Published
July 30, 2026
This settlement covers the August 2024 data incident at OnePoint Patient Care, the hospice pharmacy that dispenses medications to patients in home and facility hospice care. If you were sent a notice, you can claim an alternate cash payment estimated at $100 with no documentation, or up to $3,500 for losses you can document — the claim window closes October 8, 2026.
Current Status
Claims are open. The deadline to submit a claim is October 8, 2026, whether you file online or by mail, and a mailed claim form must be postmarked by that date. A separate and earlier deadline, August 24, 2026, applies if you want to exclude yourself from the class or object to the settlement. The Court has scheduled a final approval hearing for September 23, 2026 at 1:30 p.m. before Judge Rebecca Grady Jennings in the Western District of Kentucky. As of July 30, 2026, that hearing had not been held, no final approval order had been entered, and no payment date had been announced.
Status
Claims Open
Final approval hearing September 23, 2026
Claim Deadline
October 8, 2026
Submitted online or postmarked · opt out or object by August 24, 2026
Estimated Payout
~$100 or up to $3,500
Alternate cash estimated at $100 with no documentation, or documented losses up to $3,500 · both subject to pro rata adjustment
Proof Required
Yes
Unique ID and PIN from the postcard notice to file online · receipts or records also required for the documented-loss tier
What Changed Recently?
The claim window is open and running. A $2,115,000 settlement has been reached in Christopher Russo v. OP Pharmacy, LLC a/k/a OnePoint Patient Care, LLC, Case No. 3:24-cv-00649-RGJ, in the U.S. District Court for the Western District of Kentucky, Louisville Division. The Court authorized notice to the class, and the Settlement Administrator has mailed postcard notices carrying each class member's Unique ID and PIN.OnePoint Patient Care is a hospice pharmacy that dispenses and delivers medications for patients receiving hospice care at home and in facilities. According to the settlement notice, the data incident took place on or about August 8, 2024 and resulted in unauthorized access to or acquisition of class members' private information. The notice describes the information involved as data OnePoint collected, directly or indirectly, about current and former patients, including names, addresses, facility location, and medical information.
The lawsuit alleges lost privacy, diminution in the value of the compromised information, and time spent responding to the incident, and asserts claims for negligence, negligence per se, breach of implied contract, unjust enrichment, breach of fiduciary duty, and declaratory and injunctive relief. OnePoint denies all liability. Its stated position is that it did not breach any legal duty and was itself the victim of criminal conduct, and that the claims are not suited to class-wide treatment. The Court has not decided in favor of either side, and the settlement is not a finding that OnePoint did anything wrong. OnePoint is also implementing additional security measures, which it pays for separately without reducing the settlement fund.
Two details about the scale of the incident come from outside the settlement documents and should be read as regulatory filings and reporting rather than facts the Court has found. OnePoint reported the incident to the U.S. Department of Health and Human Services' Office for Civil Rights in October 2024 as affecting 795,916 individuals, and a filing with the Maine Attorney General's office the following month put the number at 1,741,152. Security-press coverage from late 2024 also reported that the Inc Ransom group claimed responsibility for the attack and claimed to have published data taken in it — an attacker's claim, not something OnePoint or the Court has confirmed. The settlement notice itself publishes no class size and names no attacker. Our earlier OnePoint Patient Care data breach investigation page tracked the case before a settlement existed.
Who Qualifies?
You are a Settlement Class Member if you are a living individual residing in the United States whose private information may have been accessed during the data incident, including anyone OnePoint sent a notice telling them their private information may have been impacted. In practice, the notice list is the class.You do not need to have suffered identity theft, fraud, or any loss at all to file. The alternate cash payment is available to class members who simply were notified.
Excluded from the class are the parents, subsidiaries, directors, and officers of OnePoint and any entity in which it holds a controlling interest; the judge assigned to the case, the judge's immediate family, and court staff; anyone who submits a timely and valid request for exclusion; and any person found guilty under criminal law of initiating, causing, aiding, or abetting the criminal activity behind the incident, or who pleads no contest to such a charge. If you are unsure whether you are in the class, the settlement agreement is posted on the Documents page of the official settlement website.
How Much Can You Get?
