The roughly 526 people Olinsky & Associates notified after the January 2025 cyberattack on the Syracuse law firm's network will be paid $40 automatically from Olinsky's records, plus three years of credit monitoring; there is no claim form to file. The deadline to opt out or object is October 26, 2026, and the final approval hearing is set for December 2, 2026.
Current Status
There is no claim form and no claim deadline. Every class member who does not opt out is to be mailed a $40 check, and enrollment codes for three years of credit monitoring have already gone out by postcard. The court has not ruled: the final approval hearing before the U.S. District Court for the Northern District of New York is set for December 2, 2026 at 10:00 a.m. in Syracuse, and no payment date has been announced. The deadline to exclude yourself or to object is October 26, 2026, by postmark. Class members who have moved since the notice was mailed, or who would rather be paid electronically than by check, can update their details on the official settlement website by December 2, 2026 — that step is optional, and doing nothing means a check goes to the last known mailing address.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Changed Recently?
The settlement became public when the parties moved for preliminary approval in Leon-Roman v. Olinsky & Associates, PLLC, Case No. 5:25-cv-00462-ECC-CBF, in the U.S. District Court for the Northern District of New York, filing the Class Action Settlement Agreement and Release as Exhibit 1 on February 27, 2026. The agreement records that the parties reached terms on December 15, 2025 after informal discovery and months of negotiation. Notice has since gone out and the settlement website is live; what remains is the court's decision.Olinsky is a law firm headquartered in Syracuse, New York. The agreement says the firm became aware of a cybersecurity incident on or around January 28, 2025, and that its investigation determined the incident potentially affected data including names, addresses, Social Security numbers, account information, financial information, medical records or disability-payment information, driver's license numbers and health insurance information, with some of that data truncated so that only the last four or five digits of a Social Security number or bank account number were exposed. Olinsky identified approximately 526 individuals whose information may have been affected and sent them notice beginning on or about March 11, 2025.
The complaint, filed April 14, 2025, alleged negligence, breach of implied contract and unjust enrichment, and sought damages and injunctive relief. Those are allegations. Olinsky denies each of the claims and contentions alleged against it, denies any liability or wrongdoing of any kind, and says it would have asserted defenses had the case continued. The agreement states expressly that it is not evidence of fault or liability, and no court has found that the firm did anything unlawful.
Who Qualifies?
The class is every person Olinsky & Associates identified as being among the individuals impacted by the January 2025 data incident, including everyone who was sent notice of it. That is a fixed list of roughly 526 people rather than an open population, which is why the settlement pays automatically: the administrator already holds the names and addresses, so there is nothing for a class member to establish.Excluded are Olinsky itself, any entity in which it has a controlling interest, and its officers, directors, partners, employees, legal representatives, successors, subsidiaries and assigns. Also excluded is any judge, justice or judicial officer presiding over the matter, along with their immediate families and judicial staff. Anyone who files a valid request for exclusion by the October 26, 2026 deadline leaves the class and receives nothing under the settlement.
Anyone unsure whether they are in the class can ask the settlement administrator through the official settlement website. Receiving the mailed notice or the enrollment postcard is itself the practical answer — both were sent only to the identified group.
How Much Can You Get?
Two benefits, and neither requires a claim. The first is cash: a check for $40.00 to every class member who does not opt out, which the agreement puts at $22,480 across the class. The second is three years of CyEx Financial Shield Complete, an identity monitoring service that the agreement values at $26.95 a month, or $510,325.20 in retail terms across 526 people for the full three years. The service carries $1 million of identity theft insurance and covers one-bureau credit monitoring, financial transaction monitoring, bank and financial account monitoring and real-time authentication alerts, with access to a fraud resolution agent. Enrollment codes were mailed by postcard, and the subscription becomes active only once the court grants final approval.There is no common fund, which changes how the numbers behave. Olinsky pays the class benefits, and pays the notice and administration costs, the attorneys' fees and costs and any service award separately from them. Class counsel will ask the court to approve $55,000.00 in attorneys' fees and litigation costs, and a service award of $2,000.00 for the class representative; both are subject to court approval and both come from Olinsky rather than out of the class payments. The practical effect is that the $40 is not reduced pro rata if participation is high, and does not grow if participation is low — it is a fixed per-person amount.
