J.B. Hunt Data Breach Lawsuit, Four Class Actions Filed After October 2026 Cyberattack, What Was Exposed and Who May Qualify?
J.B. Hunt Transport Services is facing four proposed federal class actions after a cybersecurity incident involving unauthorized access to part of its computer systems. The lawsuits accuse the Arkansas-based trucking and logistics company of failing to protect sensitive personal information belonging to current and former employees.
The first three cases were filed on October 27, 2026, and a fourth followed on October 28, all in the U.S. District Court for the Western District of Arkansas, Fayetteville Division. Five people are named as plaintiffs: Wendy Parnell, Shileen Lange, Aaron Hunter, Kevin Manteufel and Anthony Walker. The plaintiffs ask for a jury trial.
The lawsuits followed a claim by a ransomware group calling itself Whitearmor, which says it stole 140,838 employee records and demanded $5 million. Here is where the facts stand. J.B. Hunt has confirmed a cybersecurity incident. It has not confirmed that 140,838 records were taken, has not said which personal information was affected, and has not announced how many people are impacted. The 140,838 figure comes from the hackers and is unverified.
The cases are at a very early stage. The plaintiffs have asked the court to combine them, and J.B. Hunt has not been found liable for anything.
As of October 31, 2026, there is no approved settlement, no official claim form and no confirmed payout.
J.B. Hunt Data Breach Lawsuit: Quick Facts
| Detail | Information |
| Company | J.B. Hunt Transport Services, Inc. (Lowell, Arkansas) |
| Ransomware group | Whitearmor |
| Claimed stolen employee records | 140,838 (hacker claim, unverified) |
| Reported ransom demand | $5 million |
| Whitearmor leak-site listing | On or around October 23, 2026 |
| Lawsuits filed | October 27–28, 2026 (four proposed class actions) |
| Court | U.S. District Court, Western District of Arkansas |
| Named plaintiffs | Five |
| Main claims | Negligence, breach of implied contract, plus other theories depending on the complaint |
| Company statement | October 29, 2026: investigating unauthorized access |
| Motion to consolidate | Filed October 29, 2026 (J.B. Hunt does not oppose) |
| Class certified | No |
| Settlement or claim form | None |
What Happened in the J.B. Hunt Data Breach?
The incident became public in late October 2026, when Whitearmor listed J.B. Hunt on its dark-web leak site and said it had gotten into the company’s network.
That matters because J.B. Hunt runs a large transportation and logistics operation. It holds information about employees, drivers, carriers, customers and business partners, so an intrusion could touch more than one group of people.
October 23: Whitearmor makes its claim
According to the complaints, Whitearmor said it had 140,838 employee records containing personal information and national identification numbers, and it asked for $5 million in cryptocurrency. The complaints and cybersecurity reporting also describe other hacker claims:
- About 1.7 million carrier contacts
- About 38.2 million invoices
- About 187,000 access-permission records
- About 3,196 ranked account-takeover targets
- About 973 Microsoft 365 mailboxes
- Records tied to about 374,000 organizations
Every one of these numbers comes from the threat actor. J.B. Hunt has not confirmed them, and no independent investigation has verified them in public.
October 26: Law firms start investigating
Several law firms announced investigations and invited affected people to get in touch. Those announcements are marketing and intake. They do not show that anyone qualifies for a lawsuit or settlement.
October 27–28: Four class actions are filed
Former employees filed four proposed class actions in Arkansas federal court. They argue J.B. Hunt did not use adequate safeguards for the sensitive information it collected and kept.
October 29: J.B. Hunt confirms an investigation
The company gave a statement to KFSM 5NEWS:
“We are investigating a cybersecurity incident involving unauthorized access to certain information within an isolated portion of J.B. Hunt’s technology system.”
J.B. Hunt also said it had hired an outside cybersecurity firm, notified law enforcement, revoked the unauthorized access and kept operating without disruption to customer service.