The settlement fund is $2,115,000. Attorneys' fees of up to one third of that fund, plus reasonable costs and service awards of up to $2,500 each for the class representatives, come out of the fund if the Court approves them, and what remains is the net settlement fund available for payments. Class members choose one of two cash options.Cash Payment A — Documented Losses. Reimbursement of losses related to the data incident, up to $3,500 per class member, supported by reasonable documentation. The notice lists examples of qualifying expenses: bank fees, long distance phone charges, cell phone charges billed by the minute, data charges billed by the amount of data used, postage, gasoline for local travel, and fees for credit reports, credit monitoring, or other identity theft insurance products. Examples of reasonable documentation include telephone records, correspondence such as emails, and receipts. Your own certification, declaration, or affidavit does not count as reasonable documentation on its own, though it can be submitted to add clarification, context, or support for other documentation. You will not be reimbursed for an expense already reimbursed from another source, including compensation provided through the medical monitoring and identity theft protection product OnePoint offered in its original notification letter.
Cash Payment B — Alternate Cash. An alternate cash payment in the estimated amount of $100, with no documentation required. This is offered instead of Cash Payment A, not in addition to it.
The $100 figure is an estimate, not a guarantee. Cash payments may be adjusted pro rata on an equal percentage basis: if valid claims do not use the entire net settlement fund, payments increase; if valid claims exceed the fund, payments are reduced. The mechanics are set out in Section V of the settlement agreement, posted on the settlement website's Documents page.
One safety net is built into the structure. If you claim Cash Payment A but submit no reasonable documentation, or the Settlement Administrator finds your claim form invalid and you do not cure it, the claim is automatically converted to Cash Payment B rather than rejected outright.
What Proof or Notice ID Is Required?
This page is marked Proof Required because of how the online portal works. To file online you need the Unique ID and PIN printed on the postcard notice mailed to you; the login screen will not proceed without them. That is an administrator-issued credential, so even the no-documentation $100 tier is gated behind something a class member had to receive in the mail.There is one route around it. The settlement website states that anyone who did not receive a postcard notice can submit a claim by mail using the paper claim form posted on the Documents page. If you believe you are in the class but never got a postcard, or cannot find it, the settlement website's contact page is the route to reach the Settlement Administrator about your credentials or a paper form.
Beyond the credential, the documentation burden depends on which cash option you choose. Cash Payment B requires no documentation of any kind. Cash Payment A requires reasonable third-party documentation of each loss you claim — telephone records, correspondence, receipts — tying the expense to the data incident. After you submit online, the administrator emails a confirmation code for your submission; keep that email in case a question about your claim comes up later.
What Is the Deadline?
Two dates matter, and they are about six weeks apart:• August 24, 2026 — the postmark deadline to exclude yourself from the class, and the deadline to file an objection. An exclusion request must be mailed and must carry your name, address, telephone number, email address if you have one, your personal physical signature, and a statement that you want to be excluded; you cannot opt out by phone or email, and third parties cannot file mass or class exclusion requests on behalf of multiple class members. An objection must be filed with the Court by that date and also mailed to Class Counsel, defense counsel, and the Settlement Administrator, postmarked or shipped by private courier by that date, and it must include the detailed information the notice lists, including documentation of your class membership and your own signature.
• October 8, 2026 — the claim deadline, whether you file online or by mail. A mailed claim form must be postmarked by that date. The notice states that late submissions will not be accepted.
The notice gives calendar dates and postmark deadlines for claims, exclusions, and objections without specifying a timezone, so treat the dates as published. You cannot both exclude yourself and object — excluding yourself removes you from the class, which leaves nothing to object to.
How Do You Take Action?
File through the official settlement website, using the Unique ID and PIN from your postcard notice on the Submit a Claim page. Decide before you start which cash option you want: the documented route up to $3,500, or the estimated $100 alternate payment. If you are claiming documented losses, gather your records first, because the two options are alternatives and the claim form asks you to elect one.If you never received a postcard notice, download the paper claim form from the Documents page of the settlement website, complete and sign it, and mail it to the Settlement Administrator at the address printed on the form so it is postmarked by October 8, 2026. If your mailing or email address changes after you file, it is your responsibility to tell the Settlement Administrator, which you can do through the website's contact page.
If you do nothing, you receive no payment and you remain bound by the settlement's release, which gives up your right to sue the released parties over the claims this case resolves.
What Happens Next?
