Berry Dunn Class Action Lawsuit: $7.25M Data Breach Settlement

The BerryDunn class action lawsuit is a consolidated data breach case that settled in 2025 for $7.25 million, resolving claims brought on behalf of roughly 1.1 million people whose personal and health information was exposed in a September 2023 intrusion at the accounting firm’s IT vendor. The case, In re Berry, Dunn, McNeil & Parker Data Security Incident Litigation, No. 2:24-cv-00146-JAW, was filed in the U.S. District Court for the District of Maine. Judge John A. Woodcock Jr. granted final approval on June 6, 2025, and the settlement administrator began issuing payments on August 28, 2025.¹

What Happened in the Breach

BerryDunn’s Health Analytics Practice Group contracted with ZZ Enterprises, LLC, operating as Reliable Networks, to host and maintain the systems where the firm stored client data. On September 14, 2023, Reliable Networks detected unusual activity and later determined that an unauthorized party had accessed files containing sensitive information belonging to BerryDunn’s clients and their patients.²

The compromised data included names, Social Security numbers, dates of birth, driver’s license and state identification numbers, mailing and email addresses, health insurance policy numbers, Medicare and Medicaid numbers, passport numbers, and medical information. Approximately 1,107,354 individuals were affected.³

BerryDunn did not begin notifying affected individuals until April 25, 2024, roughly seven months after the breach was discovered. The consolidated complaint alleged that Reliable Networks provided no notification at all.⁴ Plaintiffs alleged the defendants failed to encrypt sensitive information, failed to monitor their networks, and failed to properly oversee vendor security practices. The delay in notice was a central grievance, because it left affected people exposed to identity theft and fraud without knowing their information had been compromised. Neither defendant admitted wrongdoing in the settlement.⁵

Who Was in the Settlement Class

The class covered all individuals in the United States whose private information was potentially accessible as a result of the breach, including anyone who received a notification letter from BerryDunn. The only people excluded were governing board members of the defendants, governmental entities, and the judge and court staff.⁶

Class members who wanted to preserve their right to sue independently had to opt out by May 7, 2025. Anyone who did not opt out is bound by the settlement and released all claims against BerryDunn and Reliable Networks arising from the breach.⁵

What the Settlement Paid

The $7.25 million fund is non-reversionary, meaning any unclaimed money does not go back to the defendants. BerryDunn contributed $6,325,000 and Reliable Networks contributed $925,000.⁵ Claim forms were due by May 22, 2025. Valid claimants could choose one cash option and could also elect credit monitoring.⁷

Reimbursement of documented out-of-pocket losses tied to the breach, up to $5,000. Supporting documents such as account statements, receipts, or credit reports were required. A claim for documented losses that lacked adequate proof and was not corrected defaulted to the flat cash payment.⁵
A $100 flat cash payment with no documentation required, subject to adjustment up or down depending on how many valid claims were filed.⁶
Three years of credit monitoring, including three-bureau credit monitoring, dark web monitoring, up to $1 million in identity theft insurance, and managed identity recovery services.⁵

Attorneys’ fees, litigation costs, settlement administration expenses, and service awards of up to $3,000 for each of the fifteen class representatives were paid from the same fund. Class counsel requested fees of up to one-third of the fund, roughly $2.42 million. Beyond the money, BerryDunn and Reliable Networks agreed to take reasonable steps to further secure their systems and to provide a declaration attesting to those enhancements.⁶

Where the Case Stands

The claim filing window and opt-out period have both closed. With payments underway as of late August 2025, the litigation has effectively concluded. Class members with questions about a submitted claim can still reach the settlement administrator, Angeion Group, at 1-888-569-4069 or through BDSettlement.com.⁸

1
ClaimDepot. BD Settlement
2
Angeion Group. BerryDunn Consolidated Complaint
3
HIPAA Journal. Berry Dunn McNeil Parker Data Breach Settlement
4
ClassAction.org. Berry Dunn McNeil Parker Data Security Incident Litigation Consolidated Complaint
5
Angeion Group. Settlement Agreement, In Re Berry Dunn McNeil Parker Data Security Incident Litigation
6
BD Settlement. FAQs
7
Top Class Actions. $7.25M Berry Dunn McNeil Parker Data Breach Class Action Settlement
8
ClassAction.org. Berry Dunn Data Security Incident Litigation Claim Form