Is lpdataincident.com legit? Yes — It Is the Legacy Professionals Settlement Site
Claim window open
File by January 12, 2027 · 82 days left · as of Oct 22, 2026
Yes. lpdataincident.com is the court-authorized website for Johnson, et al. v. Legacy Professionals, LLP, a $3,300,000 data breach settlement in the Circuit Court of Cook County, Illinois, run by Kroll Settlement Administration. It is not the Jack's Family Restaurants settlement. Legacy Professionals is an accounting firm that does audit and tax work for employee benefit plans and labor organizations, which is why people who never hired it got a letter. Claims are due January 12, 2027.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by any company named on this page, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
Can I Still File?
The claim deadline, what the settlement pays and where to file — plus other settlements still taking claims.
File by Jan 12, 2027 · 82 days left
Is lpdataincident.com Legit?
Other settlements with open claim windows
- SitusAMC Data Breach$5.3M · claim by November 6, 2026
- Kelly Benefits Data Breach$5 million · claim by December 28, 2026
- Wellstar MyChart Lawsuit$4.25M · claim by November 10, 2026
We are not a claims administrator and not affiliated with any settlement. File only at the official settlement website — filing is always free.
What the Lawsuit Says Happened
“LP” in the address stands for Legacy Professionals, LLP, an accounting firm with offices in Westchester, Illinois; Schererville, Indiana; and Edina, Minnesota. Its clients include employee benefit plans and labor organizations, so it held records about plan members it never dealt with directly. Its notice letter said the data was information “we handle in relation to our clients.”
Per Legacy's notice, it learned of suspicious activity on its network in late April 2024, and after receiving more information in November 2024 determined that files had been taken by an unauthorized actor. Notices went out starting February 2025.
The lawsuit alleges the exposed records included names, addresses, dates of birth, Social Security numbers, financial account numbers, passport and driver's license numbers, medical treatment information and health insurance information. Plaintiffs plead negligence, breach of implied contract and violation of the Illinois Consumer Fraud and Deceptive Business Practices Act. Legacy denies all of it.
Case details
The settlement is in Johnson, et al. v. Legacy Professionals, LLP, Case No. 2025CH00542, Circuit Court of Cook County, Illinois, County Department, Chancery Division — a state court, not federal. The official site is lpdataincident.com, which states that it is “the only authorized Settlement Website for this case.” The administrator is Kroll Settlement Administration LLC (see our Kroll overview).
The case started in federal court. In March 2025, suits were filed in the Northern District of Illinois and grouped as In re Legacy Professionals Data Security Incident Litigation, No. 1:25-cv-02476, before Judge Jeffrey I. Cummings. Plaintiffs from those suits — including those in Hammon (1:25-cv-02551), Plavsic (1:25-cv-02644), Nailor (1:25-cv-02672) and Abraham (1:25-cv-02737) — are class representatives in the Cook County settlement. The federal docket shows Legacy's motion to dismiss still being briefed in January 2026; we could not confirm how that federal case was closed.
Status: Settlement Open for Claims, Final Approval Pending
December 14, 2026 — last day to opt out or object (postmarked).
January 12, 2027 — last day to file a claim (online by 11:59 p.m. CT, or postmarked).
January 26, 2027 — final approval hearing, 9:30 a.m. CT, Courtroom 2308, Richard J. Daley Center, Chicago, also by Zoom.
Why the address gets confused with Jack's: Jack's Family Restaurants is also an “LP” with its own “Data Incident” settlement. That one is In re Jack's Family Restaurants, LP Data Breach Litigation, No. 2:25-cv-01861-LCB in federal court in Alabama, about a July 24 – August 10, 2025 attack. Its official site is jacksdatabreachsettlement.com, and its claim deadline is November 30, 2026. Different company, different court, different deadlines. A claim at lpdataincident.com does nothing for the Jack's case, and the reverse is also true.
Don't miss the claim deadline
Claims are due by January 12, 2027. We'll email you 7 days and 1 day before the deadline.
Who Is in the Settlement Class
The class is “all persons whose PII and/or PHI was potentially accessible in the Data Incident, including all persons who were sent a notice of the Data Incident.” Legacy's officers and directors, the judges and government entities are excluded.
The practical test is your mail. If you got Legacy's breach letter in 2025, or a settlement postcard naming Johnson v. Legacy Professionals, you are almost certainly in the class. Legacy's filing with federal health regulators reported at least 216,752 people affected; a separate count reported 190,818 notified. The settlement website itself gives no number.
Most people in the class never heard of Legacy. Their union, pension or health and welfare fund used Legacy as its auditor or accountant.
What You Can Get, and What Comes Out First
Documented losses: up to $5,000 for unreimbursed losses tied to the incident, such as fraud losses, bank fees and credit monitoring you paid for on or after April 1, 2024. You need third-party proof such as receipts or statements.
Cash payment: estimated at $75, with no documentation required.
Monitoring: 24 months of three-bureau credit monitoring through Kroll, with $1,000,000 of identity theft insurance.
