A group of ex-employees of Sony Pictures Entertainment will be allowed to proceed with their class action lawsuit’s claim that the studio was negligent in failing to maintain adequate security measures.

In a ruling on Monday, U.S. District Judge Gary Klausner dismissed other portions of their lawsuit, including breach of implied contract, violation of the California Customer Records Act and violation of consumer laws in Virginia and Colorado. He also tossed the portion of the plaintiffs’ negligence claim as it applied to breach of duty to timely notify the ex-employees of the breach.

But his ruling keeps alive litigation that was filed in the wake of the data breach, with ex-employees alleging that their personal information was compromised and that Sony failed to take adequate measures to protect it.

SPE had challenged the employees’ standing, contending that they failed to allege a current injury or one certainly impending.

Klausner, however, noted that the plaintiffs claim that their information has been used to send threatening emails to employees and their families. They also contend that their information has been posted on file-sharing websites.

“These allegations alone are sufficient to establish a credible threat of real and immediate harm, or certainly impending injury,” he wrote.

Klausner also said that the plaintiffs could pursue claims of violation of the California Confidentiality of Medical Information Act, violation of the unfair competition law and declaratory judgment.

The first lawsuit was filed by Michael Corona on Dec. 15, and his cases were later consolidated with claims from eight other ex-employees.