Nobody has to file anything to be paid in the Olinsky & Associates data breach settlement — but a class member can still lose the money by letting the check sit. The roughly 526 people the Syracuse law firm notified after its January 2025 cyberattack are each to be mailed a $40 check automatically, plus three years of credit monitoring. Under the settlement agreement those checks are void 90 days after they are issued, and an expired check is generally not reissued.
Status: Pending final approval | No claim form, no claim deadline | Opt out or object by October 26, 2026 (postmark) | Optional address or payment update by December 2, 2026 | $40 automatic, plus 3 years of monitoring
What Class Members Get Without Filing
| $40 check | Mailed to every class member who does not opt out, using the address the administrator holds. The agreement puts the total at $22,480 across the class. |
| 3 years of CyEx Financial Shield Complete | One-bureau credit monitoring, financial transaction and bank account monitoring, real-time authentication alerts, a fraud resolution agent and $1 million of identity theft insurance. The agreement values it at $26.95 a month, or $510,325.20 in retail terms across 526 people. Enrollment codes were already mailed by postcard; the subscription activates only after final approval. |
Because there is no common fund, the $40 is fixed. Olinsky pays the class benefits and, separately, notice and administration costs, attorneys’ fees and costs, and any service award. Class counsel will request $55,000 in fees and costs and a $2,000 service award for the class representative, subject to court approval. Neither comes out of the $40, and the $40 does not rise or fall with participation.
The 90-Day Check Problem
The settlement agreement requires the checks to say on their face that they are void 90 days after issuance. A check not cashed within that time is not reissued unless it came back undeliverable. The agreement treats cashing the check as a condition of recovery: let it expire and the right to the money, and to any other monetary relief under the settlement, is gone — while the release of claims still applies.
The other way to miss out is an outdated address. Because payment goes to the last known mailing address unless you say otherwise, anyone who has moved since the notice was mailed should update it.
The Optional Update Form
The Login ID and PIN printed on the notice open one thing on the settlement website: an address update and payment election form. It is not a claim and does not unlock any benefit. It lets you correct your mailing address or switch from a paper check to a digital payment method. The deadline to use it is December 2, 2026. If you skip it, you are paid by check at the address on file.
If you have lost the Login ID, the PIN or the monitoring enrollment code, the settlement website’s contact page is where to request a replacement.
The Breach at a Law Firm
Olinsky & Associates, PLLC is a law firm headquartered in Syracuse, New York. According to the settlement agreement, it became aware of a cybersecurity incident on or around January 28, 2025. Its notice letter, quoted in the complaint, said an unauthorized person accessed personal or health information held on file, citing Social Security numbers, account information, financial information, medical records and disability-payment information, and that some data was truncated so only the last four or five digits of a Social Security or bank account number were exposed. The agreement’s broader definition also lists names, addresses, driver’s license numbers and health insurance information.
Olinsky said the intruders reached files on a single shared drive through a phishing attack, that the vast majority of its network was not breached, and that it did not pay the ransom demand. It identified approximately 526 people whose information may have been affected and began notifying them on or about March 11, 2025.
The complaint in Leon-Roman v. Olinsky & Associates, PLLC, Case No. 5:25-cv-00462-ECC-CBF, U.S. District Court for the Northern District of New York, was filed April 14, 2025, alleging negligence, breach of implied contract and unjust enrichment. The parties reached terms on December 15, 2025 and filed the settlement agreement on February 27, 2026. Olinsky denies all claims and any wrongdoing, and the agreement states it is not evidence of fault. No court has found the firm acted unlawfully.
As part of the deal, Olinsky agreed to adopt a data breach policy, general and IT security policies, and vulnerability and patch management and vulnerability assessment policies. The agreement records that after the incident the firm added multi-factor authentication for VPN connections, web filtering and additional security software, and trained employees.
