Montana Data Breach Lawyer | Data Privacy Claims

Practice areaData Privacy & Data Breach

Great Falls & Montana Data Breach Lawyers: Data Privacy, Data Breach Notices, Medical Records and Financial Data Breaches

Boland Aarab PLLP.

Our attorneys: Caitlin Boland Aarab · Samir F. Aarab

As Montana data breach lawyers, we represent people whose personal information was exposed because a hospital, bank, employer or vendor failed to protect it. Whether you have a claim depends on what was taken and how it has affected you. Montana’s new privacy law does not let consumers sue, but other claims often do.

Key Takeaways
A business that owns or licenses Montanans’ computerized personal information must notify affected residents of a breach “without unreasonable delay” (§ 30-14-1704, MCA).
The Montana Consumer Data Privacy Act is enforced only by the Attorney General. It expressly creates no private right of action (§ 30-14-2817, MCA).
Breach victims’ lawsuits usually rest on other law: negligence, contract, consumer-protection statutes and, in some cases, federal statutes.
In federal court, you need a concrete injury to sue for damages; the risk of future harm alone is not enough (TransUnion LLC v. Ramirez, 594 U.S. 413 (2021)).

On this page: Breach notices · The privacy act · Claims that exist · Federal law · Federal court and class actions · Cases we handle · What to do · Settlement notices · Deadlines · Why Boland Aarab · FAQ

Received a data breach notice, or already dealing with fraud? Contact Boland Aarab PLLP for a free consultation at (406) 315-3737.

What does Montana law require after a data breach?

A business must tell affected Montanans promptly. Montana’s breach-notice law applies to any person or business that conducts business in Montana and owns or licenses computerized data that includes personal information (§ 30-14-1704(1), MCA). After discovering a breach, it must notify each Montana resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

What counts as personal information. A first name or first initial and last name, combined with any of these, when either is unencrypted (§ 30-14-1704(4)(b)):

Social Security number;
driver’s license, state ID or tribal ID number;
an account, credit or debit card number together with a code or password that would allow access to the account;
medical record information;
a taxpayer identification number; or
an IRS identity protection PIN.

Timing. Notice must be made “without unreasonable delay.” It may be delayed only when law enforcement determines notice would impede a criminal investigation, or as needed to determine the scope of the breach and restore the system.

How. Written, electronic or telephone notice. Substitute notice, such as email plus website posting or media notice, is allowed only in limited situations, such as when notice would cost more than $250,000 or reach more than 500,000 people (§ 30-14-1704(5)).

Report to the Attorney General. A business that sends notices must also send a copy to the Attorney General’s consumer protection office, with the number of Montanans notified (§ 30-14-1704(8)).

Vendors. A company that holds data it does not own, such as a cloud or payroll vendor, must notify the owner immediately after discovering a breach (§ 30-14-1704(2)).

The State enforces this law. The Department may seek an injunction, and a violation of the breach-notice law is treated as a violation of the Montana Consumer Protection Act, § 30-14-103, MCA (§ 30-14-1705, MCA).

Can you sue under the Montana Consumer Data Privacy Act?

No. The Montana Consumer Data Privacy Act (Title 30, chapter 14, part 28, MCA) was enacted in 2023 and amended in 2025. It gives the Attorney General “exclusive authority” to enforce it, and says nothing in it may be construed as providing the basis for “a private right of action for violations of this part or any other law” (§ 30-14-2817, MCA).

The Act still matters to you. It gives Montana consumers rights against covered businesses, including the right to (§ 30-14-2808, MCA):

confirm whether a business is processing your personal data, and see it;
correct inaccurate data;
delete personal data about you;
get a portable copy of data you provided; and
opt out of targeted advertising, the sale of your data and certain automated profiling.

It applies to businesses that control or process the personal data of at least 25,000 Montana consumers, or at least 15,000 if they make more than 25% of gross revenue from selling personal data (§ 30-14-2803, MCA). Certain protections for minors apply more broadly. If a business ignores your rights, you can file a complaint with the Attorney General, who must provide an online complaint mechanism (§ 30-14-2817(2)).