Olinsky also agreed to business practice changes: a data breach policy, a general security policy, an IT security policy, a vulnerability and patch management policy and a vulnerability assessment policy. The agreement records that the firm implemented multi-factor authentication for VPN connections, web filtering and additional security software after the incident, and that employees underwent training. Those costs are also Olinsky's to bear.
One caveat is worth knowing before the check arrives. Settlement checks are void 90 days after issuance and carry that language on their face. A check that is not cashed inside that window is not reissued unless it came back undeliverable, and the agreement treats the uncashed check as a failed condition of recovery: the right to the money is extinguished, while the release still binds.
What Proof or Notice ID Is Required?
Nothing is required to be paid. There is no claim form, no documentation, no attestation and no identifier to enter. Both benefits flow from Olinsky's own records: the $40 check is mailed to the address the administrator holds, and the credit monitoring enrollment code was mailed by postcard to the same list.A Login ID and PIN appear on the notice, and they open one thing only — the optional address update and payment election form on the settlement website. That form is not a claim and does not gate any benefit. It exists so a class member who has moved can correct the mailing address, or can switch from a paper check to a digital payment method. A class member who never logs in is still paid. Anyone who cannot find their Login ID and PIN, or who no longer has the enrollment code for the monitoring service, can request a replacement through the settlement website.
Opting out and objecting are the two steps that do carry requirements. A request for exclusion must be signed personally, must give the class member's full name, mailing address, telephone number and email address if any, and must say in substance that the person does not want to participate; one person cannot opt out on another's behalf. An objection has a longer list, including proof of class membership, the grounds for the objection with any legal support, whether it applies to the objector alone or to the class, the identity of any counsel, whether the objector or counsel will appear at the hearing, and a list of every settlement the objector or their counsel has objected to in the preceding three years.
What Is the Deadline?
There is no claim deadline, because there is no claim. Three other dates matter.October 26, 2026 is the deadline to exclude yourself from the class and the deadline to object, both by postmark to the settlement administrator. The notice does not state a timezone for either. Excluding yourself preserves the right to sue Olinsky separately over the same claims and gives up every settlement benefit; objecting is open only to class members who stay in, and a class member who objects still receives the settlement benefits if the court approves.
December 2, 2026 is the final approval hearing, and it is also the cutoff for the optional address update and payment election form. A class member who does not complete that form by then is paid by check at the last known mailing address.
One deadline runs against Olinsky rather than the class: if more than 50 class members file valid and timely exclusion requests, measured within 21 days after the opt-out date, the agreement lets Olinsky terminate the settlement in its entirety.
How Do You Take Action?
Most class members do not need to do anything. The payment and the monitoring enrollment are already routed to them, and the only question worth asking is whether the administrator has a current mailing address.The official settlement website is Olinsky Data Settlement.com, run by the court-appointed administrator, Simpluris. It hosts the long-form notice, the settlement agreement and the other case documents, the address update and payment election login, and a contact page for requesting a replacement Login ID, PIN or monitoring enrollment code. The monitoring itself is activated at the enrollment address printed on the postcard, and the subscription starts only after the court grants final approval.
A class member who wants out, or who wants to object, mails the written request to the settlement administrator by October 26, 2026 with the contents described above. The court asks class members not to contact the court or the clerk about the settlement.
What Happens Next?
The next milestone is the final approval hearing on December 2, 2026 at 10:00 a.m. at the James M. Hanley Federal Building and U.S. Courthouse in Syracuse. At that hearing the court will decide whether to approve the settlement, how class counsel should be paid, and whether to award the service award, and it will consider any timely objections. The notice says the date and time may change without further notice and points class members to the settlement website for updates. Attending is optional and an objection is considered whether or not the objector appears.Payments follow only if the court grants final approval and that approval becomes final, which takes longer if anyone appeals. The agreement sets the effective date at ten days after the judgment becomes final, and requires the cash payments to be issued by check or electronically within 30 days after that. The credit monitoring subscription activates on the same trigger. No payment date has been announced.