The statement confirms an investigation into unauthorized access. It does not confirm which records were taken, how many people are affected, or any of Whitearmor’s claims. As of October 31, we found no detailed public accounting of the affected data.
What Information Was Allegedly Stolen?
This is the first thing most current and former employees want to know. Whitearmor says it holds roughly 140,838 employee records with personal information and national identification numbers.
The complaints discuss the kinds of data that could be involved, including:
- Full names
- Social Security numbers
- Dates of birth
- Driver’s license numbers
- State and other government ID numbers
- Contact and financial details
That list describes categories the plaintiffs say are at risk. It does not establish that each item was actually taken from J.B. Hunt, or that every person’s record contains all of them.
Why a Social Security number changes the risk
A name and email address create some privacy risk. A Social Security number combined with a date of birth and an address is far more useful to a criminal. With that information someone could try to open credit accounts, file a fraudulent tax return, claim unemployment benefits, impersonate you, or build convincing phishing messages. The information also stays valuable for years, which is why plaintiffs in these cases usually ask for long-term credit monitoring.
No verified public finding shows that information from this incident has been used for identity theft.
Are customers and carriers included?
Whitearmor claims access to carrier contacts, invoices, mailboxes and organization records. If true, business partners and commercial customers could be affected too. J.B. Hunt has not confirmed that, and the four lawsuits focus on people whose private information was accessed or acquired. The court has not decided who ends up in any class.
Who Filed the Four Lawsuits?
All four cases are in the Western District of Arkansas, Fayetteville Division.
| Case | Plaintiff(s) | Case number | Filed |
| Parnell v. J.B. Hunt Transport Services, Inc. | Wendy Parnell | 5:26-cv-05297 | Oct. 27 |
| Lange v. J.B. Hunt Transport Services, Inc. | Shileen Lange | 5:26-cv-05298 | Oct. 27 |
| Hunter v. J.B. Hunt Transport Services, Inc. | Aaron Hunter | 5:26-cv-05301 | Oct. 27 |
| Manteufel v. J.B. Hunt Transport Services, Inc., et al. | Kevin Manteufel and Anthony Walker | 5:26-cv-05303 | Oct. 28 |
Parnell was the first case filed. Plaintiffs now want it to serve as the lead case if the actions are combined. Her complaint lists her as an Arkansas resident from Bentonville, and the case is assigned to Judge David Clay Fowlkes.
Lange is a former employee who lives in Virginia, according to her complaint. She says she handed over sensitive personal information as a condition of her job. She wants to represent a nationwide class, and her case is assigned to Judge Timothy L. Brooks.
Hunter focuses on the alleged exposure of employee information and the company’s security duties. Reporting lists Hunter as a Georgia resident. His case is before Judge Fowlkes.
Manteufel and Walker is the only case that also names J.B. Hunt Transport, Inc. as a defendant, alongside J.B. Hunt Transport Services, Inc. It is also assigned to Judge Fowlkes.
A filed complaint is an accusation. It does not mean a class has been certified or that the company did anything wrong.
What the Plaintiffs Say J.B. Hunt Did Wrong
Across the complaints, the core argument is that J.B. Hunt collected and stored sensitive personal information without protecting it properly, and that stronger security could have prevented or limited the incident. None of this has been proven, and the company has not admitted any of it.
Not encrypting sensitive data. The Lange complaint says J.B. Hunt did not adequately encrypt or redact sensitive information.
Weak monitoring. The plaintiffs say better monitoring could have caught suspicious access sooner.
Ignoring security guidance. The complaints point to recommendations from the FTC, the FBI and Microsoft, including multifactor authentication, timely patching, limits on administrator access, network segmentation, staff training and regular vulnerability testing.
Keeping data too long. The plaintiffs say J.B. Hunt held personal information after it was no longer needed, which increased what could be exposed.
