Express Employment Professionals Data Breach Lawsuit: One Settled Case, One New Claim
Settled — Claims Period Closed
Claim deadline was January 15, 2026 · as of Oct 18, 2026
Two different incidents share this name. The 2024 Express Employment Professionals data breach led to a class action that settled; its claim deadline was January 15, 2026. The September 2026 item in the news is a ransomware group’s claim that Express has not publicly confirmed. As of October 18, 2026, that one has no settlement, no fund and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
Can I Still File?
The claim deadline, what the settlement pays and where to file — plus other settlements still taking claims.
No. The claim deadline was January 15, 2026.
Other settlements with open claim windows
- SitusAMC Data Breach$5.3M · claim by November 6, 2026
- Kelly Benefits Data Breach$5 million · claim by December 28, 2026
- Wellstar MyChart Lawsuit$4.25M · claim by November 10, 2026
We are not a claims administrator and not affiliated with any settlement. File only at the official settlement website — filing is always free.
What Happened, and When
The 2024 incident. Express Services, Inc., the Oklahoma City company behind the Express Employment Professionals staffing brand, reported unauthorized access to two company email accounts. It spotted suspicious activity on June 21, 2024. Its investigation found access between May 7, 2024 and June 20, 2024, and the intruder copied information from emails and attachments. The settlement website calls it a targeted cyberattack in May 2024.
The exposed files may have included names, Social Security numbers, driver’s license numbers, financial information, medical information and health insurance information. Express filed a notice with the Texas attorney general on September 13, 2024 that listed 5,941 Texans as affected. We found no published nationwide total.
The September 2026 claim. On September 17, 2026, a ransomware group added expresspros.com to its leak site. The group claims it took 1100 GB of data. That is the attacker’s claim, not a confirmed fact. As of October 18, 2026 we found no breach notice from Express and no filing with a state attorney general about it, so the number of people affected and the types of data involved are unknown.
Case details
The 2024 breach case: In re Express Services, Inc. Data Breach Litigation, No. 5:24-cv-00974, U.S. District Court for the Western District of Oklahoma. The lead case, Sabo v. Express Services Inc, was filed on September 20, 2024. The class representatives were Kurtis Sabo, Russell Karli and Kristin Lunsford. Express Services denies doing anything wrong.
The 2026 claim: As of October 18, 2026, plaintiffs’ firms are publicly saying they are investigating. An investigation is not a lawsuit. Separately, a federal complaint titled Williams v. Express Services, Inc. d/b/a Express Employment Professionals, No. 1:26-cv-02685, was docketed in the Northern District of Ohio on October 13, 2026. We have not read it, so we cannot say whether it concerns the 2026 claim or something unrelated.
Not a breach case: Escobedo v. Express Services, Inc., No. 2:24-cv-01493 in the District of Oregon, is an employment civil-rights suit filed in 2024. It has nothing to do with data security. For workplace claims, see our employment lawsuit guide.
Status: 2024 Settlement Closed, 2026 Claim Unconfirmed
2026 claim: nothing to file. As of October 18, 2026 there is no confirmed breach notice, no settlement, no fund and no claim form. If a case is filed and later settles, class members are notified directly by a court-appointed administrator.
Am I Affected?
For the 2024 settlement: the class was “All Persons whose Private Information was potentially compromised as a result of the Incident.” The settlement site said that people who received a notice from the administrator were class members according to Express Services’ records. Applicants, temporary associates and staff could all be in that group, because email attachments at a staffing company often carry hiring paperwork. If you were a class member and did not opt out by December 16, 2025, you are bound by the settlement whether or not you filed a claim.
For the 2026 claim: no one knows yet. The test will be a letter from Express itself. Keep any notice you receive, including the envelope, because it is your record of which data fields were involved.
What the 2024 Settlement Paid For
• Documented out-of-pocket losses up to $800, with receipts.
• Lost time of up to four hours at $25 an hour (maximum $100), counted inside the $800 cap.
• Identity theft or fraud losses up to $5,000, with documents.
• Or a flat $75 with no proof, instead of the payments above.
• Three years of credit monitoring with $1 million in identity theft insurance.
Losses had to fall between May 7, 2024 and January 15, 2026. Express agreed to pay class counsel’s fees separately, with a request for $222,500, plus a $3,000 service award for each class representative. Late claims are not covered.
For the 2026 claim there is no settlement, no fund and no claim form. Our data breach settlement calculator shows what comparable cases have paid.
How cases like this one end
Our copy of the federal courts’ own case database covers 16,001 other personal property damage casesclosed in U.S. federal district courts between 2015 and 2026, 11.3% of them filed as class actions:
- 32.5% ended in a settlement recorded by the court. Another 19.5% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 32.5% and 52.1%.
