IHRS Data Breach Settlement

Only notice holders can claim. The IHRS Data Breach Settlement resolves Tereska v. Institute for Human Resources and Services, Case No. 2026-02353, in the Court of Common Pleas of Luzerne County, Pennsylvania, over a targeted cyberattack on IHRS' computer systems in August 2025. First, a name trap worth clearing up: despite “Human Resources” in the title, this is not an HR, payroll or staffing-vendor breach, and not an employee-only class. The court-approved notice lists medical record numbers and medical history, condition, treatment or diagnosis information among the data accessed, alongside names, dates of birth, Social Security numbers or ITINs and driver's license or state ID numbers. The Class is anyone in the United States whose Private Information was accessed — client, patient or staff alike. Second, the headline numbers do not add up the way they look. The $45 and the $2,000 are alternatives, not a total: you claim documented losses or the flat $45, never both, and the Claim Form says so in capitals under each option. The $2,000 caps only the documented loss option — it is a ceiling on proven receipts, not a payout anyone receives for filing. With nothing to document, $45 is the realistic figure. Third, the two years of credit monitoring is not on the Claim Form at all. Its only benefit sections are Cash Payment A and Cash Payment B. The CyEx Financial Shield Complete enrollment runs on a separate track using an enrollment code mailed or emailed to you, so it is a second thing to do rather than a box to tick. Membership is a closed list from IHRS' own records, and the online form needs the LoginID and PIN from your mailed notice. Claims are due December 2, 2026; opting out or objecting closes a month earlier, on November 2, 2026.

Do I Qualify?

You may be eligible if:

• Your Private Information was accessed in the August 2025 IHRS data breach. That is the whole test — the Court-defined Class is “all individuals within the United States whose Private Information was accessed in the Data Breach,” and it does not turn on what your relationship to IHRS was
• You do NOT have to be an IHRS employee. This is the misreading most likely to cost someone a claim, in both directions. “Institute for Human Resources and Services” is the organization's name, not a description of an HR vendor, and there is no employee-only limit in the class definition. The breached files held medical record numbers and medical history, condition, treatment and diagnosis data, so clients and patients are squarely inside this class
• You reside in the United States. The class definition carries a U.S.-residence requirement, but no state-by-state limit and no state-based difference in payment
• IHRS' own records identify your information as accessed. This is a closed list, not an open claim: the court-approved notice tells recipients that “IHRS' records indicate that you are a Class Member,” and some class members also received an earlier breach notice directly from IHRS. You cannot self-certify in
• You can get to a LoginID and PIN. Those credentials, printed on the mailed notice, are what open the online Claim Form — even for the receipt-free $45 option. Lost them? Call (888) 836-1710 or email info@InstituteHRDataSettlement.com for a lookup or a paper form, on which the Login ID is asked for only “if known”
• You are NOT a director, officer or agent of IHRS or its subsidiaries and affiliated companies, a governmental entity, or the assigned Judge, that Judge's immediate family or Court staff. These are the only exclusions, and they are standard carve-outs that will not catch an ordinary class member
• You have not opted out. A valid Request for Exclusion postmarked or emailed by November 2, 2026 ends your right to any benefit here and preserves your right to sue IHRS separately

There are two separate gates here, and only one of them is about receipts. Getting into the form. The online Claim Form opens only after you enter the LoginID and PIN printed on the notice mailed to you, so this is an ID-gated settlement even for the $45 option, which asks for no receipts but still needs those credentials. That gate is not absolute: call (888) 836-1710 (toll-free, 24/7) or email info@InstituteHRDataSettlement.com to have your LoginID looked up or a paper Claim Form sent, and the printable Claim Form asks for the Login ID only “if known” — so losing the notice does not end your claim. Documenting losses. This applies only if you choose Cash Payment A. Each loss must be supported by third-party documentation — bank or card statements, receipts or invoices — showing what you spent or lost and that it was because of the Data Breach, and the losses must have been incurred between August 13, 2025 and December 2, 2026. The Claim Form has you list each item and its amount in a table and total them, with extra sheets allowed if you run out of rows. Two limits catch people out: notes or papers you prepare yourself are not enough on their own to support a claim, though they can help explain other proof; and you cannot claim anything already reimbursed by a third party. Cash Payment B has nothing to document at all beyond the LoginID/PIN gate — the notice is explicit that you “do not have to provide any proof or explanation” for the flat $45. The credit monitoring needs neither. It needs a third thing: the CyEx enrollment code sent separately by postcard and/or email, because monitoring is not claimed on the Claim Form. Every claim is signed under penalty of perjury and is subject to verification, and the administrator may ask for supplemental information before treating it as complete and valid.

