Published
July 30, 2026
This settlement covers the September 17, 2024 data security incident at HCF Management, Inc., the Ohio nursing and assisted living operator, which exposed personal information belonging to residents and employees. If you were mailed a breach notice, you can claim a flat $35, or documented losses up to $4,000, plus three years of free credit monitoring — but the claim window closes September 29, 2026.
Current Status
Claims are open. The deadline to submit a claim is September 29, 2026, online or postmarked by that date, and every claimant needs the LoginID and PIN printed on the notice HCF mailed them. A separate and earlier deadline, September 13, 2026, applies if you want to exclude yourself from the class or object to the settlement. The Court of Common Pleas in Allen County, Ohio has granted preliminary approval and conditionally certified the class for settlement purposes only; the final approval hearing is set for November 30, 2026 at 2:00 p.m. before Judge Jeffrey L. Reed. As of July 30, 2026, no final approval order had been entered and no payment date had been announced.
Status
Claims Open
Fairness hearing November 30, 2026
Claim Deadline
September 29, 2026
Online or postmarked · opt out or object by September 13, 2026
Estimated Payout
$35 flat or up to $4,480
$35 cash, or documented tiers of $80 lost time + $400 out-of-pocket + $4,000 extraordinary · plus 3 years credit monitoring
Proof Required
Yes
LoginID and PIN from your mailed notice · receipts also required for the reimbursement tiers
What Changed Recently?
The claim window is open and running. The Court granted preliminary approval, conditionally certified the settlement class for settlement purposes only, and authorized the Claims Administrator to mail postcard notices carrying each class member's LoginID and PIN. The class was conditionally certified so that people could receive notice, exclude themselves, and voice support or opposition before the November hearing — it is not a merits ruling, and if the Court withholds final approval or the parties terminate the agreement, the settlement is void and the case resumes as if none of it happened.The underlying case is Bruce, et al. v. HCF Management, Inc., et al., No. CV 2025 0019, in the Court of Common Pleas of Allen County, Ohio. HCF Management is a Lima, Ohio company that operates nursing, assisted living, and independent living facilities across Ohio and Pennsylvania. On September 17, 2024, according to the settlement notice, HCF experienced a cybersecurity incident that exposed personal information belonging to its employees and customers; the company then notified the individuals whose information may have been affected.
The lawsuit alleges HCF failed to adequately protect that information and asserts claims for negligence, negligence per se, breach of implied contract, and unjust enrichment. HCF contests those claims and denies any wrongdoing. The notice states plainly that the settlement is not an admission of wrongdoing and does not imply any finding that HCF violated the law.
Two things about the incident come from outside the settlement documents and should be read as reporting rather than established fact. Security-press coverage in early 2025 attributed the attack to the RansomHub ransomware group, which claimed responsibility and claimed to have published data it said it had taken — an attacker's claim, not something HCF or the Court has confirmed. Those reports also put the number of people notified in the tens of thousands, though the figures differed between outlets. The settlement documents themselves publish no class size and do not name any attacker.
Who Qualifies?
You are a Settlement Class Member if you were sent a Notice of Data Breach as a result of the incident because your personal information was maintained on HCF's systems. That is the whole test, and it is deliberately simple: the class is the notice list.Because HCF's facilities serve residents and employ staff, the class spans both groups — the notice describes the incident as exposing the personal information of the company's employees and customers. You do not need to have suffered fraud, identity theft, or any loss at all to claim the credit monitoring or the $35 payment.
Excluded from the class are HCF and its affiliates, parents, subsidiaries, officers, agents, and directors; the judges presiding over the case and their clerks; and anyone who validly excludes themselves. If you are not sure whether a notice was mailed to you, the contact page on the official settlement website is the route to ask the Claims Administrator.
How Much Can You Get?