What legal claims do data breach victims have?

It depends on the facts, but the claims usually come from general law, not a privacy statute. Courts are still working out how these claims apply to data breaches, and results vary. The claims most often raised include:

Negligence. A company that collects sensitive information may owe a duty to use reasonable care to protect it. The claim asks whether the company’s security fell short and whether that failure caused real harm, such as fraud, lost money or time spent fixing the damage.
Breach of contract or implied contract. Where a company promised, in a contract, privacy policy or account terms, to protect your data.
The Montana Consumer Protection Act. A consumer who suffers an “ascertainable loss of money or property” from an unfair or deceptive practice may sue for actual damages or $500, whichever is greater. The court may award up to three times actual damages and attorney fees. But the statute allows an individual action only, not a class action (§ 30-14-133, MCA). Whether a breach-notice violation supports this claim is not settled.
Claims tied to a specific relationship, such as a patient’s claim against a provider, or claims under a federal statute that gives a right to sue (see below).

We will tell you plainly whether your situation supports a claim, and what it is realistically worth.

What federal laws apply to data breaches?

Several, but only some let individuals sue:

Law	What it does	Can you sue under it?
HIPAA Breach Notification Rule, 45 C.F.R. § 164.404	Requires health care providers and plans to notify patients of a breach of unsecured health information without unreasonable delay, and no later than 60 days after discovery	No. HIPAA provides no private right of action (Webb v. Smart Document Solutions, LLC, 499 F.3d 1078 (9th Cir. 2007)). State-law claims may still be available.
Fair Credit Reporting Act, 15 U.S.C. § 1681n	Regulates consumer reporting agencies and users of consumer reports	Yes, for covered violations. Willful violations allow actual damages or statutory damages of $100 to $1,000, punitive damages and attorney fees.
Class Action Fairness Act, 28 U.S.C. § 1332(d)	Gives federal courts jurisdiction over large class actions	Not a claim itself; it decides where the case is heard.

Other federal statutes can apply in particular situations, such as the misuse of motor vehicle records or video-viewing histories. Each has its own rules, and we evaluate them case by case.

Why are data breach cases usually in federal court?

Because most breaches affect people in many states. Federal courts have jurisdiction over class actions where more than $5,000,000 is at stake, the class has at least 100 members and there is minimal diversity of citizenship (28 U.S.C. § 1332(d)). Large national breaches often lead to many lawsuits that are consolidated in one federal court as multidistrict litigation. The Snowflake cloud-data cases are one example; see our Snowflake data security litigation page.

Federal court brings its own threshold question: standing. The U.S. Supreme Court has held that “only those plaintiffs who have been concretely harmed by a defendant’s statutory violation may sue,” and that the mere risk of future harm, standing alone, cannot support a claim for damages (TransUnion LLC v. Ramirez, 594 U.S. 413 (2021)). That is why documenting actual misuse, losses and time spent matters. These cases involve federal statutes, sophisticated corporate defendants and a real prospect of trial.

What data breach cases do we handle?

We represent Montanans whose personal information was exposed in:

Hospital, clinic and medical records breaches.
Bank, lender and payment card breaches.
Employer and payroll data breaches, exposing Social Security numbers, tax forms and direct-deposit information.
Cloud and vendor breaches that expose customer data, such as the Snowflake litigation.

What should you do after a data breach notice?

Keep the letter or email. It tells you who was breached, when, and what was taken.
Sign up for any free credit monitoring offered, and consider freezing your credit with the credit bureaus.
Watch your bank statements, credit reports and medical bills for anything you do not recognize, including medical services you never received.
Change passwords and turn on two-factor authentication for any account tied to the breached information.
Write down every loss: fraudulent charges, fees, time off work and hours spent on the phone. In federal court, concrete harm matters.
Report identity theft to your bank and to law enforcement when it happens.
Call us before you respond to a settlement notice or sign anything.

What should you do with a class action settlement notice?

