Published
October 15, 2026
People whose information was exposed in the February 2026 Tower Administrative Services data breach may be covered by a proposed class action alleging Tower failed to protect their names, Social Security numbers and financial account information. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes class action complaints. The statements below are unproven allegations. Tower Administrative Services, Inc. has not admitted wrongdoing and has not been found liable, there is no certified class, and there is nothing to claim at this time. This page is informational. It is not legal advice.
What the Tower Administrative Services Lawsuits Are About
Tower Administrative Services, Inc. is a company that, according to the first complaint filed against it, administers the payment of insurance premiums and provides customer service or mortgage acceleration programs. The complaint places its principal place of business in Lancaster, Pennsylvania. Tower says in an online notice that someone gained unauthorized access to information in its systems on or around February 3, 2026, and that the exposed information may have included names, addresses, Social Security numbers and financial account information.The lawsuits that followed allege that the intrusion happened because Tower did not adequately secure its network, and that it then waited months to tell the people whose information was involved. The first complaint says the files of tens of thousands of people were accessed. Tower’s notice says it is not aware of any evidence that the information has been or will be misused.
That first complaint, No. 5:26-cv-04490, was filed on June 29, 2026 in the U.S. District Court for the Eastern District of Pennsylvania, and multiple similar suits were filed in the same court over the following days. On July 28, 2026, the court granted in part and denied in part the plaintiffs’ unopposed motion to consolidate the cases, and a Consolidated Class Action Complaint was filed in the lead case on August 28, 2026. Tower has not admitted wrongdoing, and no court has ruled on whether any of the allegations are true.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Status
Lawsuits Consolidated · Complaint Stage
Lead case No. 5:26-cv-04490 · E.D. Pa. · consolidation granted in part July 28, 2026 · no class certified
Information Exposed
Names, addresses, Social Security numbers and financial account information
Varies by person, per Tower’s notice · tens of thousands of people affected, per the first complaint
Can I Claim?
No — nothing to claim yet
No settlement, no claim form and no deadline
Timeline: From the Network Intrusion to the Consolidated Complaint
The breach dates below come from Tower’s online notice and the first complaint; the litigation dates come from the court docket.- February 3, 2026 — Information in Tower’s systems is subject to unauthorized access, according to Tower’s notice.
- February 4, 2026 — Tower discovers suspicious activity on its network. Its notice says it moved to secure the network and brought in third-party specialists to investigate.
- May 20, 2026 — Tower finishes reviewing what data was at risk and whom it relates to, according to its notice. Tower then works to confirm contact information so it can notify affected people; the notice does not give the date letters were mailed.
- June 29, 2026 — The first class action complaint is filed in the Eastern District of Pennsylvania. More suits follow in the same court in the next few days.
- July 24, 2026 — The plaintiffs move to consolidate the cases and to have their lawyers appointed to lead them.
- July 28, 2026 — The court grants the unopposed consolidation motion in part and denies it in part.
- August 28, 2026 — A Consolidated Class Action Complaint is filed in the lead case on behalf of eight named plaintiffs.
- September 9, 2026 — Tower files a joint stipulated briefing schedule.
- September 14, 2026 — The plaintiffs file a renewed motion to appoint counsel.
What Information Was Involved
Tower’s notice says the information involved varies from person to person and may have included:- Names
- Addresses
- Social Security numbers
- Financial account information
The first complaint lists the same four categories. It also alleges that Tower’s notification did not tell recipients whether their driver’s license numbers were compromised, leaving them unsure how much of their information was exposed. Tower’s notice does not list driver’s license numbers among the affected data.
Who Is Affected
The people at the center of the case are those whose information was in the files accessed during the intrusion. The first complaint alleges that they had to give Tower their personal information in order to receive insurance or mortgage payment services, and that the lead plaintiff received a notice letter from Tower saying her information had been exposed. The complaint estimates the number affected at tens of thousands of people across the United States, citing Tower’s notice and a state attorney general’s data breach report; it does not give an exact count, and the court documents reviewed for this article do not name the insurers or lenders whose customers were involved.Tower’s notice says it is notifying potentially affected individuals and providing access to credit monitoring services at no cost to them.
What the Complaint Alleges
The first complaint, filed June 29, 2026, makes these core allegations against Tower:- Tower collected and stored customers’ personal information as part of its business and, by doing so, took on a duty to protect it.
- Tower did not spend enough on encrypting sensitive data, blocking outside access, detecting intrusions or training employees to recognize hacking threats.
- Tower failed to detect the breach in time and then took months to notify the people affected, which the complaint says made the harm worse.
- On information and belief, the attackers removed the information from Tower’s network and have been marketing and selling it on the dark web.
- The people affected now face a continuing risk of identity theft and have already lost time and money responding to the breach.
The complaint also points to the Federal Trade Commission Act and to state laws as sources of Tower’s alleged duty to keep the data secure, and to Tower’s own privacy policy as reinforcing that duty. Tower has not admitted any of these allegations, and none has been proven.