Late notice. Some complaints allege affected people were not told quickly enough. J.B. Hunt’s investigation was still underway when the suits were filed, so the date it determined what was taken, and whether notice duties were triggered, is not public.
The Legal Claims Explained
Not every complaint pleads the same claims. Negligence and breach of implied contract are the common ones. The others appear in some filings.
Negligence
The plaintiffs argue J.B. Hunt owed them a duty of reasonable care in collecting and protecting their data. To win, a plaintiff generally has to show a duty, a breach of that duty, causation, and damages the law recognizes. J.B. Hunt can challenge each element.
Negligence per se
The Lange complaint builds this claim partly on Section 5 of the FTC Act, 15 U.S.C. § 45, which bans unfair or deceptive practices. There is a hurdle here. The FTC Act itself does not give private individuals a right to sue, and courts have disagreed about whether a negligence per se theory can rest on Section 5. The judge will also look at whether the applicable state law allows the theory at all.
Breach of implied contract
The plaintiffs say employees gave up their information with the understanding that the company would protect it, and that failing to do so broke an implied agreement. J.B. Hunt may argue no enforceable contract existed, or that its terms were different.
Unjust enrichment
Some complaints say J.B. Hunt benefited from using employee data while spending too little on security. This is an equitable claim, and whether it survives can depend on whether another contract covers the same subject.
Invasion of privacy and breach of fiduciary duty
The Hunter complaint adds both. Fiduciary duty is a tough claim in data cases, because a plaintiff must show a legally recognized fiduciary relationship. Simply holding someone’s data usually does not create one.
Injunctive and declaratory relief
The plaintiffs also want court orders requiring better security, not only money. In data breach cases, that is often the point as much as damages.
Arkansas Law: The Personal Information Protection Act
Arkansas has a statute aimed at exactly this situation, the Personal Information Protection Act, Arkansas Code Title 4, Chapter 110. Two sections matter most.
§ 4-110-104: Reasonable security and disposal
A business that acquires, owns or licenses personal information about Arkansas residents must put in place reasonable security procedures suited to the sensitivity of the data. It must also take reasonable steps to destroy records containing personal information once they are no longer needed. That second duty lines up with the plaintiffs’ claim that J.B. Hunt kept data too long.
§ 4-110-105: Breach notification
Under subsection (a), a business must notify Arkansas residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Notice must come in the most expedient time possible and without unreasonable delay. The law allows a delay for a law enforcement investigation and for the time needed to work out the scope of the breach and restore system integrity.
Two other parts of the section are easy to get wrong:
- Harm exception. Under subsection (d), notice is not required if, after a reasonable investigation, the business determines there is no reasonable likelihood of harm to customers.
- Attorney General notice. Under subsection (b)(2), when a breach affects the personal information of more than 1,000 people, the business must tell the Arkansas Attorney General at the same time it notifies individuals, or within 45 days after it determines there is a reasonable likelihood of harm, whichever comes first. The 45 days is not a general deadline for notifying every employee.
The law also requires businesses to keep their written breach determination and supporting documents for five years.
Does Arkansas law cover everyone?
Not automatically. The statute protects Arkansas residents. Plaintiffs elsewhere may rely on their own state’s breach and privacy laws, and because the proposed class is nationwide, the court may have to sort out which state’s law applies to which plaintiff.
Did the plaintiffs sue directly under the Arkansas statute?
Based on the Lange complaint’s listed counts (negligence, negligence per se, breach of implied contract and unjust enrichment), there is no standalone Arkansas PIPA count. The statute is useful background for what reasonable security and timely notice look like, but we cannot say it is a pleaded claim in every case. A consolidated complaint may change that.
Can J.B. Hunt Argue There Was No Real Harm?
Yes, and expect it to. Federal courts require a concrete and particularized injury before a case can proceed, a requirement known as Article III standing. Two Supreme Court decisions frame the issue: Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), and TransUnion LLC v. Ramirez, 594 U.S. 413 (2021). In TransUnion, the Court said that the risk of future harm alone generally does not support a damages claim, though a sufficiently imminent and substantial risk can support forward-looking relief such as an injunction.