Read it carefully, and note the deadlines. A class settlement notice usually gives you choices: file a claim, do nothing, exclude yourself (“opt out”), or object. Doing nothing can still release your claims. Opting out preserves your right to sue on your own but gives up the settlement payment. Each option has a firm deadline set by the court. If you suffered serious losses, such as identity theft or large out-of-pocket costs, the choice deserves a lawyer’s review before the deadline passes.

How long do you have to bring a data breach claim?

It depends on the claim, and some deadlines are short:

3 years for most tort claims, such as negligence (§ 27-2-204(1), MCA).
2 years for an individual Montana Consumer Protection Act claim, which runs under § 27-2-211, MCA (§ 30-14-133(1)(a), MCA).
Settlement deadlines in a pending class action, set by the court, which can be only weeks away.

When a deadline starts can be disputed. Do not wait to find out.

The Boland Aarab Way

Data breach cases are fought in federal court against large institutions, and they are won by lawyers who are prepared to go the distance:

We know federal court. Both partners are admitted in the U.S. District Court for the District of Montana, the Ninth Circuit Court of Appeals and the U.S. Supreme Court. Our attorneys have handled more than 40 cases in the District of Montana over the past nine years, and Samir Aarab has argued twice before the Ninth Circuit.
We take on large institutions. In Estate of Alexander v. Cascade County, a civil-rights and wrongful-death case in federal court in Great Falls, we obtained a $550,000 settlement.
We protect results on appeal. Our appellate record includes Voegel v. Salsbery, 2023 MT 137, where the Montana Supreme Court reinstated a $168,500 jury verdict for our client.
We tell you the truth. Not every breach is a lawsuit. We will tell you whether yours is, and what we would do about it.

Both attorneys are members of the American Association for Justice and the Montana Trial Lawyers Association, and Samir Aarab is also a member of Public Justice. See our results.

Contact Boland Aarab PLLP for a free consultation at (406) 315-3737.

Where do we handle data breach cases?

Our office is at 18 6th Street North, Suite 200, in Great Falls. We represent data breach victims across Montana, including Great Falls, Billings, Missoula, Helena, Bozeman, Butte and Kalispell.

Data breach cases across Montana

We are based in Great Falls and handle data breach cases statewide. Local information for each city:

Frequently Asked Questions

Can I sue a company for a data breach in Montana? Sometimes. Claims usually rest on negligence, contract or consumer-protection law, and they are strongest when the breach caused real losses. Montana’s Consumer Data Privacy Act itself does not allow private lawsuits (§ 30-14-2817, MCA).

How quickly must a company tell me about a data breach in Montana? “Without unreasonable delay,” with limited exceptions for law-enforcement requests and investigating the breach (§ 30-14-1704, MCA). Health care providers covered by HIPAA must notify patients within 60 days of discovery at the latest (45 C.F.R. § 164.404).

Is there a private right of action under the Montana Consumer Data Privacy Act? No. The Attorney General has exclusive authority to enforce it, and the Act says it provides no basis for a private right of action (§ 30-14-2817, MCA). You can file a complaint with the Attorney General.

Can I sue under HIPAA if my medical records were breached? No. HIPAA does not create a private right of action. Patients may still have state-law claims against the provider or its vendor.

What is a data breach lawsuit worth? It depends on what was taken and what it cost you. Proven fraud, out-of-pocket losses and lost time carry more weight than exposure alone, especially in federal court after TransUnion v. Ramirez.

Should I join the class action or opt out? It depends on your losses. For most people, filing a claim in the settlement makes sense. If you suffered serious identity theft or large losses, talk with a lawyer before the opt-out deadline.

What should I do first after getting a breach notice? Keep the notice, enroll in any free monitoring, consider a credit freeze, watch your accounts and records of losses, and call us before signing anything.

How long do I have to file a data breach claim? Generally 3 years for negligence claims (§ 27-2-204, MCA) and 2 years for an individual Consumer Protection Act claim. Class settlement deadlines can be much shorter.

Talk to a Montana Data Breach Lawyer