PDCM Data Breach Lawsuit: What Happened and Whether a Case Exists
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
PDCM Insurance is an insurance and employee-benefits broker in Waterloo, Iowa. Its network was accessed on April 27–28, 2025, but letters only went out in August 2026. If you got one, it is most likely because your employer used PDCM for benefits. As of October 12, 2026, we found no PDCM data breach lawsuit on file — only law-firm “investigations.” There is no settlement and no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What PDCM Says Happened
According to PDCM's own notice, the company became aware of suspicious network activity on April 28, 2025. It secured its network, notified law enforcement and started an investigation, which found unauthorized access to certain files and folders between April 27 and April 28, 2025.
PDCM then reviewed what was in those files. Its website lists name, date of birth, Social Security number, driver’s license and state ID numbers, taxpayer identification number, financial account information, and health data: treatment information, diagnosis, treating or referring physician, prescription information, health insurance subscriber and policy numbers, and medical record number. Not every person had every field.
PDCM says it has no indication that the information was used for identity theft or fraud. It has not publicly named the attacker, and we do not repeat unconfirmed claims about who it was.
Case Details
No court case found. As of October 12, 2026, a search of federal court records on CourtListener for “PDCM Insurance” returned only unrelated bankruptcy matters, and our federal docket database shows no case naming PDCM. ClassAction.org has posted a page saying attorneys are investigating whether a class action can be filed — that is recruitment, not a lawsuit. Iowa state courts were not searched, and a complaint could be filed at any time; if one is, it will have a court name and a case number you can verify.
Status: Breach Notified, No Lawsuit, No Settlement
Whether the Martin Bros. figure is part of PDCM's 4,734 or in addition to it is not stated, and no total across all states has been published. The gap between the breach and the letters — more than a year — is the kind of fact data breach lawsuits typically focus on.
Who Is Affected
PDCM is a broker and benefits administrator, so most affected people never chose PDCM themselves. Its filing says it is notifying “data owner clients” and individuals it dealt with directly. Martin Bros. describes PDCM as its “third-party benefits administration partner” and says the incident affects its employees and their families.
The practical test is your mail. If you received a PDCM letter (the template uses a Kroll return address), you are among the people notified. Keep it: it lists which of your data fields were involved and contains your credit-monitoring enrollment details. If you work for an Iowa employer that used PDCM for benefits and have not received a letter, PDCM's assistance line is 844-958-8900.
Is There Any Money?
What is available now is free credit monitoring through Kroll. PDCM's Iowa filing says 12 months for people whose Social Security number or similar identifier was involved; the later Martin Bros. filing says PDCM is providing five years to everyone potentially affected. Your own letter controls — check it. For how resolved breach cases generally pay out, see our data breach settlement calculator.
PDCM Breach Timeline
- 1
April 27–28, 2025 — Files Accessed
Per PDCM, an unauthorized party accessed certain files and folders on its network.
- 2
April 28, 2025 — Activity Detected
PDCM spots suspicious network activity, secures its systems, notifies law enforcement and starts an investigation.
- 3
February 17, 2026 — Client Data Confirmed
Per the Martin Bros. filing, PDCM's review confirms that records of people connected to that client were involved.
- 4
August 3, 2026 — Letters and Iowa AG Notice
PDCM tells the Iowa Attorney General it has notified 4,734 Iowa residents, with notification still ongoing. Martin Bros. is formally told the same day.
- 5
September 29, 2026 — Client Files Its Own Notice
Martin Bros. notifies the Iowa Attorney General about roughly 1,085 Iowa residents connected to it.
- 6
October 12, 2026 — No Lawsuit Found
No PDCM data breach lawsuit appears in federal court records searched. Law firms are advertising investigations only.
Three Things to Watch For
A breach with letters in the mail but no lawsuit and no settlement leaves room for confusion:
“Claim your PDCM settlement” pages
There is no PDCM settlement and no claims site. A page asking for your Social Security number or bank details to “secure your payment” is collecting data, not filing a claim.
Calls offering to activate your monitoring
PDCM's letter says you complete Kroll enrollment yourself, using the details printed in the letter. Hang up on anyone who calls to “activate” it and asks for your full Social Security number. If in doubt, call the number in PDCM's notice: 844-958-8900.
“Lawsuit investigation” sign-up forms
Investigation pages are law-firm intake forms, not a case. Submitting one does not make you part of any class, and a retainer you sign is a real contract — read it before treating it as registration.
PDCM Data Breach — Questions People Actually Ask
What happened in the PDCM data breach?
PDCM Insurance, a Waterloo, Iowa insurance and benefits broker, says an unauthorized party accessed files and folders on its network on April 27–28, 2025. It noticed on April 28, 2025, notified law enforcement and reviewed the files. Letters to affected people went out starting around August 3, 2026.
How many people were affected by the PDCM data breach?
No national total has been published. PDCM told the Iowa Attorney General it notified 4,734 Iowa residents on or about August 3, 2026, and said notification was ongoing. Client Martin Bros. separately reported about 1,085 Iowa residents on September 29, 2026.
What data was exposed?
Per PDCM's notice: names, dates of birth, Social Security numbers, driver’s license and state ID numbers, taxpayer ID numbers, financial account information, and health data including diagnoses, treatment and prescription information, physician names, health insurance numbers and medical record numbers. Your letter lists the fields that applied to you.
Is there a PDCM data breach lawsuit?
Not that we could find as of October 12, 2026. Federal court records searched show no case against PDCM over the breach. Law firms have posted pages saying they are investigating whether to sue. If a complaint is filed, it will have a court and case number you can check.
How much compensation will I get for a data breach?
For PDCM, nothing at this point: there is no lawsuit, settlement or fund. Payments only come from a court-approved settlement or judgment, and amounts depend on that case. What you can get now is free Kroll credit monitoring offered in PDCM's letter.
Is the PDCM data breach letter legit?
PDCM posted a notice of the incident on its website and filed a sample letter with the Iowa Attorney General; the template uses a Kroll return address. Check that the phone number in your letter matches the assistance line on PDCM's site, 844-958-8900. A real breach letter will not ask you to pay anything.
Why did it take more than a year to send letters?
PDCM says it spent the time reviewing the accessed files to find out whose information was in them; its Iowa filing says that review “recently concluded” in August 2026. Per Martin Bros., PDCM confirmed that client's employees were involved on February 17, 2026, but formally told the company on August 3, 2026.
What should I do right now?
Enroll in the free Kroll monitoring using the details in your letter — you have to do it yourself. Consider a free credit freeze at all three bureaus. Review your health plan's explanation-of-benefits statements for care you never received. Keep the letter.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Settlements currently accepting claims, with deadlines
Data Breach Settlement Calculator
Estimate what a data breach settlement could pay you
Settlement Payout Calculator
How class action funds are divided per person
Allianz Life Data Breach Lawsuit
Another insurance-sector breach and where its cases stand