WPM Pathology Data Breach Settlement: What You Can Claim, and by When
A November 2024 cyberattack on a pathology laboratory in Salina, Kansas exposed dates of birth, Social Security numbers, diagnosis information, medical record numbers and health insurance claims data. A settlement is now open for claims. The simplest option pays $45 and asks for no receipts; the documented routes go considerably higher. The deadline is October 19, 2026, and everything here comes from the court-approved notice rather than from a summary of it.
Claim Deadline: October 19, 2026
Claims, opt-outs and objections all share the same date — October 19, 2026. The Final Approval Hearing follows on December 16, 2026 at 9:00 a.m., and no money is paid until the court approves the settlement and that approval becomes final. Do nothing and you stay in the class, receive nothing, and give up the right to sue over this breach. File at wpmpldatabreach.com; the administrator will also post a paper form on request.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened
According to the court-approved notice, the case "is about the targeted cyberattack on WPM Pathology’s computer systems that occurred in November 2024." Files containing private information were accessed. The notice lists the categories as dates of birth, Social Security numbers, diagnosis information, medical record numbers and health insurance claims information — the combination that makes medical breaches harder to recover from than a stolen card number, because none of it can be reissued. WPM Pathology is an independent anatomic pathology laboratory in Salina, Kansas; Salina Regional Health Center, Inc. is a co-defendant. Both deny wrongdoing, and the court has not decided who is right.
Case Details
Steinle v. WPM Pathology Laboratory, and Salina Regional Health Center, Inc., Case No. SA-2025-CV-000218, District Court of Saline County, Kansas. Administration by Simpluris (Info@WPMPLDataBreach.com, 866-675-3062). Claim, opt-out and objection deadline October 19, 2026; Final Approval Hearing December 16, 2026 at 9:00 a.m.
Where the Case Stands
Who Is Included
The court defined the class as "all whose Private Information was compromised in the Data Breach, including all individuals to whom Defendants sent an individual notification letter to regarding the Data Breach." Excluded are WPM Pathology’s officers, directors and related companies, governmental entities, the judge and the judge’s family and staff, and anyone who validly opts out. If a notification letter reached you, that letter is the clearest evidence of membership and carries the Login ID you need to file. Many affected people never dealt with the laboratory directly — pathology work is ordered by a treating physician, so the specimen and the record travel without the patient. If you have lost the letter, contact the administrator rather than any third-party site: no legitimate service issues claim credentials on your behalf.
What the Settlement Pays
How This Case Got Here
- 1
November 2024 — the attack
A targeted cyberattack on WPM Pathology’s computer systems. Files containing patient information were accessed. Sources disagree on the exact day within the month, so we name the month only.
- 2
April 2025 — reported to federal regulators
The incident was reported to the U.S. Department of Health and Human Services Office for Civil Rights, the regulator that maintains the public register of health-data breaches. We could not retrieve the portal entry directly, so we attribute this to secondary reporting rather than stating a count as established.
- 3
2025 — the lawsuit
Steinle v. WPM Pathology Laboratory, and Salina Regional Health Center, Inc. is filed in the District Court of Saline County, Kansas, as Case No. SA-2025-CV-000218.
- 4
2026 — settlement and notice
The parties agree to settle "to avoid the costs and risks, disruptions, and uncertainties of continuing the Litigation." The court authorises a notice programme and Simpluris is appointed administrator.
- 5
October 19, 2026 — the deadline
Claims, opt-outs and objections close. After this date, class members who did nothing remain bound by the settlement and receive nothing.
- 6
December 16, 2026 — Final Approval Hearing
The court decides whether to approve the settlement, the fees and the service award. Payment follows only after approval becomes final, which appeals can delay by months.
How to Tell the Real Claim From a Fake One
Medical breach settlements attract impostors, because the people receiving letters are by definition anxious and were caught unaware. Three things separate the real process from the rest.
The real site is wpmpldatabreach.com and it never asks for payment
Filing a claim is free. Any site charging a fee to submit, or offering to "secure" or "expedite" your payment for a cut, is not part of this settlement. The administrator is Simpluris, reachable at Info@WPMPLDataBreach.com and 866-675-3062.
Nobody legitimate will issue you a Login ID
Claim credentials come with the notice mailed to class members. A third party that offers to supply one is either guessing or harvesting your details. Lost the letter? The administrator is the only correct address for that.
No one can tell you your payout amount
The notice sets ceilings, not amounts, and what you receive depends on what you document and how many people file. A confident figure quoted before the hearing is an invention — including any figure you may find on aggregator sites.
Questions People Actually Ask
How much money is in the settlement fund?
The court-approved notice does not state a total, and neither does the settlement website. Several aggregator sites present "$4,000" as the fund — that figure is the per-person ceiling for documented identity-theft losses. What the notice does disclose is that Class Counsel will ask the court to approve $150,000 in attorneys’ fees and litigation costs, plus a $2,500 service award.
How many people were affected?
No figure appears in the court-approved notice. Secondary sources report roughly 5,600 individuals and a report to federal regulators in April 2025, but we could not verify a count in a primary document — so we do not state one as fact. If you received a letter, you are in the class regardless of the total.
Should I take the $45 or claim documented losses?
If you have receipts, the documented routes are worth more: up to $400 for out-of-pocket costs, up to $4,000 for identity-theft losses, plus up to $80 for time. The $45 flat payment exists for the majority who were exposed but cannot document a loss. You cannot take both.
When would I actually be paid?
Not before the Final Approval Hearing on December 16, 2026, and only if the court approves the settlement and that approval becomes final. Appeals can extend it by months. Any site promising a payment date is guessing.
Does claiming give up my rights?
Unless you opt out by October 19, 2026 you are in the class and give up the right to sue the defendants over the claims resolved here — whether or not you file. Opting out preserves your right to sue on your own, at your own expense.
I never used this laboratory. Why am I involved?
Pathology laboratories receive specimens and records through treating physicians and hospitals rather than from patients directly, and Salina Regional Health Center is a co-defendant here. Being affected without recognising the laboratory’s name is expected in this kind of case, not a sign of error.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.