That does not mean a plaintiff must already be a victim of identity theft. Actual misuse of data, out-of-pocket losses, time and money spent responding to the incident, and disclosure of private information can all count, depending on the facts.
The Western District of Arkansas sits in the Eighth Circuit. In In re SuperValu, Inc., Customer Data Security Breach Litigation, 925 F.3d 955 (8th Cir. 2019), the court separated plaintiffs who alleged actual misuse of their information from those who relied mainly on a general risk of future identity theft. Expect standing to be one of the first fights in this case.
Who Could Qualify as a Class Member?
The Lange complaint proposes a nationwide class of “all individuals whose Private Information was accessed and/or acquired by an unauthorized party in the Data Breach.”
The key phrase is accessed and/or acquired. Having worked at J.B. Hunt is not enough by itself. Depending on what the evidence shows and how the court defines the class, those affected could include current employees, former employees, drivers and others whose data sat in the affected systems. Business contacts would qualify only if they fall inside the final class definition.
Two points to keep straight:
- Employment alone does not prove your data was involved. The affected group has to be established, either by the company or through the litigation.
- No class has been certified. A complaint asking for class status is a request. The court has not ruled on it.
If a class is eventually certified or a class settlement is approved, members generally get formal notice and, in most cases, a chance to opt out. A settlement can also release claims you might otherwise bring on your own, which is one reason to read any official notice carefully.
The October 29 Motion to Consolidate
On October 29, 2026, the plaintiffs filed an Unopposed Motion to Consolidate Cases and Appoint Interim Co-Lead Counsel. They want the four cases combined under the first-filed Parnell case, No. 5:26-cv-05297. Consolidation is governed by Federal Rule of Civil Procedure 42, and interim leadership by Rule 23(g).
J.B. Hunt does not oppose consolidation, but it takes no position on who should lead the case. That is a procedural stance, not an admission of fault.
The plaintiffs ask the court to appoint Leanna A. Loginov of Shamis & Gentile, P.A. and Mariya Weekes of Milberg, PLLC as interim co-lead counsel. They also ask for 45 days after the court’s order to file a single consolidated complaint. As of October 31, 2026, the court had not ruled.
Consolidation avoids duplicate work on discovery, expert reports, motions and class certification. It does not decide whether J.B. Hunt was negligent, whether the data was really stolen, or whether anyone is owed money.
What Damages Are the Plaintiffs Seeking?
The complaints ask for several kinds of relief:
- Compensatory and consequential damages for losses the plaintiffs can tie to the incident
- Nominal damages where a right was violated without a large financial loss
- Punitive damages, where the law allows and the evidence supports them
- Attorney’s fees and costs, where a statute or rule permits
- Court-ordered changes, including stronger data security, better monitoring, independent annual security audits and continued credit monitoring for class members
Those are requests, not benefits anyone has today.
How much could an employee receive?
No one can say. The complaints do not set a payment schedule. Any recovery would depend on which claims survive, whether a class is certified, what damages are proven, and whether the case settles or goes to trial. Be wary of any site that advertises a specific J.B. Hunt payout, whether $100, $500 or $1,000.
Is There a J.B. Hunt Data Breach Settlement or Claim Form?
No. As of October 31, 2026:
| Question | Answer |
| Has J.B. Hunt admitted liability? | No |
| Has a court found it negligent? | No |
| Have four proposed class actions been filed? | Yes |
| Has a class been certified? | No |
| Has a settlement been announced? | No |
| Is there an official claim form or deadline? | No |
| Is there a confirmed payout? | No |
The $5 million figure is the ransom Whitearmor reportedly demanded. It is not a judgment or settlement owed to employees.
Some law firms invite people to submit details for a free case review. That is attorney intake, not a claim form, and it does not guarantee compensation. If a settlement is ever approved, the official notice will say who qualifies, how to file, the deadlines and the benefits.
