The Marshall & Melhorn data breach settlement is an $800,000 class action resolution that a federal judge in Ohio approved on January 14, 2025, closing out claims from a 2021 cyberattack on the Toledo law firm. The claims deadline was December 23, 2024, and the case is now closed with no appeals filed.1ClaimDepot. Marshall Melhorn Data Breach Settlement
Who Was Eligible and What They Could Recover
The settlement class covered all U.S. residents who received a notice from Marshall & Melhorn that their private information had been compromised in the breach. Notification letters went out on June 7, 2023.2Massachusetts Attorney General. Assigned Data Breach Number 29755, Marshall Melhorn LLC
Eligible class members who filed a valid claim by December 23, 2024, could recover in two ways:
- Reimbursement of documented out-of-pocket losses traceable to the breach, capped at $5,000 per person. Qualifying costs included unreimbursed fraud or identity theft losses, professional fees for credit repair or legal help, credit freeze and unfreeze fees, and credit monitoring paid for after September 14, 2021.
- A pro rata cash payment from whatever remained in the fund after administrative costs, attorneys’ fees, service awards, and out-of-pocket reimbursements. The baseline estimate was roughly $70 per claimant, subject to adjustment based on how many claims came in.3ClassAction.org. Marshall Melhorn Data Breach Settlement Notice
The $800,000 fund was non-reversionary, meaning any unclaimed money stayed in the fund for distribution to claimants rather than reverting to the firm.4ClassAction.org. Marshall and Melhorn LLC Data Breach Litigation Settlement Agreement
What the Breach Involved
Between August 20 and September 14, 2021, an unauthorized third party accessed Marshall & Melhorn’s computer network. The exposed information included full names, Social Security numbers, financial account information, driver’s license and state ID numbers, passport information, dates of birth, medical records, and health insurance details.4ClassAction.org. Marshall and Melhorn LLC Data Breach Litigation Settlement Agreement
Marshall & Melhorn identified 27,271 people as directly affected. Plaintiffs alleged in court that the true number of people whose data was accessed was closer to 47,000.5ClassAction.org. Marshall and Melhorn LLC Data Breach Litigation Complaint The firm’s investigation could not determine which specific files were accessed or taken. No ransomware group or threat actor was publicly named as responsible.6HIPAA Journal. Cyberattack at Precision Imaging Centers, Marshall Melhorn, Atrium Health Wake Forest Baptist
Along with the notification letters, the firm offered affected people 24 months of free credit monitoring and identity theft restoration through Experian IdentityWorks.2Massachusetts Attorney General. Assigned Data Breach Number 29755, Marshall Melhorn LLC
How the Lawsuit Reached Settlement
Two former clients of the firm filed class action complaints in June 2023 in the U.S. District Court for the Northern District of Ohio. The cases were consolidated on July 21, 2023, as In re Marshall & Melhorn, LLC Data Breach Litigation. The complaint alleged the firm failed to properly secure and encrypt sensitive data, kept records in a manner vulnerable to cyberattack, and did not comply with cybersecurity standards from NIST, CIS, or the FTC. The claims included negligence, negligence per se, breach of implied contract, breach of fiduciary duty, and unjust enrichment.5ClassAction.org. Marshall and Melhorn LLC Data Breach Litigation Complaint
Plaintiffs also alleged that stolen data had been published on the internet. Marshall & Melhorn denied that claim and said there was no evidence of publication. The firm denied wrongdoing throughout the case. The parties reached a settlement in principle on May 23, 2024.4ClassAction.org. Marshall and Melhorn LLC Data Breach Litigation Settlement Agreement
Final Approval and Current Status
Judge James R. Knepp II granted preliminary approval on August 23, 2024, and held a fairness hearing on January 13, 2025. No class members filed objections, and the motion for final approval was unopposed. The court found the settlement fair, reasonable, and adequate, entered judgment the following day, and dismissed the case with prejudice while retaining jurisdiction to enforce the terms.7Simpluris. Amended Order Granting Final Approval of Class Action Settlement
The court approved $266,666.67 in attorneys’ fees (one-third of the fund), $16,161.73 in litigation expenses, and service awards of $2,500 each to the two named plaintiffs.8Midpage. Thiel v Marshall Melhorn LLC, Amended Order Granting Final Approval No appeals were filed, and payments to eligible claimants followed the expiration of the appeal period. The claim window has closed, so people who did not file by December 23, 2024, can no longer submit a claim under this settlement.