- 5.9% were decided on a motion before any trial.
- 1 in 90 reached a trial (1.1%), after a median of 27.5 months.
- Median time from filing to the end of the case: 8.4 months.
- Only 250 of them (1.6%) record a money award at all; the median of those is $443,000.
These are base rates for this type of case (federal other personal property damage cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
Express Employment Data Breach Timeline
May 7 – June 20, 2024 — Email Accounts Accessed
An unauthorized party gets into two Express email accounts and copies data from emails and attachments. Express detects it on June 21, 2024.
September 13, 2024 — Notices and Texas Filing
Notice letters go out, and Express reports 5,941 affected Texans to the Texas attorney general.
September 20, 2024 — Class Action Filed
Sabo v. Express Services is filed in the Western District of Oklahoma. It becomes In re Express Services, Inc. Data Breach Litigation, No. 5:24-cv-00974.
October 17, 2025 – January 15, 2026 — Settlement Notice and Claims
Settlement notices are mailed. The opt-out and objection deadline is December 16, 2025, and the claim deadline is January 15, 2026.
January 21, 2026 — Final Approval Hearing
The hearing takes place in Oklahoma City, and the docket closes the same day.
September 17, 2026 — New Ransomware Claim
A ransomware group lists expresspros.com and claims 1100 GB of data. As of October 18, 2026, Express has not confirmed it, and there is no settlement.
Three Things to Watch For
A closed settlement and a fresh, unconfirmed breach claim make an easy opening for imposters:
“Late claim” offers for the 2024 settlement
The claim deadline was January 15, 2026. Nobody can reopen it for a fee, and the official settlement site is offline. A message promising to “recover your Express settlement payment” for an upfront charge is not from the administrator.
Fake recruiter or onboarding messages
Stolen staffing records describe job seekers in detail. Expect convincing texts that use the Express name to ask for your Social Security number, bank details for “direct deposit,” or ID photos. Check the offer with your local Express office by phone before replying.
“Your data is on the dark web — pay to remove it”
Ransomware leak claims attract extortion spam aimed at the people in the records. No one can delete leaked files for you. Freeze your credit instead, which is free.
Express Employment Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is there an Express Employment Professionals data breach lawsuit right now?
For the 2024 breach, yes: it settled as In re Express Services, Inc. Data Breach Litigation, No. 5:24-cv-00974 (W.D. Okla.), and claims closed on January 15, 2026. For the September 2026 ransomware claim, as of October 18, 2026 we found law firm investigations and one new N.D. Ohio complaint (No. 1:26-cv-02685) whose subject we have not been able to confirm. There is no settlement for the 2026 claim.
How many people were affected?
For 2024, Express reported 5,941 Texans to the Texas attorney general. We found no published nationwide figure. For 2026, the number is unknown, because Express has not issued a confirmed breach notice that we could find.
What data was exposed?
In 2024: names, Social Security numbers, driver’s license numbers, financial information, medical information and health insurance information, according to the settlement website and the Texas filing. For 2026, the data types have not been confirmed.
Can I still file a claim in the Express Services settlement?
No. The deadline for online claims and for mailed claims, judged by postmark, was January 15, 2026. The deadline to opt out was December 16, 2025.
When will Express settlement payments arrive?
The settlement said payments would go out after final approval and after any appeals were resolved. The hearing was January 21, 2026. As of October 18, 2026, the official site is offline, and we found no published payment date. The administrator’s number listed on the site was (833) 417-4923.
What is the typical payout per person for a data breach settlement?
In this case, a claimant with no documents could get a flat $75. Documented losses could be reimbursed up to $800, or up to $5,000 for identity theft, plus three years of credit monitoring. Other cases use different terms. See our payout calculator.
How to sue a company for a data breach?
Most breach cases run as class actions. If you are a class member, you do not have to file anything until a settlement opens a claim process. Opting out keeps your right to sue on your own, but in the 2024 Express case that window closed on December 16, 2025. Whether to sue individually is a question for a licensed attorney.
What is worth doing right now?
Freeze your credit at all three bureaus. It is free and reversible. Treat unexpected job offers or onboarding requests that use the Express name with suspicion, and keep any breach notice Express sends you about the 2026 claim.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Open Class Action SettlementsSettlements still taking claims, with deadlines
- Data Breach Settlement CalculatorEstimate what a breach settlement claim may pay
- Eyemart Express Data Breach LawsuitA different company: the Dallas case, no settlement yet
- Employment Lawsuit GuideDeadlines and class actions for workplace claims