How to spot a fake claim site
Breach lawsuits attract scams. Be cautious if a website or message asks for your Social Security number just to “register” for a J.B. Hunt payment, promises a fixed payout, pressures you with a deadline, or asks for a fee. A real settlement notice comes through a court-approved administrator and never asks you to pay to participate.
What Current and Former J.B. Hunt Employees Should Do Now
The scope of the incident is not public yet, but there are sensible steps you can take today.
Watch your accounts. Look for purchases you do not recognize, new credit accounts, unexpected login alerts and unfamiliar loan or credit applications. Report suspicious activity to your bank right away.
Consider a credit freeze. A freeze makes it harder for someone to open new credit in your name. It is free at each of the three bureaus: Equifax, Experian and TransUnion. It does not stop every kind of identity theft, but it blocks a common one.
Change reused passwords. If you used the same password for a J.B. Hunt account and anything else, change it everywhere and turn on multifactor authentication.
Expect phishing. Criminals holding employee data often pose as HR, payroll, benefits providers, banks or IT support. Do not click unexpected links or share passwords or verification codes in response to unsolicited messages. Attackers also tend to follow up on a breach with fake “security alerts,” a pattern we saw in our coverage of the second Citizens Bank data breach class action.
Keep any notice you receive. If J.B. Hunt sends a letter, save it. It should say which of your information was involved, the date range, whether your Social Security number was exposed, and whether credit monitoring is offered and for how long. That letter tells you far more about your personal risk than a ransomware group’s boast.
Report identity theft. If someone misuses your information, report it at IdentityTheft.gov, the FTC’s official resource. Do not wait for the lawsuit to play out. Our guide to the OneMain Financial data breach lawsuit walks through similar protective steps for people whose financial details were exposed.
The Earlier 2021 J.B. Hunt Data Incident
This is not J.B. Hunt’s first data security problem, and readers often confuse the two.
In 2021, J.B. Hunt disclosed an issue involving third-party application software used in its driver-applicant process, caused by a configuration error. According to its notice to the Maine Attorney General, the incident ran from August 17, 2020, through July 2, 2021, was discovered on September 10, 2021, and affected about 231,687 people. Names and Social Security numbers were exposed, and written notices began in October 2021. A proposed class action, Wilson v. J.B. Hunt Transport, Inc., No. 5:21-cv-05194, was filed on November 1, 2021.
| 2021 incident | 2026 incident | |
| Cause | Third-party software configuration error | Alleged unauthorized system access and ransomware claim |
| Population | Driver applicants | Employees and possibly others |
| Period | 2020–2021 | Reported October 2026 |
| People affected | About 231,687 | Unconfirmed (hackers claim 140,838 employee records) |
The earlier incident does not prove negligence in the new one. Each needs its own facts and legal analysis.
Other J.B. Hunt Lawsuits Not to Confuse With This One
J.B. Hunt has appeared in other cases that have nothing to do with the October 2026 cyberattack:
- A background-check case, Taylor v. J.B. Hunt Transport Services, Inc., involving Fair Credit Reporting Act allegations about notices given to applicants or employees.
- An Illinois Biometric Information Privacy Act (BIPA) class settlement of about $976,000, reported in connection with Lytx inward-facing driver cameras. It concerns facial scans collected from Illinois employees, not stolen data, and it does not compensate people affected by this incident.
Data security cases also tend to follow similar patterns, so it helps to compare. See our coverage of the ADT data breach class action involving 5.5 million records for another recent example where hacker claims and company confirmations did not match.
What Happens Next
- Consolidation and leadership. The court decides whether to combine the four cases under Parnell and who should be interim co-lead counsel. J.B. Hunt does not oppose consolidation.
- A consolidated complaint. If the motion is granted, plaintiffs have asked for 45 days to file one complaint. It may refine the class definition and the legal claims.