The Consolidated Case in Pennsylvania Federal Court
The first suit was assigned to District Judge Jeffrey L. Schmehl in the Eastern District of Pennsylvania. Within days, multiple other proposed class actions over the same breach were filed in that court. On July 24, 2026, the plaintiffs in the lead case asked the court to consolidate the related cases and to appoint their lawyers to lead the litigation. Chief Judge Wendy Beetlestone signed an order on July 28, 2026 granting that unopposed motion in part and denying it in part. The text of the order is not publicly posted on CourtListener, so the exact list of cases it combined is not available there.On August 28, 2026, eight named plaintiffs filed a Consolidated Class Action Complaint in the lead case. That pleading now governs the litigation, and its class definitions, legal claims and requests for relief may differ from the original complaint described on this page. Tower filed a joint stipulated briefing schedule on September 9, 2026, and the plaintiffs filed a renewed motion to appoint counsel on September 14, 2026. CourtListener’s copy of the docket showed no ruling on that renewed motion as of October 15, 2026.
The Proposed Class
The original complaint asks the court to certify a nationwide class of all persons residing in the United States whose personal information was exposed to unauthorized individuals as a result of the Tower data breach. It reserves the right to amend that definition or propose subclasses, and the consolidated complaint may define the class differently. No class has been certified. Until a court certifies a class, no one is a class member in a legal sense.Claims and Relief Sought
The original complaint brings three claims on behalf of the proposed nationwide class:- Negligence
- Breach of implied contract
- Unjust enrichment, pleaded in the alternative
It asks for actual damages, restitution and disgorgement, and pre- and post-judgment interest, along with attorneys’ fees and costs. It also asks for court-ordered improvements to Tower’s data security, including periodic third-party security audits and penetration testing, automated security monitoring, segmentation of customer data, an end to transmitting or storing personal information in email, deletion of customer data Tower no longer needs, and ongoing security training. The complaint further seeks Tower-funded long-term credit monitoring and an order requiring Tower to pay the cost of notifying class members and administering any claims process. These are requests, not outcomes, and the consolidated complaint may seek different relief.
What Happens Next
In data breach class actions at this stage, the defendant commonly responds to the consolidated complaint, often with a motion to dismiss some or all of the claims. The docket entry for the joint briefing schedule Tower filed in September does not describe which filing it covers. The court may also rule on the pending request to appoint the lawyers who will lead the case for the plaintiffs. If the case survives a motion to dismiss, it would typically move into discovery and, later, a motion for class certification. A case like this can also be resolved through a settlement at any point, which would need court approval before any payments could be made.Is There Anything to Claim?
There is nothing to claim. The Tower Administrative Services lawsuits have not produced a settlement, there is no settlement fund, claim form, settlement website or deadline, and no class has been certified. If the case settles, a court-approved notice would describe who qualifies and how claims would be filed.Questions
Is there a Tower Administrative Services data breach settlement?
There is no settlement. The proposed class actions over the February 2026 Tower Administrative Services breach are pending in the U.S. District Court for the Eastern District of Pennsylvania, where the court consolidated the cases in part on July 28, 2026. No class has been certified, and there is no settlement fund, claim form or deadline.
What does Tower Administrative Services do?
According to the first complaint, Tower Administrative Services, Inc. administers the payment of insurance premiums and provides customer service or mortgage acceleration programs. The complaint places its principal place of business in Lancaster, Pennsylvania, and alleges that people gave Tower their personal information in order to receive insurance or mortgage payment services.
What information was exposed in the Tower Administrative Services data breach?
Tower's online notice says the affected information varies by person and may have included names, addresses, Social Security numbers and financial account information. The first complaint lists the same four categories and alleges the files of tens of thousands of people were accessed.
Did Tower Administrative Services offer credit monitoring?
Tower's online notice says it is providing access to credit monitoring services at no cost to potentially affected individuals. Separately, the lawsuits ask the court to order Tower to fund long-term credit monitoring, which would happen only through a judgment or a settlement.
Has Tower Administrative Services admitted wrongdoing?
Tower Administrative Services has not admitted wrongdoing, and no court has ruled on whether the allegations in the lawsuits are true. Its notice says it is not aware of any evidence that information has been or will be misused, while the complaint alleges, on information and belief, that the data was stolen and is being marketed on the dark web.
About This Page
OpenClassActions.com is a consumer news and information site, not a law firm. This article is general information about the Tower Administrative Services data breach lawsuits. It is not legal advice, and reading it does not create an attorney-client relationship.Sources
• Tower Administrative Services data breach litigation, E.D. Pa. No. 5:26-cv-04490 — CourtListener docket• Class action complaint, ECF No. 1 (filed June 29, 2026) — PDF via CourtListener RECAP
• Tower Administrative Services — Notification of Data Security Incident
For more class actions keep scrolling below.
Status
Consolidated · Complaint Stage · No Class Certified
Case Title
Tower Administrative Services data breach litigation, E.D. Pa. No. 5:26-cv-04490 (lead case)
Case Number
5:26-cv-04490
Court
U.S. District Court, Eastern District of Pennsylvania
Judge
District Judge Jeffrey L. Schmehl
Date Filed
June 29, 2026
Consolidated
July 28, 2026 (granted in part)