This is a claims-made settlement rather than a common fund, so there is no single pot of money to divide and no published total. HCF pays the approved benefits claim by claim. Every class member can claim the credit monitoring, and separately choose one route for cash.Credit monitoring. Three years of credit monitoring including $1,000,000 in identity theft insurance, available to every class member who files an approved claim. It is on top of any free monitoring HCF already offered after the incident, and it can be claimed alongside any cash benefit.
The documented route. Three reimbursement tiers, each with its own cap:
• Lost time at $20 per hour for up to four hours, an $80 maximum, supported by an attestation of the time you spent and the tasks it went to — monitoring accounts, calling financial institutions, replacing cards, filling out police reports, and the like.
• Documented out-of-pocket expenses up to $400 total. The listed categories run from credit report and identity theft protection costs to postage, notary, mileage, and unreimbursed bank, overdraft, late, over-limit, and card reissuance fees.
• Documented extraordinary losses up to $4,000, covering the same fee categories at a larger scale plus interest on payday loans caused by a card cancellation or over-limit situation, and professional fees such as an accountant or attorney hired to set things right.
Taken at their ceilings those three tiers total $4,480, but that figure describes the outer edge of the structure rather than a likely outcome — each tier has to be separately proven, and the top tier requires documented losses of an extraordinary nature. Losses must have occurred between September 17, 2024 and September 29, 2026.
The flat route. A one-time $35 Alternative Cash Payment. It is offered instead of the documented tiers, not in addition to them, and it needs no receipts — which makes it the practical choice for anyone who was notified but never traced a concrete loss to the incident.
Each class member may submit only one claim form, so decide between the documented route and the $35 before you file. Separately, the class representatives are asking the Court to approve $1,500 each for their service, and the notice states that money is not taken from the amount available to class members. Class Counsel will seek attorneys' fees and expenses of up to $210,000, also subject to court approval.
What Proof or Notice ID Is Required?
Every claim is gated on an administrator-issued credential, which is why this page is marked Proof Required even though the $35 tier needs no receipts. To file online you must log in with the LoginID and PIN printed on your mailed notice. The paper claim form asks for a Unique Identifier found on the postcard notice. Someone who never received a notice, or threw it away, cannot simply file.If you cannot locate your credentials, the settlement website's contact page is the route to ask the Claims Administrator to look them up; the site asks you to supply your full name and mailing address when you do.
Beyond the credential, the documentation burden depends on which route you take. The $35 payment and the credit monitoring require no receipts. Lost time requires a signed attestation of the hours and the tasks. Out-of-pocket and extraordinary losses require reasonable third-party documentation — receipts, bank statements, reports — showing the loss is fairly traceable to the incident, that it fell inside the claim window, that it was not already reimbursed, and that you made reasonable efforts to avoid or recover it, including exhausting any available credit monitoring or identity theft insurance. Self-prepared documents such as handwritten receipts are not sufficient on their own, though they can be submitted to clarify or support other proof. The administrator may come back for more information before processing a claim.
What Is the Deadline?
Two dates matter, and they are two weeks apart:• September 13, 2026 — the postmark deadline to exclude yourself from the class, and the deadline to object. An exclusion request must be a mailed letter stating you want out of the case, with your name, address, telephone number, and signature; you cannot opt out by phone or email. An objection must state your grounds with factual and legal support, identify any other class settlement objections you have filed in the last four years, and carry your signature, and it must be filed with the Clerk of Courts or mailed to Class Counsel by that date.
• September 29, 2026 — the claim deadline, whether you file online or by mail. A mailed claim form must be postmarked by that date.
The notice gives postmark deadlines and does not specify a timezone. You cannot both exclude yourself and object: excluding yourself removes you from the case, which leaves you nothing to object to. Excluding yourself also restarts the clock on the statute of limitations for your own suit, with the same amount of time you had when this case was filed.
How Do You Take Action?