- J.B. Hunt responds. The company can challenge standing and the legal sufficiency of the claims, dispute the alleged security failures, and contest class certification.
- Discovery. If the case survives early motions, the parties may dig into what systems were accessed, what data was copied, when the company found out, what security controls existed, whether any identity theft occurred, and when people were notified. Whitearmor’s claims will have to be tested against the company’s forensic findings.
- Class certification and resolution. The court decides whether the case meets Rule 23. After that, the parties may settle or head toward trial. No outcome can be predicted yet.
Timeline
| Date | Development |
| Aug. 17, 2020 – July 2, 2021 | Separate earlier incident involving third-party applicant software |
| Sept. 10, 2021 | Earlier incident discovered |
| Oct. 2021 | Notices sent for the earlier incident |
| Nov. 1, 2021 | Wilson v. J.B. Hunt filed |
| On or around Oct. 23, 2026 | Whitearmor lists J.B. Hunt and claims 140,838 employee records |
| Oct. 26, 2026 | Law firms announce investigations |
| Oct. 27, 2026 | Parnell, Lange and Hunter filed |
| Oct. 28, 2026 | Manteufel and Walker filed |
| Oct. 29, 2026 | J.B. Hunt confirms an investigation; plaintiffs move to consolidate |
| Oct. 31, 2026 | No settlement, class certification or liability finding identified |
Sources and Legal References
Court filings
- Lange v. J.B. Hunt Transport Services, Inc., No. 5:26-cv-05298 – Class Action Complaint (Oct. 27, 2026)
- Parnell v. J.B. Hunt Transport Services, Inc., No. 5:26-cv-05297 – Class Action Complaint
- Plaintiffs’ Motion to Consolidate and Appoint Interim Co-Lead Counsel (Oct. 29, 2026)
- Parnell docket | Lange docket | Hunter docket | Manteufel docket
Reporting
- KFSM 5NEWS – Multiple Class Action Suits Filed Over Reported J.B. Hunt Data Breach
- OpenClassActions – J.B. Hunt Data Breach Lawsuits
- Class Action Pulse – J.B. Hunt Data Breach Lawsuit
Arkansas law
- Ark. Code § 4-110-104 – Protection of personal information
- Ark. Code § 4-110-105 – Disclosure of security breaches
- Arkansas Attorney General – Security or Data Breach guidance
Federal law and cases
- FTC Act, 15 U.S.C. § 45
- Fed. R. Civ. P. 23 and Rule 42
- Spokeo, Inc. v. Robins, 578 U.S. 330 (2016)
- TransUnion LLC v. Ramirez, 594 U.S. 413 (2021)
- In re SuperValu, Inc., 925 F.3d 955 (8th Cir. 2019)
Earlier J.B. Hunt matters
- Maine Attorney General – J.B. Hunt 2021 breach notice
- Wilson v. J.B. Hunt – 2021 applicant data breach lawsuit
- ClaimsHero – J.B. Hunt BIPA settlement summary
About the Author
Researched and written by Israr Ahmad, legal content researcher covering U.S. data breaches, class action lawsuits, privacy law, cybersecurity litigation and consumer protection.
This article is based on public court complaints, consolidation filings, statutes, government records and established news reporting. The hacker group’s claims about the number and types of stolen records have not been independently verified, and the allegations in the proposed class actions are not findings of fact or liability. We update this page as the court acts.
AllAboutLawyer.com is an independent legal information website, not a law firm, and Israr Ahmad is not an attorney. This article is for general information only and is not legal advice. If you think your information was exposed, or you are weighing legal action, speak with a licensed attorney in your state.
Last updated: October 31, 2026
About the Author
Israr Ahmad is a legal content researcher with 4+ years of experience covering class action settlements and consumer rights cases. He has researched and published coverage of 2,500+ settlements using verified court records, settlement administrator filings, and government sources. Learn more about Israr.