Dollar Tree and Family Dollar job applicants and employees whose Social Security numbers were exposed in the 2023 Zeroed-In Technologies breach may be covered by a proposed class action alleging Zeroed-In failed to protect their data. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a pending class action. The claims are unproven allegations. Zeroed-In Technologies, Dollar Tree and Family Dollar have not been found liable, there is no certified class, and there is nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
In August 2023, hackers got into the systems of Zeroed-In Technologies, LLC, an HR data vendor used by Dollar Tree and Family Dollar, and took names, birth dates and Social Security numbers belonging to about 1.98 million people, most of them the two retailers’ job applicants and current and former employees.Almost three years later, there is still no settlement. More than a dozen lawsuits were combined into one class action in federal court in Maryland, In re Zeroed-In Technologies, LLC Data Breach Litigation, No. 1:23-cv-03284-BAH. In March 2025 the judge sent most of the claims against Dollar Tree and Family Dollar to individual arbitration while letting the core claims against Zeroed-In go forward, and settlement talks with Zeroed-In have not produced a deal. Dollar Tree, meanwhile, is suing Zeroed-In in Virginia over who should pay for the breach.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
The 2023 Breach
Zeroed-In reported that an unauthorized party accessed its systems on August 7 and 8, 2023. In a notice filed with the Maine Attorney General in late November 2023, it put the number of affected people at about 1,977,486 and said the exposed data included names, dates of birth and Social Security numbers. Affected people were offered 12 months of identity protection and credit monitoring, BleepingComputer reported.Zeroed-In told Dollar Tree that some of the compromised information related to people associated with Dollar Tree and Family Dollar, which together operate more than 16,000 stores. A Family Dollar spokesperson said at the time that “Zeroed-In is a vendor that we and other companies use,” and that the company had informed the retailer of a security incident and notified current and former employees.
How the Lawsuits Were Combined
The first suit, Gordon v. Zeroed-In Technologies, LLC, was filed in the U.S. District Court for the District of Maryland on December 4, 2023. More than a dozen similar suits against Zeroed-In, Dollar Tree and Family Dollar followed in early 2024, and they were consolidated before U.S. District Judge Brendan A. Hurson. The plaintiffs filed a consolidated class action complaint on April 15, 2024, alleging the companies failed to adequately protect the data and bringing claims including negligence, breach of contract and unjust enrichment.March 2025: Arbitration for Dollar Tree, Claims Survive Against Zeroed-In
Judge Hurson issued two rulings on March 26, 2025. In the first, he granted Dollar Tree and Family Dollar’s motion to compel arbitration as to 22 of the named plaintiffs, finding they had accepted arbitration agreements that require disputes to be brought individually and not as a class, and held that class action waiver enforceable. He denied the motion as to two plaintiffs, ordering a jury trial on whether they had agreed to arbitrate, and one plaintiff was not subject to arbitration at all. The two plaintiffs later dropped their claims against the retailers, and as of April 2026 one plaintiff remained with claims against Dollar Tree and Family Dollar in court.In the second ruling, he partly granted and partly denied Zeroed-In’s motion to dismiss. Claims for negligence, breach of a third-party beneficiary contract and unjust enrichment against Zeroed-In went forward, Bloomberg Law reported, while a breach of fiduciary duty claim and a standalone declaratory judgment claim were dismissed.
Whether any of the employees sent to arbitration have pursued individual arbitrations is not public. Arbitration proceedings are private, and no reporting has described arbitration filings in this matter.
Settlement Talks and the 2026 Schedule
In June 2025 the court paused the case so the parties could exchange information and mediate. The plaintiffs and Zeroed-In held a private mediation on December 9, 2025 without reaching an agreement, and in an April 17, 2026 joint status report they said they would continue settlement discussions as discovery proceeds. The court lifted the stay the same day.That report proposed a schedule with fact discovery substantially complete by August 28, 2026, a class certification motion by September 21, 2026, Zeroed-In’s opposition by November 16, 2026 and the plaintiffs’ reply by December 18, 2026. The public docket did not yet show whether the motion was filed on that schedule. In April 2026, seven named plaintiffs voluntarily dismissed their claims against Zeroed-In without prejudice, leaving 18 named plaintiffs with claims against the vendor.
