OneTouchPoint Corp. decided to resolve class action litigation as a result of a 2022 ransomware attack and data breach that impacted over 2.65 million people.
The Wisconsin mailing and printing vendor discovered the cyberattack on April 28, 2022, after the encryption of files in its network. A forensic investigation confirmed on April 27, 2022, that a ransomware group was behind the attack on its network.
The data compromised and potentially stolen included names, subscriber ID numbers, diagnoses, prescription drugs, addresses, birth dates, doctor demographic information, family backgrounds, social histories, allergies, vitals, vaccines, and other details.
OneTouchPoint notified the HHS’ Office for Civil Rights about the data breach that impacted 2,651,396 people. Notifications were distributed to impacted individuals in April 2022.
Consolidation of the Class Action Lawsuits
Several class action lawsuits were filed against OneTouchPoint because of the data breach. The lawsuits had identical claims and alleged that the breach could have been avoided, but OneTouchPoint did not enforce reasonable and proper cybersecurity protocols.
The consolidated lawsuit, Dusterhoft v. OneTouchPoint, Inc., was filed with the Circuit Court of Waukesha County, Wisconsin. The stated claims include breach of contract, negligence, negligence per se, breach of fiduciary duty, breach of implied contract, breach of confidence, invasion of privacy, misrepresentation, fraud, bailment, unjust enrichment, wantonness, inability to provide sufficient notice in compliance with any breach notification law, such as HIPAA, or common law duty, and breach of state consumer protection legislation.
OneTouchPoint did not admit any claim or contention in the lawsuit. The parties decided to resolve the litigation to avoid the expenses and risks of a trial and its corresponding appeals.
Settlement Terms
OneTouchPoint decided to pay up to $1,500,000 attorneys’ fees and costs, settlement management costs, and $1,000 service awards per class representative.
The settlement also offers monetary benefits and credit monitoring for qualified class members. OneTouchPoint consented to injunctive relief and security enhancements worth up to $2,000,000. Security improvements will remain in force for a minimum of five years.
The settlement class consists of two subclasses. The monetary relief class includes people who received breach notification letters. Members of this class can file claims for monetary benefits.
The injunctive relief class includes people who received notifications about the data breach but for whom the investigation cannot ascertain that the breach had a real impact. Those people will get injunctive relief only.
Credit Monitoring and Monetary Benefits
Members belonging to the monetary relief class may select a free two-year membership to a single-bureau credit monitoring service. The membership comes with a $1 million identity theft insurance policy.
Every qualified class member can file claims for documented, unreimbursed ordinary expenses of up to $500. Claims for up to $5,000 in documented, unreimbursed extraordinary losses may also be filed.
Compensation for up to four hours of lost time valued at $25 per hour may also be claimed. Monetary relief class members who do not wish to file a compensation claim can claim a $75 cash payment as an alternative.
Settlement Deadlines
The last day to opt out of the settlement or object is October 16, 2026. Claims may be submitted until November 16, 2026. The final approval hearing is set for November 18, 2026.