What Happened?

A targeted cyberattack hit the computer systems of Institute for Human Resources and Services, Inc. in August 2025. The court-approved notice and the settlement website both give only the month, not a specific incident date. Certain files containing private information were accessed during the attack.

The exposed data is unusually broad and unusually sensitive. According to the notice, the affected files may have contained names, dates of birth, Social Security numbers or ITINs, driver's license or state ID numbers, medical record numbers, and medical history, condition, treatment or diagnosis information. That mix of government identifiers and clinical detail is why the settlement carries two years of monitoring with $1 million of financial fraud insurance rather than a cash payment alone — and it is the clearest signal that the breached records were client and patient files, not merely personnel records.

Sharon Tereska sued as Class Representative, alleging IHRS failed to adequately protect that information. The case is Tereska v. Institute for Human Resources and Services, Case No. 2026-02353, in the Court of Common Pleas of Luzerne County, Pennsylvania. IHRS denies that it did anything wrong, and the Court has not decided who is right; the parties settled to avoid the costs, risks, disruptions and uncertainties of continuing the litigation.

The settlement is claims-made rather than a fixed fund. IHRS pays the benefits on valid claims, and pays the $120,000 in attorneys' fees and costs and the $1,500 Service Award separately, subject to Court approval, so neither reduces what class members receive. The Court appointed Kenneth J. Grunfeld of Kopelowitz Ostrow, P.A. and Mariya Weekes of Milberg, PLLC as Class Counsel; Simpluris is the Settlement Administrator and mailed notice on September 3, 2026.

The Court has not granted final approval. The Final Approval Hearing is set for December 17, 2026 at 9:30 a.m. Eastern Time by teleconference, and the notice warns the date and time may change without further notice. Payments and monitoring enrollment follow only after final approval and the resolution of any appeals, and no payment date has been announced.

How to File Your Claim

1. KNOW WHICH CASH OPTION YOU WANT BEFORE YOU START — you may claim Cash Payment A (documented losses, up to $2,000) OR Cash Payment B (a flat $45), not both. The Claim Form says so in capitals under each one: “DO NOT CLAIM THIS BENEFIT IF YOU ARE CLAIMING A PAYMENT FROM SECTION II/III”
2. File online at institutehrdatasettlement.com using the LoginID and PIN printed on the notice mailed to you. The online Claim Form will not open without those credentials
3. No notice, or lost your credentials? You are not shut out. Contact the Settlement Administrator at info@InstituteHRDataSettlement.com or (888) 836-1710 (toll-free, 24/7) to have your LoginID looked up or a paper Claim Form sent. The printable Claim Form asks for the Login ID only “if known,” so a mailed claim is the route if the credentials cannot be recovered
4. Choose Cash Payment A only if you can attach third-party proof — bank or card statements, receipts or invoices — for each loss, and only for losses incurred between August 13, 2025 and December 2, 2026. Notes you write yourself may explain other proof but cannot support a claim on their own, and expenses already reimbursed by a third party cannot be claimed
5. Otherwise check Cash Payment B for the flat $45. Beyond the LoginID and PIN it asks for no receipts and no explanation of any kind
6. Pick how you want to be paid: the Claim Form offers PayPal, Venmo, Zelle, a virtual prepaid card, or a physical check mailed to the address you give
7. CLAIM THE TWO YEARS OF CREDIT MONITORING SEPARATELY — it is not a checkbox on the Claim Form. The CyEx Financial Shield Complete enrollment runs on its own track using an enrollment code that was sent to all Class Members by postcard and/or email. If you no longer have that code, contact the Settlement Administrator. The settlement site also has an “Enrollment Instructions Request” page where a LoginID and PIN sign you up for a reminder email with enrollment instructions once the Settlement becomes final
8. Submit one Claim Form per person, online by December 2, 2026, or by mail postmarked — and, per the Claim Form, received — no later than December 2, 2026. Mail to IHRS Data Breach Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958
9. Note the earlier deadline: to opt out or object you must act by November 2, 2026, a full month before the claim deadline
10. Visit the official claim form: https://institutehrdatasettlement.com/