The final approval hearing is scheduled for September 23, 2026 at 1:30 p.m. before Judge Rebecca Grady Jennings at the Gene Snyder United States Courthouse in Louisville, Kentucky. The Court will consider whether the settlement is fair, reasonable, and adequate, hear any timely objections, and rule on Class Counsel's application for attorneys' fees, costs, and service awards. You do not have to attend to receive benefits. The notice warns that the hearing's date and time can change without further notice to the class, and that the Court may decide to hold it by video or telephone, so check the settlement website before planning around it.Benefits follow approval, not the claim deadline. The notice states that if you file a timely and valid claim form, benefits are provided after the Court approves the settlement and the settlement becomes final — and it asks class members to be patient, because that can take time. No payment date has been announced.
If you have not followed a case from breach notice to check before, our data breach class action glossary entry walks through the stages, and the open data breach settlements hub tracks which claim windows are still live.
Sources and Verification
• Official settlement website, including its Frequently Asked Questions, Documents, and Submit a Claim pages: OnePoint Settlement.com• Court-authorized Notice of Class Action Settlement, Christopher Russo v. OP Pharmacy, LLC a/k/a OnePoint Patient Care, LLC, Case No. 3:24-cv-00649-RGJ, U.S. District Court for the Western District of Kentucky, Louisville Division (embedded below)
• Claim instructions and claim form published on the official settlement website
• Scale of the incident: OnePoint's October 2024 report to the U.S. Department of Health and Human Services' Office for Civil Rights and its November 2024 filing with the Maine Attorney General's office, as reported in contemporaneous security-press coverage including SecurityWeek, Security Affairs, and The HIPAA Journal. Attacker claims reported there are identified as claims on this page, not as findings.
OpenClassActions.com is a consumer news site and is not the settlement administrator or a law firm.
Questions
Do I need my notice to file a OnePoint Patient Care settlement claim?
To file online, yes. The claim portal asks for the Unique ID and PIN printed on the postcard notice that was mailed to you. The settlement website states that people who did not receive a postcard notice may submit a claim by mail using the paper claim form posted on the Documents page. Because the online route is gated on an administrator-issued code, this page treats the settlement as proof-required.
What is the difference between Cash Payment A and Cash Payment B?
Cash Payment A reimburses documented losses related to the data incident, up to $3,500 per class member, and requires reasonable third-party documentation such as receipts, telephone records, or correspondence. Cash Payment B is an alternate cash payment estimated at $100 that requires no documentation. You choose one or the other. If you select Cash Payment A and the Settlement Administrator finds the claim invalid and you do not cure it, the claim is automatically converted to Cash Payment B.
Is the $100 payment guaranteed?
No. The notice describes $100 as an estimate. Cash payments may be adjusted pro rata, up or down on an equal percentage basis, depending on the total value of valid claims measured against the net settlement fund. If claims come in below the fund, payments can rise; if they exceed it, payments are reduced.
What are the OnePoint Patient Care settlement deadlines?
Claims must be submitted online or postmarked by October 8, 2026. The deadline to exclude yourself from the class or to object to the settlement is earlier: August 24, 2026. The final approval hearing is scheduled for September 23, 2026 before Judge Rebecca Grady Jennings in the Western District of Kentucky.
When will OnePoint Patient Care settlement payments be sent?
No payment date has been announced. The notice states that benefits are provided after the Court approves the settlement and the settlement becomes final. As of July 30, 2026 the final approval hearing had not been held and no final approval order had been entered.
How many people were affected by the OnePoint Patient Care data incident?
The settlement documents do not publish a class size. OnePoint reported the incident to the U.S. Department of Health and Human Services' Office for Civil Rights in October 2024 as affecting 795,916 individuals, and a later filing with the Maine Attorney General's office in November 2024 put the figure at 1,741,152. The settlement class is defined by who was sent notice, not by either of those numbers.
Official Settlement Notice
For more class actions keep scrolling below.
Settlement Amount
$2,115,000
Case Title
Christopher Russo v. OP Pharmacy, LLC a/k/a OnePoint Patient Care, LLC
Case Number
3:24-cv-00649-RGJ
Court
U.S. District Court, Western District of Kentucky, Louisville Division
Final Approval Hearing
September 23, 2026 at 1:30 PM
Before Judge Rebecca Grady Jennings, Louisville, Kentucky · date and time may change without further notice
Administrator
Epiq
Official Website
OnePoint Settlement.com
