There is no Legacy Professionals LLP data breach settlement at this time. The class action litigation against the Illinois accounting firm remains active in Cook County Circuit Court, no settlement fund has been established, and no claims process or deadline to file for compensation exists. If you received a notification letter, the only relief currently available is the credit monitoring the firm offered directly.1HIPAA Journal. Legacy Professionals Data Breach Lawsuits
What Legacy Professionals Is Offering Affected Individuals
Legacy Professionals offered affected individuals 24 months of complimentary credit monitoring and identity theft protection through a service called IDX. Enrollment required a unique code included in the notification letter, and the sign-up deadline was May 27, 2025. No extension has been publicly announced.2Montana Department of Justice. Legacy Professionals Consumer Notification Letter3ClaimDepot. Legacy Professionals LLP Data Breach
The firm also set up a dedicated hotline at (877) 441-7153, open Monday through Friday from 6 a.m. to 6 p.m. Pacific Time, for questions about the incident.2Montana Department of Justice. Legacy Professionals Consumer Notification Letter
This monitoring offer is separate from any potential class action recovery. Accepting it does not, on its own, waive your right to participate in the litigation.
Where the Class Action Stands
The first complaint, Johnson v. Legacy Professionals, LLP, was filed on December 20, 2024, in the U.S. District Court for the Northern District of Illinois by the firm FeganScott. A second complaint followed on January 17, 2025, and by March 2025 at least five proposed federal class actions had been filed against the firm.4FeganScott. Legacy Professionals Data Breach5TEISS. Chicago Accounting Firm Faces Class Action Lawsuits Over 2024 Data Breach
The federal Johnson case was terminated on March 14, 2025, and the matter moved to Cook County Circuit Court, where it remains active.6PACER Monitor. Johnson v Legacy Professionals, LLP4FeganScott. Legacy Professionals Data Breach There is no public indication that formal settlement negotiations have begun or that the multiple lawsuits have been consolidated.
The complaints allege that Legacy Professionals failed to implement reasonable security safeguards, was negligent in protecting sensitive data, delayed notifying affected individuals for months, and had not disclosed the full scope of the incident or the specific data stolen.4FeganScott. Legacy Professionals Data Breach
Why the Timing of Notifications Matters
The gap between the breach and the notification letters is central to the litigation. Legacy Professionals detected suspicious activity in late April 2024. The LockBit ransomware group publicly claimed responsibility in August 2024. The firm’s forensic investigation confirmed data theft in November 2024. Notification letters did not go out until February 27, 2025, roughly ten months after the intrusion.5TEISS. Chicago Accounting Firm Faces Class Action Lawsuits Over 2024 Data Breach7Bank Info Security. Accounting Firm Notifying 217,000 of Health Data Hack
Because the breach involved protected health information, HIPAA rules applied. Under HIPAA, business associates that handle health data must notify affected individuals within 60 days of discovering a breach. The class action complaints allege Legacy Professionals missed that window by a wide margin.7Bank Info Security. Accounting Firm Notifying 217,000 of Health Data Hack The HHS Office for Civil Rights has not publicly announced an enforcement action against the firm.1HIPAA Journal. Legacy Professionals Data Breach Lawsuits
Who Was Affected and What Was Exposed
Legacy Professionals reported the incident to the HHS Office for Civil Rights on February 28, 2025, listing 216,752 affected individuals. An earlier filing with the Maine Attorney General reported approximately 190,818, a figure that likely reflected only a partial review at that stage.7Bank Info Security. Accounting Firm Notifying 217,000 of Health Data Hack8HIPAA Times. Legacy Professionals LLP Faces Data Breach Affecting Over 190K Breach notices were also filed with attorneys general in Maryland, California, Texas, and Massachusetts.3ClaimDepot. Legacy Professionals LLP Data Breach
The data exposed varied by person but could include names, Social Security numbers, driver’s license and state ID numbers, medical treatment information, and health insurance information. The firm stated the breach was limited to its own systems and did not directly affect client systems.7Bank Info Security. Accounting Firm Notifying 217,000 of Health Data Hack2Montana Department of Justice. Legacy Professionals Consumer Notification Letter Much of the compromised data came from employee benefit plan records the firm maintained for its clients.
What to Watch For
If a settlement is reached, it would typically be announced through the Cook County court docket, the plaintiffs’ law firms handling the case, and, in most cases, a dedicated claims administration website. Until then, there is no claim form to submit and no compensation to apply for. Keep your notification letter, any records of identity theft or fraud that follow the breach, and receipts for any out-of-pocket costs you incur protecting your credit. Those documents are what a future claims process would ask you to produce.