Equifax’s data breach is likely to be one of the most costly hacks in corporate history. The credit reporting firm is already facing a series of class action lawsuits and investigations by the U.S. Federal Trade Commission and various state attorneys general.

A ruling by Suffolk County Superior Court Judge Kenneth Salinger in Boston, which was made public on Wednesday, has allowed the state of Massachusetts to move forward with its lawsuit against credit reporting firm Equifax Inc for failing to safeguard its databases or provide prompt notice of a breach which exposed the personal data of 147 million U.S. citizens.

Superior Court Judge Kenneth Salinger denied a motion by Equifax to dismiss a lawsuit by Massachusetts Attorney General Maura Healey following the disclosure of the breach in September 2017.

As per Massachusetts Attorney General Maura Healey’s lawsuit, Equifax was in violation of its legal duties to address all reasonably foreseeable risks to its data security and to implement reasonably up-to-date fixes to its software.

Further, the lawsuit alleges that Equifax knew or should have known, by March 2017, that a serious security vulnerability existed in the computer code that it used in its systems; however despite it failed to patch or upgrade its software to eliminate it.

Hackers were able to exploit these vulnerabilities and were able to gain access to its databases and steal personal information, alleged the lawsuit.

“These allegations state a viable claim for violation of the data security regulations,” wrote Salinger.

Equifax declined to comment.

As a result of the data breach, this is one of several legal challenges which Equifax is facing. It is also facing a series of class action lawsuits and investigations by the U.S. Federal Trade Commission and various state attorneys general.

In a statement, Healey, a Democrat, said her office was prepared to make its case in court to protect state residents and prevent future breaches.

“Today’s order confirms that Equifax is not above the law and can be held accountable for violating the rights of Massachusetts consumers,” said Healey.

In March 2018, Equifax said it expects costs, related to its massive data breach, to surge by $275 million this year.