Patients whose information Unlimited Technology Systems held for specialty medical practices may be covered by a consolidated proposed class action alleging the Cincinnati healthcare technology company failed to protect names, Social Security numbers and medical information taken in an October 2025 breach. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes class action complaints. The statements below are unproven allegations. Unlimited Technology Systems, LLC has not admitted wrongdoing and has not been found liable, there is no certified class, and there is nothing to claim at this time. This page is informational. It is not legal advice.
What the Unlimited Technology Systems Lawsuits Are About
Unlimited Technology Systems, LLC is a Cincinnati-based healthcare technology company. One of the complaints filed against it describes the company as a provider of software and technology to specialty medical practices, particularly in oncology and other complex-care fields, and says it serves more than 4,500 clinical offices and 6,500 specialty providers. Patients do not deal with the company directly; the complaint alleges their information reached it through the practices and providers that use its systems.According to the company’s notice letter, which the complaint quotes, Unlimited Technology Systems discovered unauthorized activity in its commercial datacenter on October 19, 2025, and determined that an unauthorized actor may have obtained a copy of personal information between October 5 and October 10, 2025. Patients began receiving notice letters on or around July 20, 2026. Lawsuits followed within days, and on August 27, 2026, the U.S. District Court for the Southern District of Ohio consolidated ten of them into a single case, In re Unlimited Technology Systems Data Breach Litigation, No. 1:26-cv-00712.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Timeline: From the Datacenter Intrusion to a Single Case
These dates come from the company’s notice letter as quoted in the complaint, the complaint itself, and the court docket.- October 5–10, 2025 — An unauthorized actor may have obtained a copy of personal information from Unlimited Technology Systems’ network and systems, according to the notice.
- October 19, 2025 — The company discovers unauthorized activity within its commercial datacenter. The notice says it hired a cybersecurity forensic firm, notified law enforcement and reviewed the data involved.
- On or around July 20, 2026 — Notice letters begin going out to affected people, a gap the complaint puts at more than nine months after discovery.
- July 22, 2026 — The first class action complaint, No. 1:26-cv-00712, is filed in the Southern District of Ohio.
- July 23, 2026 — Another complaint, No. 1:26-cv-00721, is filed in the same court. It is the complaint described in detail below.
- August 27, 2026 — The court consolidates ten related cases into No. 1:26-cv-00712, renames the case In re Unlimited Technology Systems Data Breach Litigation, and appoints interim counsel for the proposed class.
- Within 50 days of the August 27 order — A consolidated amended complaint is due. Unlimited Technology Systems then has 50 days from service to respond.
What Information Was Involved
The notice letter quoted in the complaint says the data involved may have included a person’s name and information in one or more of these categories:- Health insurance and patient balance information, such as insurance policy numbers or claims and benefits information
- Medical information, such as medical record numbers, dates of service and diagnosis information
- Scanned documents, such as driver’s licenses or other government identification, insurance cards and intake forms
- Social Security numbers
- Other personal information, such as dates of birth, email addresses, home addresses, phone numbers or demographic information
The notice frames these as categories that may have been involved, so the mix differs from one person to the next. The complaint alleges the files taken were unencrypted and, on information and belief, that the stolen information has been published on the dark web. Those points are allegations; the notice as quoted does not address them.
Who Is Affected
The people covered are patients of the medical practices and providers that relied on Unlimited Technology Systems, not the practices themselves. The complaint does not name the practices whose patients were notified and does not give a total count of affected people. It says only that the proposed class includes at least thousands of members, if not more.The clearest marker of who is affected is the notice letter. The proposed class described below expressly includes people who received one.
What the Complaint Alleges
The complaint in No. 1:26-cv-00721 alleges that Unlimited Technology Systems did not use reasonable security procedures for the sensitive data it maintained, including encryption, redaction or deleting information it no longer needed, and that it failed to monitor its systems closely enough to catch the intrusion sooner. It points to Federal Trade Commission guidance, HIPAA’s Privacy and Security Rules, and published government and industry recommendations on preventing cyberattacks as the standards the company allegedly fell short of. It also cites the company’s privacy policy, which it says promised that sensitive information would be protected.The timing of the notice is a central theme. The complaint alleges that the company waited more than nine months after discovering the breach to tell patients, and it argues the delay violated Ohio’s data breach notification statute, which it says requires notice within 45 days of discovery. It also criticizes the notice letter for not saying whether the threat was contained or how the breach happened.
The named plaintiff in that case, an Ohio resident, alleges she provided her information indirectly as a condition of receiving care from one of the company’s clients. The complaint says she has spent time reviewing accounts and credit reports and changing passwords, and that patients across the proposed class face an ongoing risk of identity theft and medical identity theft, along with lost time, a lost benefit of the bargain and a loss in the value of their information.
