Olinsky Data Breach Settlement: $40 and Three Years of Monitoring Are Automatic

Key facts

Case: Leon-Roman v. Olinsky & Associates, PLLC, Case No. 5:25-cv-000462-ECC-CBF
Court: U.S. District Court for the Northern District of New York
Who is included: About 526 people Olinsky identified as affected by the January 2025 data incident, including those sent notice
Automatic cash benefit: $40 for class members who do not opt out
Automatic monitoring benefit: Three years of CyEx Financial Shield Complete, activated after the settlement becomes final
Claims deadline: None. The settlement uses automatic benefits.
Opt-out and objection deadline: October 26, 2026
Final approval hearing: December 2, 2026 at 10 a.m., subject to change

What happened

Olinsky & Associates, PLLC has agreed to a proposed class action settlement over a January 2025 cybersecurity incident. The court-authorized notice says Olinsky discovered the incident around January 28, 2025 and later identified approximately 526 people whose information may have been affected. Notices began going to those people around March 11, 2025.

The proposed settlement is unusual because class members do not need to file a claim. People who remain in the class are set to receive a $40 payment and an activation code for three years of identity and financial monitoring. The benefits will become available only after the court grants final approval and any appeals are resolved.

Olinsky denies wrongdoing. The court has not decided whether the plaintiff or Olinsky is right. The settlement resolves disputed claims without a trial.

No claim form is required

The court-authorized FAQ says class members who do not opt out will automatically receive the $40 payment and monitoring benefit. There is no claims deadline.

Who Olinsky is and why the information matters

Olinsky & Associates, also known as Olinsky Law Group, is a law firm headquartered in Syracuse, New York. The settlement documents describe information connected to the firm's clients and disability-law work. A former client filed the lawsuit after receiving notice that his information may have been involved.

The notice says the affected data varied by person. It may have included names, addresses, Social Security numbers, account information, financial information, medical records, disability-payment information, driver's license numbers, and health-insurance information. In some records, Social Security or bank-account information was truncated so only the last four or five digits were exposed.

"Protected health information" generally means individually identifiable health information handled by certain covered organizations or their service partners. Its significance here is practical. Medical records, health-insurance details, and disability-payment information can reveal sensitive facts beyond ordinary contact information. The notice does not say every listed data type was involved for every class member.

What the lawsuit alleged

Plaintiff Felipe Leon-Roman filed the federal lawsuit on April 14, 2025. The complaint asserted negligence, breach of implied contract, and unjust enrichment. In plain English, those theories alleged that Olinsky failed to use reasonable safeguards, did not meet obligations implied by receiving private information, and retained a benefit without adequately protecting the data.

Those claims remain allegations. Olinsky denies liability and says it would assert defenses if the case continued. The settlement agreement says the parties reached material terms in December 2025 after informal discovery and negotiations. They chose settlement to avoid the cost, delay, and uncertainty of continued litigation.

The court has authorized notice, but has not entered final approval. Settlement-only class certification does not mean a class would necessarily have been certified for trial.

Evidence boundary

The settlement notice confirms that information may have been affected and identifies the categories involved. It does not establish that every class member experienced identity theft, fraud, or financial loss.

Who is covered

The class includes people Olinsky identified as affected by the data incident, including everyone sent notice of the incident. The filed agreement estimates approximately 526 class members.

That is a records-based definition. It does not cover every Olinsky client or every person who has communicated with the firm. People who received the administrator's postcard or Olinsky's earlier incident notice have the strongest indication that they are included.

Excluded people include Olinsky and related insiders, as well as the judge and court staff connected to the case. A class member who requests exclusion by the deadline leaves the settlement, gives up the benefits, and preserves any individual claims that would otherwise be released.

What class members receive

Automatic $40 cash payment

Every class member who does not opt out will receive a $40 payment. The default method is a check mailed to the person's last known address. The settlement website also provides a payment-election process for class members who want to update their mailing address or choose an electronic method.

The $40 is not described as reimbursement for a specific documented loss. No receipts or proof of spending are required. The settlement agreement values the aggregate cash payments at $22,480 for 526 class members.