Who Is in the Class
The class is everyone Olinsky identified as impacted by the January 2025 incident, including everyone sent notice. That fixed list is why the payments are automatic: the administrator already has the names and addresses. If you received the notice or the enrollment postcard, you are on it. Excluded are Olinsky and its controlled entities, officers, directors, partners, employees, legal representatives, successors, subsidiaries and assigns; presiding judicial officers with their families and staff; and anyone who opts out.
Opting Out or Objecting
Both must be mailed to the administrator, postmarked by October 26, 2026; the notice gives no timezone. An exclusion request must be personally signed, give your full name, mailing address, phone number and email address if any, and say you do not want to participate. One person cannot opt out for another. Opting out keeps your right to sue Olinsky separately and forfeits the $40 and the monitoring.
An objection requires, among other things, proof of class membership, the grounds and any legal support, whether it applies to you alone or the whole class, any counsel’s identity, whether you or counsel will appear, and a list of settlements you or your counsel objected to in the past three years. Objectors stay in the class and still receive benefits if the settlement is approved. The court asks class members not to contact the court or clerk about the settlement.
If more than 50 class members validly opt out, Olinsky may terminate the whole settlement, measured within 21 days after the opt-out date.
Approval and Timing
The final approval hearing is set for December 2, 2026 at 10:00 a.m. at the James M. Hanley Federal Building and U.S. Courthouse in Syracuse. The court will rule on the settlement, class counsel’s fees and the service award, and will consider timely objections. The date and time can change without further notice; check the official Olinsky settlement website, run by administrator Simpluris, which also hosts the notice and settlement agreement.
The effective date is ten days after the judgment becomes final, and payments are due within 30 days after that, by check or electronically. The monitoring activates on the same trigger. No payment date has been announced. If the court rejects the deal or Olinsky terminates it, the case returns to litigation, though Olinsky still owes the notice and administration costs already incurred. Status updates are posted on OpenClassActions.com’s Olinsky & Associates settlement page.
Frequently Asked Questions
Do I need to file a claim in the Olinsky & Associates settlement?
No. There is no claim form and no claim deadline. Every class member who does not opt out is to be mailed a $40 check, and credit monitoring enrollment codes were already sent by postcard.
What happens if I do not cash the $40 check in time?
The check is void 90 days after it is issued and is not reissued unless it was returned as undeliverable. Under the settlement agreement, you lose the right to the money, but the release of claims still applies.
What is the Login ID and PIN on my notice for?
Only the optional address update and payment election form, which lets you change your mailing address or choose a digital payment instead of a check by December 2, 2026. You are paid whether or not you use it.
Could the $40 be reduced?
No pro rata reduction applies. There is no common fund; Olinsky pays the $40 per person and separately pays fees, costs, administration and the service award.
When does the credit monitoring start?
The CyEx Financial Shield Complete subscription activates only after the court grants final approval and the settlement becomes effective. Use the enrollment code from your postcard; replacements can be requested through the settlement website.
Sources
- Official settlement website, long-form notice, FAQ and address update page — OlinskyDataSettlement.com, administered by Simpluris.
- Class Action Settlement Agreement and Release (filed February 27, 2026) and class action complaint (filed April 14, 2025), Leon-Roman v. Olinsky & Associates, PLLC, Case No. 5:25-cv-00462-ECC-CBF (N.D.N.Y.).
- OpenClassActions.com — Olinsky & Associates Data Breach Settlement.
Source and credit: the settlement terms, deadlines and benefit details described above are drawn from our sister site’s reporting — OpenClassActions.com: Olinsky & Associates Data Breach Settlement — $40 Automatically, Plus 3 Years of Monitoring — which tracks this case against the court-approved notice and the official settlement website and is updated as the court rules.
Legal Disclaimer
This article is for informational purposes only and is not legal advice. OpenClassActions.org is a consumer news site, not a law firm and not the settlement administrator, and is not affiliated with any party to the case described. The allegations are allegations; unless a court has ruled, the defendants deny wrongdoing and no court has decided the merits. Deadlines, benefit amounts and payment timing can change as the court and the administrator act, so confirm current status on the official settlement website. You never need to pay anyone to file a claim or to receive a settlement payment.