If the court declines to approve the settlement, or if Olinsky exercises its right to terminate over exclusions, the settlement is cancelled and the case returns to litigation as though no class had been certified. The agreement provides that Olinsky remains responsible for notice and administration costs already incurred even in that event.
Sources and Verification
This page is based on the long-form notice of proposed class action settlement, the frequently asked questions and the address update and payment election login page published on the official settlement website for Olinsky Data Settlement.com, and on two filings in Leon-Roman v. Olinsky & Associates, PLLC, Case No. 5:25-cv-00462-ECC-CBF, in the U.S. District Court for the Northern District of New York: the Class Action Settlement Agreement and Release filed as Exhibit 1 on February 27, 2026, and the class action complaint filed April 14, 2025. The agreement is the source for the benefit amounts and their aggregate values, the payment timing, the check expiry, the 50-exclusion termination right and the business practice changes; the notice and the FAQs are the source for the deadlines, the hearing details and the filing requirements; the complaint and the quoted notice letter within it are the source for the description of the incident. The long-form notice is embedded below.For another settlement covering a breach at a law firm, see OCA's page on the Berman & Rabin data breach settlement. For a comparable settlement where a vendor's breach reached the clients of the businesses it served, see the Doxim data breach settlement.
Questions
Why is this settlement paying a flat $40 rather than a share of a fund?
There is no common fund here. The settlement agreement obligates Olinsky to send every class member who does not opt out a $40 check, which works out to $22,480 across the class, and to pay the credit monitoring, the notice and administration costs, the attorneys' fees and costs and the service award separately. Because none of those come out of the class payment, the $40 is not reduced pro rata the way a share of a fixed fund would be, and it does not rise if few people participate either.
What happens if the $40 check is never cashed?
The agreement voids settlement checks 90 days after issuance and requires the checks to carry that language on their face. A check that is not negotiated within that window is not reissued unless it came back as undeliverable, and the agreement treats cashing the check as a condition of recovery: a class member who lets it expire loses the right to the money and to any other monetary relief under the settlement. The release still applies.
Can the Olinsky settlement still fall apart before anyone is paid?
It can. The agreement gives Olinsky the right to terminate the settlement in its entirety if more than 50 class members file valid and timely requests for exclusion, measured within 21 days after the opt-out date. The settlement also fails if the court declines to approve it or materially changes its terms, in which case the case returns to litigation as though no class had been certified. Olinsky would still owe the notice and administration costs already incurred.
What information did Olinsky say was involved in the January 2025 incident?
Olinsky's notice letter told recipients that an unauthorized person accessed personal or health information the firm held on file, giving Social Security numbers, account information, financial information, medical records and disability-payment information as examples, and said some of the data was truncated so that only the last four or five digits of a Social Security number or bank account number were exposed. The settlement agreement's broader definition of private information also lists names, addresses, driver's license numbers and health insurance information. Olinsky said the intruders reached files on one shared drive through a phishing attack, that the vast majority of its network was not breached, and that it did not pay the ransom demand.
Does the address update and payment election form have to be completed to get paid?
No. The form only changes where the payment goes and what form it takes. A class member who never touches it is still paid, by check, at the last mailing address the administrator has. The form is worth using for anyone who has moved since the notice was mailed, or who would rather be paid electronically than by paper check, and it opens with the Login ID and PIN printed on the notice.
Why does this class only cover about 526 people?
The class is not defined by who used the firm, but by who Olinsky identified as impacted. Olinsky said its investigation found the intruders reached files on a single shared drive rather than the wider network, and it identified approximately 526 individuals whose information may have been affected, all of whom were sent notice beginning on or about March 11, 2025. Anyone outside that identified group is outside the class, which is also why no claim form was needed: the administrator already holds the list.
