Current and former employees of Applebee’s franchisee Apple American Group may be covered by a consolidated proposed class action alleging Apple American Group failed to protect Social Security numbers and other personal information exposed in an April 2026 breach. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes class action complaints. The statements below are unproven allegations. Apple American Group LLC and Apple American Group II, LLC have not admitted wrongdoing and have not been found liable, there is no certified class, and there is nothing to claim at this time. This page is informational. It is not legal advice.
What the Apple American Group Lawsuits Are About
Apple American Group LLC and Apple American Group II, LLC are, according to the complaint filed against them in No. 1:26-cv-02032, a restaurant franchise company that operates Applebee’s restaurants in multiple U.S. states and is part of the Apple American Group family of Applebee’s franchise operators. The complaint describes both companies as Delaware entities headquartered in Independence, Ohio. Applebee’s itself and the brand’s franchisor are not named as defendants in that complaint.The lawsuits concern a cyberattack the company detected in April 2026. Quoting the company’s own breach notice, the complaint says Apple American Group became aware of suspicious network activity on or about April 9, 2026, and that its investigation found an unknown actor had accessed certain servers between April 8 and April 9 and accessed or acquired certain files. The complaint alleges the files held Social Security numbers, government-issued ID numbers and financial information belonging to current and former employees, and that the company did not begin notifying them until August 2026.
The lead case, No. 1:26-cv-02013, was filed on August 23, 2026 in the U.S. District Court for the Northern District of Ohio. On September 4, 2026, the court consolidated it with nine related cases, and they now proceed together before Judge Dan Aaron Polster. Apple American Group has not admitted wrongdoing, and no court has ruled on whether any of the allegations are true.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Timeline: From the Server Intrusion to Consolidation
These dates come from the complaint in No. 1:26-cv-02032, which relies on the company’s breach-notice filings with state attorneys general, and from the court docket.- April 8–9, 2026 — An unknown actor accesses certain Apple American Group servers and accesses or acquires certain files, according to the company’s investigation as quoted in the complaint.
- On or about April 9, 2026 — Apple American Group becomes aware of suspicious network activity.
- August 2026 — The company begins notifying affected people, according to the complaint, which says it waited until August despite learning of the breach in April.
- On or around August 18, 2026 — Apple American Group reports the breach to the Vermont Attorney General as affecting 2,992 Vermont residents, according to the complaint.
- August 23, 2026 — The lead case, No. 1:26-cv-02013, is filed in the Northern District of Ohio.
- August 24, 2026 — No. 1:26-cv-02032, the complaint described on this page, is filed in the same court.
- September 4, 2026 — The court consolidates all matters pending before it against Apple American Group under Federal Rule of Civil Procedure 42(a) and designates No. 1:26-cv-02013 as the lead case.
What Information Was Involved
Citing breach-notice filings with the Vermont and California attorneys general, the complaint lists these categories of employee information as compromised:- Names
- Social Security numbers
- Government-issued ID numbers
- Financial account information
- Credit and debit card account information
In separate passages, the complaint also asserts that protected health information, including biometric information and health records, was compromised, and it argues that the company is subject to HIPAA. The data lists it attributes to the state filings do not include those categories. None of these allegations about the scope of the data has been tested in court.
Who Is Affected
The complaint describes the people whose information was exposed as current and former employees who provided it to Apple American Group as a condition of employment. Its only count of affected people comes from the company’s report to the Vermont Attorney General, which the complaint says listed 2,992 Vermont residents. The complaint does not give a nationwide figure. It estimates the proposed class at a minimum of thousands of people.Although the complaint is framed around employees, the class it proposes is written more broadly: everyone in the United States whose information was compromised in the breach. A court would decide who, if anyone, falls within a certified class.
What the Complaint Alleges
The complaint’s central claim is that Apple American Group did not take reasonable steps to protect information it required employees to hand over. It alleges that the breach happened in part because the company stored that information in an unencrypted environment accessible from the internet, and that the company failed to follow basic security practices described in Federal Trade Commission guidance, such as limiting how long sensitive data is kept, restricting access and monitoring network traffic for signs of intrusion.The complaint also takes issue with the timing of the notice. It says Apple American Group learned of the breach in April 2026 but did not begin telling affected people until August 2026, leaving them without a chance to protect themselves in the meantime.
The named plaintiff in No. 1:26-cv-02032, a Florida resident, alleges she has had to spend time researching the breach and monitoring her financial statements, and that she faces a continuing risk of identity theft and fraud. The complaint says employees across the proposed class face the same risks, along with out-of-pocket costs for protective measures, lost time, loss of privacy and a decline in the value of their personal information.