Before any of this is paid, the fund covers administration costs, attorneys' fees of up to 35% ($1,155,000) plus expenses, and service awards of up to $2,500 per class representative. What remains goes first to monitoring, then to reimbursements, and last to the cash payments. That means the $75 is an estimate, and it shrinks if many people file. No money is paid before final approval and the end of any appeals. Our data breach settlement calculator shows how claim rates move pro rata payments.
Legacy Professionals Breach and Settlement Timeline
Late April 2024 — Suspicious Activity
Legacy says it learned of suspicious activity on its network and brought in an outside cybersecurity firm.
November 2024 — Files Confirmed Taken
After more information came in, the investigation found that an unauthorized actor had taken files from Legacy servers.
February 2025 — Notice Letters
Legacy begins notifying people and offers 24 months of IDX monitoring. Later complaints allege the notice was delayed until February 27, 2025.
March 2025 — Federal Suits Filed
Several class actions are filed in the Northern District of Illinois and grouped as No. 1:25-cv-02476 before Judge Jeffrey I. Cummings.
December 14, 2026 and January 12, 2027 — Deadlines
December 14, 2026 is the deadline to opt out or object in the Cook County settlement, No. 2025CH00542. January 12, 2027 is the deadline to file a claim.
January 26, 2027 — Final Approval Hearing
The Cook County court decides whether to approve the $3,300,000 settlement and the fee request. No payments go out before final approval and the end of any appeals.
Three Things to Watch For
A real settlement site with a short, odd name is easy to imitate. Here is what goes wrong in this case:
Mixing up the Legacy and Jack's settlements
Both are “LP data incident” cases open in 2026, but they have different administrators, courts and deadlines. A page or message that sends Jack's employees to lpdataincident.com, or Legacy class members to the Jack's site, is wrong. Go by the company named in your own letter.
Claim links that leave the official site
Type lpdataincident.com yourself instead of tapping a link in an email. The site's Submit Claim button opens a Kroll form on forms.ksacms.com, which is expected. Any other claim address is not. Filing is free, and the cash option needs no documents, so anyone asking for a fee or your full bank login is not Kroll.
Old IDX enrollment versus the new Kroll monitoring
The 2025 breach letter offered IDX monitoring, and its enrollment deadline was May 27, 2025. The settlement's monitoring is a separate Kroll benefit that you select on the claim form. Messages saying you must “re-activate” or pay to upgrade either one are not part of the settlement.
lpdataincident.com — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is lpdataincident.com legit?
Yes. It is the court-authorized website for Johnson, et al. v. Legacy Professionals, LLP, Case No. 2025CH00542 in the Circuit Court of Cook County. It is controlled by Kroll Settlement Administration and calls itself the only authorized site for the case. If you see lpdataincident com written without the dot in a search, it is the same address.
Is lpdataincident.com the Jack's Family Restaurants settlement?
No. Jack's has its own settlement, No. 2:25-cv-01861-LCB in federal court in Alabama, at jacksdatabreachsettlement.com, with a claim deadline of November 30, 2026. lpdataincident.com is only for the Legacy Professionals accounting-firm breach.
Why does an accounting firm I never used have my information?
Legacy Professionals does audit, accounting and tax work for employee benefit plans and labor organizations. If your union, pension or health and welfare fund was a client, your records could be on Legacy's servers. Its notice described the data as information it handles “in relation to our clients.”
How much will I get?
Up to $5,000 for documented losses, plus a cash payment estimated at $75 with no documents needed, plus 24 months of Kroll credit monitoring if you choose it. The cash figure is an estimate. It is paid from what is left of the $3,300,000 fund after fees, costs, monitoring and reimbursements.
What are the deadlines?
Opt out or object by December 14, 2026. File a claim by January 12, 2027, online by 11:59 p.m. CT or by mail postmarked that day. The final approval hearing is January 26, 2027.
When will the settlement pay?
Not before the court grants final approval at or after the January 26, 2027 hearing, and not until any appeals are resolved. The settlement site has not announced a payment date.
What is a data incident?
In this case, the “Data Incident” is the alleged April 2024 intrusion into Legacy's computer systems in which personal and health information was potentially accessible. The settlement class is defined by it: anyone whose information was potentially accessible, including everyone who was sent a notice.
How can I check that a call or letter is really from the administrator?
Compare it with the contact details on the official site: phone (833) 453-3042, or mail to Johnson, et al. v. Legacy Professionals, LLP, c/o Kroll Settlement Administration LLC, P.O. Box 5324, New York, NY 10150-5324. If those do not match, do not respond. Our Kroll monitoring guide explains what genuine Kroll messages look like.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Kroll Settlement AdministrationThe administrator behind lpdataincident.com and how it contacts you
- Is Kroll Monitoring Legit?What the free monitoring from a settlement actually includes
- Data Breach Settlement CalculatorEstimate a pro rata payment from fund size and claim rates
- Open Class Action SettlementsSettlements taking claims now, with deadlines