The Albany College of Pharmacy Settlement Has No Cap at All — and Pays $80 for Four Hours of Your Time on a Signature and a Short Description. Its Own Documents Set Three Different Claim Tests.

Most breach settlements are a fixed pot: fees, administration and monitoring all come out of it, and if too many people file, everybody's payment shrinks. This one is built the other way, in the agreement's own words:

“The Settlement shall be administered on a wholly claims-made basis, with no aggregate cap on the monetary amount of claims paid by Defendant.”

Attorneys' fees of up to $300,000 are “to be paid by Defendant separate from the Settlement Class Benefits.” Service awards of $2,500 to each of four class representatives, likewise separate. Administration costs: “Defendant shall be solely responsible for payment.” None of it reduces what class members get, and no pro-rata haircut applies.

The same paragraph carries the warning that makes the deadline matter: “If a Settlement Class Member does not submit a Valid Claim, the Settlement Class Member will release his or her claims against the Released Parties without receiving a Settlement Class Member Benefit.” Doing nothing costs you the claim and gains you nothing.

The arithmetic almost nobody does: if you have no receipts but did spend time dealing with this — freezing credit, calling the bank, watching statements — the attested time claim pays $80 and needs no documentation, more than three times the $25 flat option. For anyone who did spend time on this, the flat payment is the worse deal — and it is the one that reads as “the easy one.” If you spent no time at all, the $25 is the honest choice.

Maximum realistically available: $5,080 plus two years of monitoring.

This is the practical trap. The court-approved notice says: online claims by November 16, 2026, mailed claims “postmarked no later than November 15, 2026.” November 15, 2026 is a Sunday, and the postal service does not postmark on Sundays. And the claim form itself uses a third formulation: “received by November 16,” which is not the same test as a postmark at all.

We cannot tell you how the administrator will apply it. We can tell you the safe course: file online, or post it by Friday, November 13 and keep proof of mailing. The opt-out and objection deadlines are cleaner: both October 16, 2026, and exclusion must be in writing by mail — not by phone, not by email, and nobody can opt out on someone else's behalf. Money follows the December 10 hearing and the expiry of any appeals, not the claim deadline.

The intrusion ran from August 31 to September 14, 2024 and was detected, the college says, “on or about” September 14. The data review only confirmed the contents on May 30, 2025; letters went out on June 16, 2025, with a second round on September 8, 2025.

The categories are the broadest of the three settlements we read together this week. The settlement lists names, Social Security numbers, financial information, birth certificates, marriage certificates, passport numbers, driver's licence numbers, health insurance information, medical information and student information. The college's own notice goes further and adds account and routing numbers, security codes, mother's maiden name, digital signatures, government identification numbers, taxpayer IDs, payment card numbers and expiry dates, alien registration numbers, usernames and passwords, and biometric data.

Those are categories you cannot cancel. A card can be reissued; a birth certificate, a passport number and a biometric template cannot.

It is not just students. The agreement says class members “are current and former employees, patients, applicants, and students of ACPHS” — so people who merely applied, and patients of the college's pharmacy, are in. Membership is not tied to receiving a letter either: if your address was out of date and nothing reached you, you may still be in the class, and the administrator's telephone line will confirm it free of charge. The court record puts the notified group at approximately 26,411; a figure of 28,600 circulates in trade press whose underlying filing we could not locate. Washington's breach registry is the one state number we verified at the source: 3,245 residents.

Two footnotes, both flagged rather than asserted. A ransomware tracker reported in October 2024 that the group Medusa listed the college and demanded $150,000; neither the college's notice nor the settlement papers name any group, saying only “a criminal actor.” And the college is merging into Russell Sage College — the Board of Regents approved it in May 2026, with completion expected around July 1, 2027. The institution you would be writing to may not carry this name much longer.