Three years of monitoring

Class members will also receive an activation code for three years of CyEx Financial Shield Complete. The notice describes one-bureau credit monitoring, financial-transaction monitoring, bank-account monitoring, real-time authentication alerts, fraud-resolution assistance, and up to $1 million in identity-theft insurance under the service.

The code does not become active merely because notice was sent. The official FAQ says activation follows final approval and the resolution of appeals. Class members who lost their code can contact the settlement administrator for help.

Security changes

The settlement agreement says Olinsky agreed to maintain several security measures, including breach-response, general security, information-technology security, patch-management, and vulnerability-assessment policies. It also describes multi-factor authentication for virtual private network connections, web filtering, cybersecurity software, and employee training.

These measures are injunctive relief, meaning changes in conduct rather than direct cash compensation. The court has not found that the listed measures prove the prior safeguards were legally inadequate.

Benefits are automatic, but not immediate

Class members do not file a claim. The $40 payment and monitoring activation still depend on final approval and the settlement becoming effective.

Deadlines and practical steps

There is no claim deadline because there is no claims process. Two rights deadlines still matter:

October 26, 2026: deadline to mail a request to opt out
October 26, 2026: deadline to mail an objection that satisfies the notice requirements

The final approval hearing is scheduled for December 2, 2026 at 10 a.m. in the U.S. District Court for the Northern District of New York in Syracuse. The official notice warns that the date and time can change, so class members should check the settlement website.

A class member who wants the benefits generally does not need to submit a claim. Practical steps may still include keeping the notice, checking that the administrator has a current mailing address, selecting an electronic payment method if desired, and retaining the monitoring enrollment code.

Do not send sensitive records to Class Action Pulse. The settlement administrator, not this publication, handles addresses, payment elections, and replacement codes.

Check your mailing address

The payment is automatic, but a stale address can create delivery problems. Use only the court-authorized website or administrator contact information shown on your notice.

Case timeline and current procedural status

January 28, 2025: Olinsky says it became aware of the data incident.
March 11, 2025: formal notices began going to identified people, according to the settlement documents.
April 14, 2025: Felipe Leon-Roman filed the federal lawsuit.
December 15, 2025: the parties reached agreement on material settlement terms.
September 11, 2026: the settlement notice date listed by the administrator.
October 26, 2026: opt-out and objection deadline.
December 2, 2026: scheduled final approval hearing.

A "final approval hearing" is the point at which the court considers whether the settlement is fair, reasonable, and adequate. Approval does not always produce immediate payment. The settlement must become effective, and appeals can delay that process.

What remains disputed

The settlement does not decide whether Olinsky violated a legal duty, whether its security was unreasonable, or whether the incident caused financial harm. Olinsky denies wrongdoing. The class is also limited to people identified in the firm's records, not anyone who believes they may have interacted with the firm.

The notice lists possible data categories, but the combination varied by person. A notice recipient should read their individual incident notice rather than assume every category applied to them.

The final delivery date for checks and monitoring activation remains unknown because it depends on final approval and appeals. The official website is the best source for schedule changes.

Frequently asked questions

Do class members need to file a claim?

No. The court-authorized FAQ says the settlement uses automatic benefits. Class members who do not opt out will receive the $40 payment and monitoring benefit after the settlement becomes final.

Who is included?

People Olinsky identified as affected by the January 2025 data incident, including those sent notice. The agreement estimates about 526 people.

Is the $40 payment guaranteed today?

No. It is a settlement benefit, but distribution depends on final approval and the settlement becoming effective.

What happens if a class member does nothing?

The notice says the person remains in the class, receives the automatic benefits, and gives up the released claims against Olinsky covered by the settlement.

What happens if a person opts out?

They receive no settlement benefits and preserve the ability to bring their own claims about the released issues, subject to applicable law and deadlines.

Did the court find Olinsky liable?

No. Olinsky denies wrongdoing, and the court has not decided the merits.

Where should payment or address changes be made?

Only through the court-authorized Olinsky Data Incident Settlement website or the administrator contact information on the official notice. Class Action Pulse does not administer the settlement.