How the Ten Cases Were Combined
The lead case, No. 1:26-cv-00712, is assigned to Judge Matthew W. McFarland, with referral to Magistrate Judge Stephanie K. Bowman. The August 27, 2026 consolidation order joined it with Case Nos. 1:26-cv-721, 728, 729, 732, 733, 736, 737, 740 and 803, and directs that later related suits filed in the district be consolidated as well. The combined matter now carries the caption In re Unlimited Technology Systems Data Breach Litigation.The same order appointed Markovits, Stock & DeMarco, LLC as interim counsel to lead the case for the proposed class. It set a schedule under which the plaintiffs file a consolidated amended complaint within 50 days of the order, and Unlimited Technology Systems responds within 50 days of being served with it. Consolidation is a case-management step. It does not decide anything about whether the allegations are true.
The Proposed Class
The complaint in No. 1:26-cv-00721 seeks to represent a nationwide class of all individuals whose private information was accessed or acquired by an unauthorized party in the breach, including those who received the company’s notice. Excluded are Unlimited Technology Systems, its officers, directors and affiliates, entities it controls, and the assigned judge and the judge’s immediate family. The complaint reserves the right to narrow, expand or divide the class into subclasses.No class has been certified. The definition is a proposal, and the consolidated amended complaint may restate it.
Legal Claims and What the Plaintiffs Ask For
The complaint in No. 1:26-cv-00721 brings four counts on behalf of the proposed class:- Negligence
- Negligence per se, based on Section 5 of the FTC Act
- Breach of third-party beneficiary contract, on the theory that patients were intended beneficiaries of the company’s contracts with its clients
- Unjust enrichment, pleaded in addition to or in the alternative to the other claims
It asks the court to certify the class and to award actual and statutory damages, equitable relief, restitution and disgorgement. It also seeks an order requiring the company to strengthen its data security and monitoring, conduct periodic audits, and pay for lifetime credit monitoring and identity theft insurance for class members, along with the costs of notifying the class and administering any claims process, interest, and attorneys’ fees and costs. It demands a jury trial and does not put a dollar figure on the damages sought.
Those claims and requests come from one of the ten original complaints. The consolidated amended complaint replaces the individual pleadings and may add, drop or reframe claims.
What Happens Next
In consolidated data breach litigation, interim counsel generally files a single amended complaint that becomes the operative pleading. The defendant then typically answers or moves to dismiss, and the court decides which claims, if any, can proceed. Claims that survive move into discovery and, later, a contested motion for class certification.Many data breach class actions resolve through a negotiated settlement, though some are dismissed and none is guaranteed to settle. Any settlement would need court approval, and class members would generally be notified and given the chance to file a claim, object or opt out. None of those steps has happened in the Unlimited Technology Systems case.
Is There Anything to Claim?
There is nothing to claim. The case is at the complaint stage, no class has been certified, and there is no settlement, claim form, settlement website or deadline. Unlimited Technology Systems has not admitted wrongdoing, and no court has ruled on the allegations.Questions
Is there an Unlimited Technology Systems data breach settlement?
There is no settlement. The lawsuits over the October 2025 Unlimited Technology Systems breach have been consolidated in the U.S. District Court for the Southern District of Ohio and are still at the complaint stage. No class has been certified, and there is no settlement fund, claim form or deadline.
What happened in the Unlimited Technology Systems data breach?
According to the company’s notice letter as quoted in the complaint, Unlimited Technology Systems discovered unauthorized activity in its commercial datacenter on October 19, 2025. Its investigation found that an unauthorized actor may have obtained a copy of personal information between October 5 and October 10, 2025. The company says it hired a cybersecurity forensic firm and notified law enforcement. Notice letters began going out on or around July 20, 2026, according to the complaint.
Why did Unlimited Technology Systems have patient information?
The complaint describes Unlimited Technology Systems as a healthcare technology company that provides software and technology to specialty medical practices and providers, particularly in oncology and other complex-care fields. It alleges that patients’ information reached the company indirectly, through the practices and providers that use its services, rather than from patients themselves.
What information was involved in the Unlimited Technology Systems breach?
The notice letter quoted in the complaint lists names along with one or more of these categories: health insurance and patient balance information, medical information such as medical record numbers, dates of service and diagnoses, scanned documents such as driver’s licenses, insurance cards and intake forms, Social Security numbers, and other personal information such as dates of birth, contact details and demographic information. Not every category applies to every person.
What does it mean that the Unlimited Technology Systems lawsuits were consolidated?
On August 27, 2026, the court combined ten related cases into the lead case, No. 1:26-cv-00712, under the caption In re Unlimited Technology Systems Data Breach Litigation, and later related suits in the district are folded in as well. The court appointed Markovits, Stock & DeMarco, LLC as interim counsel for the proposed class. Consolidation is a case-management step and says nothing about whether the allegations are true.
What do the lawsuits ask the court to order?
The complaint reviewed for this article, No. 1:26-cv-00721, asks for class certification, money damages including actual and statutory damages, restitution and disgorgement, an order requiring stronger data security and periodic audits, lifetime credit monitoring and identity theft insurance for class members, and attorneys’ fees and costs. The consolidated complaint the court ordered may change the claims and requests.
Sources
• In re Unlimited Technology Systems Data Breach Litigation, No. 1:26-cv-00712 (S.D. Ohio) — CourtListener docket• Class action complaint, No. 1:26-cv-00721, ECF No. 1 (filed July 23, 2026), quoting the company’s notice letter — PDF via CourtListener RECAP