File through the official claim form on the settlement website using the LoginID and PIN from your notice, or mail the paper claim form with any supporting documentation so it is postmarked by September 29, 2026. If all you want is the credit monitoring or the $35 payment, the tear-off panel of the postcard notice HCF mailed you is the shortest path — it works for both.Before you file, settle the one decision this settlement forces: the documented tiers or the flat $35. Only one claim form per class member is accepted, so pull together your receipts first if you intend to claim losses. The settlement website hosts the long-form notice, the settlement agreement, the claim form, and an important-dates page.
What Happens Next?
The final approval hearing is set for November 30, 2026 at 2:00 p.m. in Courtroom B before Judge Jeffrey L. Reed at the Allen County Court of Common Pleas. The Court will decide whether the settlement is fair, reasonable, and adequate, hear any objections, and rule on Class Counsel's fee request and the service awards. You do not have to attend to receive benefits, and the notice warns the hearing may be postponed to a later date without notice — check the settlement website before making plans around it.Benefits follow approval, not the claim deadline. Credit monitoring is provided after the Court enters a Final Approval Order. Cash claims are paid in the amount the Claims Administrator approves, after final approval and after the time for any appeals has expired. The notice is candid that the parties cannot predict when or whether final approval will come, and that an appeal would delay payment. No payment date has been announced.
If you have not tracked how these cases move from notice to check, our data breach class action entry walks through the stages, and the open data breach settlements hub tracks which claim windows are still live.
Sources and Verification
• Official settlement website: HCF Data Settlement.com• Notice of Proposed Class Action Settlement, Bruce, et al. v. HCF Management, Inc., et al., No. CV 2025 0019, Court of Common Pleas, Allen County, Ohio, entered by order of Judge Jeffrey L. Reed
• Claim form and Frequently Asked Questions published on the official settlement website
• Background on the incident and on HCF Management's operations: contemporaneous trade and security-press reporting, including McKnight's Long-Term Care News and Comparitech. Attacker claims reported there are identified as claims on this page, not as findings.
Questions
Do I need my notice to file an HCF Management settlement claim?
Yes. The online claim portal requires a LoginID and PIN printed on the notice that was mailed to you, and the paper claim form asks for a Unique Identifier from the postcard notice. If you cannot find your credentials, the settlement website's contact page is the route to ask the Claims Administrator to look them up using your full name and mailing address.
Can I take the $35 cash payment and the free credit monitoring?
Yes. Credit monitoring may be claimed in addition to monetary compensation. What you cannot do is combine the $35 Alternative Cash Payment with the documented tiers — the $35 is offered instead of lost time, out-of-pocket losses, and extraordinary losses, not on top of them.
What documentation do the reimbursement tiers require?
Lost time needs a signed attestation stating how many hours you spent and on what tasks. Out-of-pocket and extraordinary losses need reasonable third-party documentation such as receipts, bank statements, or reports showing the loss is fairly traceable to the incident and was not already reimbursed. Self-prepared documents like handwritten receipts are not enough on their own, though they can support other proof.
What is the difference between the September 13 and September 29 deadlines?
September 13, 2026 is the postmark deadline to exclude yourself from the class or to object to the settlement. September 29, 2026 is the deadline to submit a claim, online or postmarked. If you exclude yourself you get nothing from the settlement but keep the right to sue over the incident, and you cannot both exclude yourself and object.
When will HCF Management settlement payments be sent?
No payment date has been announced. The final approval hearing is set for November 30, 2026. Credit monitoring is provided after the Court enters a Final Approval Order, and cash claims are paid after the claim is processed, after final approval, and after the time for any appeals has expired. An appeal would push that timeline out further.
For more class actions keep scrolling below.
Settlement Amount
Not disclosed
Claims-made settlement — benefits are paid per approved claim; no common fund figure is published
Case Title
Bruce, et al. v. HCF Management, Inc., et al.
Case Number
CV 2025 0019
Court
Court of Common Pleas, Allen County, Ohio
Final Approval Hearing
November 30, 2026 at 2:00 PM
Courtroom B, before Judge Jeffrey L. Reed · may be postponed without notice
Administrator
Simpluris, Inc.
Official Website
HCF Data Settlement.com