How Much Will I Actually Get?

THE TWO CASH OPTIONS ARE STRICTLY EITHER-OR — THE $2,000 AND THE $45 DO NOT ADD UP. The Claim Form puts the warning in capitals beneath each option: “DO NOT CLAIM THIS BENEFIT IF YOU ARE CLAIMING A PAYMENT FROM SECTION II/III.” The notice separates them with a bare “-OR-”. You get one cash payment from this settlement, not two. READ THE $2,000 AS A CEILING, NOT AN EXPECTATION, AND NOTE THAT IT CAPS ONLY ONE OF THE TWO CASH OPTIONS. The $2,000 is the maximum reimbursement under Cash Payment A alone. It is not a cap on the settlement as a whole, it is not an amount anyone is paid for showing up, and it has no bearing on Cash Payment B. Nobody receives $2,000 without documenting $2,000 of actual loss. (1) CASH PAYMENT A — DOCUMENTED LOSSES, UP TO $2,000.00. Reimbursement of actual, documented out-of-pocket losses caused by the Data Breach and incurred between August 13, 2025 and December 2, 2026: money lost to identity theft or fraud, fees for credit reports, credit monitoring or freezing and unfreezing credit, the cost of replacing IDs, and postage to contact banks by mail. Each loss needs third-party proof such as bank statements or receipts; self-prepared notes can support other proof but never stand alone. Expenses already reimbursed by a third party are not claimable. -OR- (2) CASH PAYMENT B — A FLAT $45.00, NOTHING TO DOCUMENT. A one-time alternative cash payment taken instead of Cash Payment A, asking for no receipts and no explanation beyond the LoginID and PIN that open the form. This is a fixed figure, not an estimate and not an “up to” — it is not pro-rated up or down, because there is no shared fund to divide. For most class members, who have no receipts tying a specific expense to this breach, $45 is the realistic outcome. Documenting losses only beats it if you can prove more than $45. PLUS, ON A SEPARATE TRACK: TWO YEARS OF CYEX FINANCIAL SHIELD COMPLETE. All Class Members are eligible, alongside whichever cash option they choose, and it comes with $1 million of financial fraud insurance plus monitoring for fraud or identity theft, unauthorized financial transactions, and personal information tied to high-risk transactions, with access to a fraud resolution agent. IMPORTANT, AND DIFFERENT FROM MOST SETTLEMENTS ON THIS SITE: THE MONITORING IS NOT A CHECKBOX ON THE CLAIM FORM. The Claim Form's only benefit sections are II (Cash Payment A) and III (Cash Payment B) — there is no monitoring election anywhere on it. Enrollment codes were sent to all Class Members by postcard and/or email, and the notice directs anyone who has lost the code to the Settlement Administrator. Treat the monitoring as a second, separate thing to do. Also note the $1 million figure is insurance cover attached to the CyEx product, not settlement money anyone is paid. NO AGGREGATE FUND — THIS IS A CLAIMS-MADE SETTLEMENT. There is no common fund split among claimants, so payments do not shrink if many people file or grow if few do. IHRS pays the benefits on valid claims, and it separately pays the $120,000 in attorneys' fees and litigation costs and the $1,500 Service Award that Class Counsel will request, subject to Court approval. Those amounts are paid by IHRS and do not come out of class members' payments. Nothing is paid until the Court grants final approval after the December 17, 2026 hearing and any appeals are resolved.

Last reviewed: September 26, 2026 | Information verified from court records and official settlement documents.

Frequently Asked Questions