Merrell v. Inotiv, Inc.

discovery and nonclinical development through investigational new drug (IND) and beyond.”¹

4. On August 8, 2025 , Defendant became aware of a cybersecurity incident that encrypted certain elements of its IT Network.² Upon discovery, Defendant launched an investigation to determine the nature and scope of the Data Breach.³

5. Upon information and belief, Qilin, a ransomware group, accessed Defendant’s IT network and stole 176 gigabytes of data.⁴ Additionally, Qilin claims to have stolen around 162,000 of Defendant’s files and published and/or made available for purchase the Plaintiff and Class Members’ Private Information on the dark web.⁵

6. On August 8, 2025 , Defendant issued a public disclosure through Form 8-k to the United States Securities and Exchange Commission.⁶

7. The Data Breach was a direct result of Defendant’s failure to implement adequate and reasonable cyber-security procedures and protocols necessary to protect individuals’ Private Information with which it was entrusted for research operations with Defendant.

8. Businesses like Defendant’s that collect individuals’ Private Information owe individuals to whom the information relates a duty to protect the Private Information from disclosure and theft and to keep it safe and confidential. This duty arises under contract, statutory,

¹ http://www.inotiv.com/about (last visited August 25, 2025 ).

²Form 8-K, Inotiv, Inc., United States Securities and Exchange Commission: http://www.sec.gov/Archives/edgar/data/ / /notv- .htm (last visited August 25, 2025 ).

³Id.

⁴ http://www.bleepingcomputer.com/news/security/pharma-firm-inotiv-says-ransomware-attack-impacted-operations/ (last visited August 7, 2025 ).

⁵Id.

⁶Form 8-K, Inotiv, Inc., United States Securities and Exchange Commission: http://www.sec.gov/Archives/edgar/data/ / /notv- .htm (last visited August 25, 2025 ).

and common law, industry standards, representations made to Plaintiff and Class Members, and because it is foreseeable that hackers with nefarious intentions will target the Private Information and use it to harm the affected individuals.

9. Upon information and belief, Defendant breached its duties and obligations by failing, in one or more of the following ways: (1) failing to design, implement, monitor, and maintain reasonable network safeguards against foreseeable threats; (2) failing to design, implement, and maintain reasonable data retention policies; (3) failing to adequately train staff on data security; (4) failing to comply with industry-standard data security practices; (5) failing to warn Plaintiff and Class Members of Defendant’s inadequate data security practices; (6) failing to encrypt or adequately encrypt the Private Information; (7) failing to recognize or detect that its network had been compromised and accessed in a timely manner to mitigate the harm; (8) failing to utilize widely available software able to detect and prevent this type of attack; and (9) otherwise failing to secure the hardware using reasonable and effective data security procedures free of foreseeable vulnerabilities and data security incidents.

10. Defendant understood its obligations and promised to safeguard Plaintiff’s and Class Members’ Private Information. Plaintiff and Class Members relied on these implied promises when seeking out and obtaining Defendant’s services. But for this mutual understanding, Plaintiff and Class Members would not have provided Defendant with their Private Information. Defendant, however, did not meet these reasonable expectations, causing Plaintiff and Class Members to suffer injury.

11. Defendant disregarded the rights of Plaintiff and Class Members by, inter alia, intentionally, willfully, recklessly, and/or negligently failing to take adequate and reasonable measures to ensure its data systems were protected against unauthorized intrusions; failing to