in In re Snowflake, Inc., Data Security Breach Litigation, a multidistrict proceeding involving cyberattacks in which threat actors allegedly obtained data stored by numerous companies on Snowflake’s cloud platform.
NOFFCU Serves as Representative Plaintiff
New Orleans Firemen’s Federal Credit Union serves as the representative plaintiff for the financial institutions. The credit union filed its amended representative class-action complaint April 8, 2025. The proposed class consists of financial institutions that issue credit and debit cards to customers whose information allegedly was compromised in the breach.
The financial institutions alleged the breach caused them to suffer losses that included costs associated with fraudulent transactions and responding to compromised payment cards.
In refusing to throw out most of the claims, Morris found the financial institutions had sufficiently alleged the requirements necessary to establish standing in federal court, including an injury that could be traced to the defendants and potentially remedied by the court.
Specifics of Ruling
Specifically, Morris ruled:
- Negligence: The financial institutions sufficiently pleaded their negligence claims, and the court rejected the defendants’ argument that the economic loss doctrine barred those claims.
- Negligence per se: The allegations were sufficient at the pleading stage for that claim to continue.
- Unjust enrichment: The financial institutions sufficiently pleaded claims against the defendants.
- Standing: The institutions sufficiently alleged injury-in-fact, traceability and redressability to establish Article III standing.
- Declaratory and injunctive relief: The financial institutions did not prevail on every issue. Morris dismissed their separate claim seeking declaratory and injunctive relief.
The ruling does not determine that Snowflake, Ticketmaster or Live Nation is liable for the breach or award damages to the credit unions. Instead, it allows the financial institutions’ principal damages claims to survive the defendants’ motions to dismiss and proceed to later stages of the litigation.
Credit Unions Among Early Plaintiffs
Several credit unions had brought litigation arising from the breach before the representative financial-institution complaint was filed.
Financial Horizons Credit Union and Collegedale Credit Union filed suit against Snowflake, Ticketmaster and Live Nation in January 2025. Omaha Federal Credit Union also brought a case. Those institutions later voluntarily dismissed their individual actions after the court established a separate financial-institution track within the multidistrict litigation.
In February 2025, Morris formally created what the court called a “Financial Institution spoke” to handle the investigation and prosecution of claims by financial institutions against Snowflake and Ticketmaster/Live Nation. The judge noted the parties agreed the financial-institution claims required separate attention.
New Orleans Firemen’s FCU subsequently filed its own class-action lawsuit March 28 against Snowflake, Ticketmaster and Live Nation. The credit union was later designated the representative class member for the financial-institution plaintiffs.
Financial Institutions Allege Direct Losses
The financial institutions’ claims differ from those brought by consumers whose personal information allegedly was stolen.
New Orleans Firemen’s FCU and the proposed financial-institution class contend they suffered their own economic injuries as issuers of payment cards.
That distinction became important in the defendants’ efforts to have the lawsuit dismissed.
Morris concluded the institutions had adequately alleged actual financial injuries sufficient to establish standing. He also rejected the argument that the economic loss doctrine prevented them from pursuing negligence claims seeking recovery of their financial losses.
The court determined at the pleading stage that Montana law should apply to the financial institutions’ claims.
Massive Breach Led to Multidistrict Litigation
The litigation stems from a series of attacks involving customer accounts hosted on Snowflake’s cloud platform. The court has characterized the cases as involving an alleged “hub-and-spoke” breach, with Snowflake serving as the hub and companies storing information on its platform serving as the spokes.
The Judicial Panel on Multidistrict Litigation centralized the federal lawsuits in Montana, creating MDL No. 3126.
The litigation includes separate groups of plaintiffs representing consumers, financial institutions and other entities allegedly affected by compromises of Snowflake customer environments.
Morris issued a separate decision Oct. 28 addressing consumer claims before issuing the financial-institution ruling the following day.
For the credit unions and other card issuers, the Oct. 29 ruling means their central allegations survived the first major challenge from the defendants, according to legal analysts.
Judge’s Conclusion
Morris concluded the institutions had sufficiently pleaded negligence, negligence per se and unjust enrichment against both Snowflake and Ticketmaster/Live Nation.
Snowflake’s motion to dismiss was therefore granted only as to the financial institutions’ request for declaratory and injunctive relief and denied as to all three of their principal damages claims. Ticketmaster and Live Nation received the same result on their motion.