Dollar Tree Sues Zeroed-In
On April 18, 2025, Dollar Tree Management, LLC, Dollar Tree, Inc. and Family Dollar, LLC sued Zeroed-In in the U.S. District Court for the Eastern District of Virginia in Norfolk, No. 2:25-cv-239. The case is a contract dispute over the scope of Zeroed-In’s alleged obligation to indemnify Dollar Tree under the agreement through which Zeroed-In provided software and services and received the employee data. On October 28, 2025, U.S. District Judge Jamar K. Walker denied Dollar Tree’s motion for partial judgment on its declaratory judgment claim, finding that Zeroed-In disputes material facts.That suit is between the companies and does not produce any payment to the people whose data was exposed.
What Happens Next
The next milestone in the Maryland case is a ruling on class certification for the claims against Zeroed-In. A settlement could come before or after that ruling. If the case settles, a court-approved notice would describe who qualifies, what proof a claim requires and the deadline, and OCA will update this page.Questions
Is there a Zeroed-In or Dollar Tree data breach settlement?
There is no settlement as of October 21, 2026. The plaintiffs and Zeroed-In Technologies mediated on December 9, 2025 without reaching a deal and told the court in April 2026 that settlement discussions would continue. There is no claim form or deadline.
Why were the claims against Dollar Tree sent to arbitration?
On March 26, 2025, U.S. District Judge Brendan A. Hurson ruled that 22 of the named plaintiffs had agreed to arbitration agreements with Dollar Tree, including a waiver of class claims, so their claims against Dollar Tree and Family Dollar must be arbitrated individually. The ruling turned on the arbitration agreements those employees accepted; claims against the vendor, Zeroed-In, were not part of it.
What information was exposed in the Zeroed-In breach?
Zeroed-In Technologies reported that an unauthorized party accessed its systems on August 7 and 8, 2023 and that names, dates of birth and Social Security numbers were exposed. Its notice to the Maine Attorney General put the number of affected people at about 1,977,486, mostly applicants and current and former employees tied to Dollar Tree and Family Dollar.
Why is Dollar Tree suing Zeroed-In?
Dollar Tree Management, LLC sued Zeroed-In Technologies in federal court in Norfolk, Virginia, on April 18, 2025, in a contract dispute over the scope of Zeroed-In’s alleged obligation to indemnify Dollar Tree for the breach. On October 28, 2025, the judge denied Dollar Tree’s request for an early ruling on its declaratory judgment claim because Zeroed-In disputes material facts.
Sources
• Memorandum Opinion on the motion to compel arbitration, ECF No. 124 (D. Md. Mar. 26, 2025)• Memorandum Opinion on Zeroed-In’s motion to dismiss, ECF No. 126 (D. Md. Mar. 26, 2025)
• Joint Status Report, ECF No. 148 (D. Md. Apr. 17, 2026)
• In re Zeroed-In Technologies, LLC Data Breach Litigation, No. 1:23-cv-03284-BAH (D. Md.), docket via CourtListener
• Bloomberg Law, “Employees Advance Data-Breach Suit Against Dollar Tree Vendor”
• BleepingComputer, “Dollar Tree hit by third-party data breach impacting 2 million people” (November 29, 2023)
• SecurityWeek, “Dollar Tree Impacted by ZeroedIn Data Breach Affecting 2 Million Individuals” (November 30, 2023)
• Dollar Tree Management, LLC v. Zeroed-In Technologies, LLC, No. 2:25-cv-239 (E.D. Va.), order of October 28, 2025, as summarized by Virginia Lawyers Weekly
