Current and former employees of Valenti Southeast Management, a Tampa-based Wendy’s and Chili’s franchise operator, may be covered by a proposed class action alleging the company failed to protect Social Security numbers and other personal data taken in an October 2026 ransomware attack. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action complaint. The statements below are unproven allegations. Valenti Southeast Management has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational. It is not legal advice.
What the Valenti Lawsuit Is About
A proposed class action filed October 16, 2026 accuses Valenti Southeast Management, LLC of failing to safeguard the personal information of its restaurant workers. The case, James v. Valenti Southeast Management, LLC, No. 8:26-cv-03149, is pending in the U.S. District Court for the Middle District of Florida, Tampa Division.The complaint says Valenti, a franchise operator that has historically run Wendy’s restaurants and Chili’s Grill & Bar locations, lost control of its computer network on or around October 12, 2026. It alleges that employee Social Security numbers, financial details and health information were taken, and that Valenti had not started notifying anyone four days later. Valenti has not responded to the complaint in court, and none of the allegations have been tested.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Timeline
- On or around October 12, 2026: According to the complaint, cybercriminals gained access to Valenti’s network, and the Interlock ransomware group listed Valenti on its leak site the same day.
- October 16, 2026: The complaint is filed in Tampa federal court. It says Valenti had not yet begun formally notifying affected people.
- October 17, 2026: No other lawsuits over the incident appear on the federal docket, and no judge assignment is shown yet.
What the Complaint Says Was Taken
The named plaintiff, a current worker at a Chili’s location the complaint says Valenti previously operated, alleges he had to give Valenti his name, date of birth, Social Security number, contact information, address and financial information as a condition of employment. The complaint describes the data collectively as personally identifiable information and protected health information.The complaint also quotes Interlock’s leak-site post, in which the group claimed to hold employee Social Security numbers, wage, tax and benefits data and medical records, along with supplier contracts, financial statements and customer loyalty and payment card data. Those are the attackers’ claims as repeated in the complaint. Valenti has not publicly said what was taken or how many people are affected.
What Valenti Is Accused Of
The plaintiff alleges that Valenti stored employee data without encryption, did not adequately train its staff on cybersecurity, did not monitor its vendors and contractors, and failed to detect the intrusion when it began. The complaint points to Federal Trade Commission data-security guidance, HIPAA security rules and the NIST Cybersecurity Framework as standards it says the company did not meet.The complaint also faults the timing of notice. It argues that because Interlock had already advertised the data, delays in formal notice left workers unable to take early steps such as watching their accounts and credit reports. The plaintiff says he has seen an increase in spam and scam calls since the incident, which the complaint attributes to the breach.
The Proposed Class and Legal Claims
The suit seeks to represent all individuals residing in the United States whose private information was compromised in the Valenti data breach, including those who receive notice of it. The complaint estimates the class at several thousand people and invokes the Class Action Fairness Act, alleging more than $5 million in controversy.It asserts six counts:
- Negligence
- Negligence per se, based on Section 5 of the FTC Act and HIPAA
- Breach of implied contract
- Unjust enrichment
- Invasion of privacy
- Breach of fiduciary duty
The plaintiff asks for class certification, compensatory, punitive and statutory damages where allowed, restitution, injunctive relief requiring stronger data security, attorneys’ fees and a jury trial. The case was filed by Milberg PLLC, with Strauss Borrelli PLLC listed as co-counsel.
What Happens Next
Valenti has not yet been served or appeared in the case. Data breach suits filed this early are often followed by additional complaints from other employees, and when several land in the same court they are commonly consolidated under one lead case. Valenti may also send breach notice letters that disclose the number of people affected and the specific data involved. OpenClassActions.com will update this page as the docket develops.Is There Anything to Claim?
No. There is no settlement, no settlement fund and no claim form. Any payment would come only if the case settles or the plaintiffs win, which in data breach litigation typically takes a year or more. If a settlement is reached, eligible class members would generally be identified through Valenti’s records and sent notice.Questions
Is there a Valenti data breach settlement?
No. As of October 17, 2026 the case is at the complaint stage. There is no settlement, no settlement fund and no claim form, and no class has been certified. The lawsuit was filed one day earlier.
Who is Valenti Southeast Management?
According to the complaint, Valenti Southeast Management, LLC is a Florida company based in Tampa that operates restaurant franchises and has historically managed Wendy’s fast-food restaurants and Chili’s Grill & Bar locations. Wendy’s and Chili’s themselves are not defendants in the case.
Has Valenti sent data breach notice letters?
Not according to the complaint, which says that as of October 16, 2026 Valenti had not begun formally notifying the people whose information was involved. Valenti has not publicly confirmed the scope of the incident or how many people it affects.
What does Interlock have to do with the case?
The complaint says the ransomware group Interlock claimed responsibility for the attack on October 12, 2026, listed Valenti on its leak site, and posted folders it said held stolen documents. Those are the group’s own claims as described in the complaint; they have not been verified in court.
Who would be in the proposed class?
The complaint proposes a nationwide class of all individuals residing in the United States whose private information was compromised in the Valenti data breach, including anyone who receives a breach notice. The complaint focuses on current and former employees. A court has not certified any class.
Sources
- James v. Valenti Southeast Management, LLC — docket, U.S. District Court for the Middle District of Florida (CourtListener)
- Class Action Complaint, filed October 16, 2026 (CourtListener)