The Consolidated Case in Ohio Federal Court
The complaint asserts federal jurisdiction under the Class Action Fairness Act, alleging that the claims of the proposed class exceed $5 million, that the class has at least 100 members and that at least one member is a citizen of a different state than the defendants. It says venue is proper in the Northern District of Ohio because the companies are based there.The September 4, 2026 order, a non-document order entered on behalf of Judge Dan Aaron Polster under Federal Rule of Civil Procedure 42(a), consolidated all matters pending before the court against Apple American Group. It designated No. 1:26-cv-02013 as the lead case and listed nine associated cases: Nos. 1:26-cv-2023, 2032, 2036, 2048, 2051, 2052, 2091, 2128 and 2162.
Each of the ten cases began with its own complaint, and the class definitions and claims in them may not be identical. This page describes the complaint in No. 1:26-cv-02032. If the plaintiffs file a single consolidated complaint, it could change the claims, the defendants or the proposed class.
The Proposed Class
The complaint in No. 1:26-cv-02032 seeks to represent a nationwide class of all individuals in the United States whose private information was compromised in the breach. Excluded are Apple American Group and its subsidiaries, affiliates, officers and directors, any entity it controls, the legal representatives, heirs, successors and assigns of anyone excluded, and the judges assigned to the case and their immediate families.The complaint says the definition is based on the information available when it was filed and may be changed in an amended pleading or at class certification. No class has been certified, and the definition is only a proposal.
Claims and Relief Sought
The complaint in No. 1:26-cv-02032 brings four counts on behalf of the proposed class:- Negligence
- Breach of implied contract
- Unjust enrichment, pleaded in the alternative to the implied-contract claim
- Declaratory judgment
It asks the court to certify the class and to order Apple American Group to stop the conduct the complaint describes, to adopt appropriate data collection, storage and security practices, and to disclose with specificity what types of information were compromised. It also seeks restitution and disgorgement, and an order requiring the company to pay for at least ten years of credit monitoring for class members.
On the damages side, the complaint seeks actual, compensatory and statutory damages and statutory penalties in an amount to be determined, punitive damages, attorneys’ fees and costs, and pre- and post-judgment interest. It demands a jury trial. No dollar figure is attached to any of it.
What Happens Next
In consolidated data breach cases, the court often appoints interim lead counsel for the plaintiffs, who then commonly file a single consolidated complaint that replaces the individual ones. The defendant typically answers or moves to dismiss, and the court decides which claims, if any, can go forward. Claims that survive move into discovery and, later, a contested request for class certification.Many data breach class actions end in a negotiated settlement rather than a trial, but that outcome is not assured in any particular case, and some are dismissed. If the Apple American Group case settles, the court would have to approve the terms, and class members would generally be notified and given a chance to file a claim, object or opt out. None of that has happened here.
Is There Anything to Claim?
There is nothing to claim. The case is at the complaint stage, no class has been certified, and there is no settlement, claim form, settlement website or deadline.Questions
Is there an Apple American Group data breach settlement?
There is no settlement. The proposed class actions over the April 2026 Apple American Group breach have been consolidated in the U.S. District Court for the Northern District of Ohio and are still at the complaint stage. No class has been certified, and there is no settlement fund, claim form or deadline.
Is Applebee’s being sued over the Apple American Group data breach?
The defendants named in the complaint in No. 1:26-cv-02032 are Apple American Group LLC and Apple American Group II, LLC. The complaint describes them as a restaurant franchise company that operates Applebee’s restaurants in multiple states. Applebee’s itself and the brand’s franchisor are not named as defendants in that complaint.
Who was affected by the Apple American Group data breach?
The complaint in No. 1:26-cv-02032 describes the affected people as current and former Apple American Group employees who gave the company their information as a condition of employment. It cites a filing with the Vermont Attorney General reporting 2,992 affected Vermont residents and does not give a nationwide total.
What information was exposed in the Apple American Group data breach?
Drawing on state breach-notice filings, the complaint lists names, Social Security numbers, government-issued ID numbers, financial account information and credit and debit card account information. In other passages it also asserts that protected health information, including biometric information and health records, was involved.
When did Apple American Group find out about the breach?
According to the complaint, Apple American Group became aware of suspicious network activity on or about April 9, 2026, and its investigation found that an unknown actor accessed certain servers between April 8 and April 9, 2026. The complaint says the company did not begin notifying affected people until August 2026, and it reported the breach to the Vermont Attorney General on or around August 18, 2026.
What does it mean that the Apple American Group lawsuits were consolidated?
On September 4, 2026, the court entered an order under Federal Rule of Civil Procedure 42(a) consolidating all matters pending before it against Apple American Group. The lead case is No. 1:26-cv-02013, and nine associated cases now move forward with it before Judge Dan Aaron Polster. Consolidation is a case-management step and says nothing about whether the allegations are true.
Sources
• Lema v. Apple American Group, LLC, No. 1:26-cv-02013 (N.D. Ohio), lead case — CourtListener docket• No. 1:26-cv-02032 (N.D. Ohio), consolidated case — CourtListener docket
• Class action complaint, No. 1:26-cv-02032, ECF No. 1 (filed August 24, 2026) — PDF via CourtListener RECAP
