WPM Pathology Lab and Salina Regional Health Center Agree to Class Action Settlement Over 2024 Data Breach

WPM Pathology Laboratory and Salina Regional Health Center, Inc. have agreed to a class action settlement to resolve allegations that they failed to protect sensitive medical and personal information during a November 2024 cyberattack. If you received a breach notice regarding this incident, you may be eligible to claim up to $4,480 in cash reimbursement or a $45 flat cash payout, alongside two years of free credit and identity monitoring.

The lawsuit, Steinle v. WPM Pathology Laboratory and Salina Regional Health Center, Inc., filed in Kansas state court, covers approximately 5,619 patients whose protected health details were compromised when unauthorized actors breached internal computer networks.

What Caused the November 2024 WPM Pathology Cyberattack?

In November 2024, unauthorized cybercriminals breached the information systems at WPM Pathology Laboratory, a clinical laboratory based in Salina, Kansas, which works in conjunction with Salina Regional Health Center.

The security breach allowed bad actors to access confidential servers containing patient records. Following an internal investigation, WPM Pathology sent individual notification letters to affected patients informing them that their personal identifiers and protected health information had been exposed.

The lawsuit alleged that both entities failed to implement reasonable cybersecurity measures to shield sensitive patient records from foreseeable network intrusions, leaving thousands of people exposed to potential financial exploitation.

What Data Was Compromised in the Security Failure?

According to court records, the unauthorized third party accessed files containing a broad array of sensitive patient details. The exposed information included:

• Full names and dates of birth

• Social Security numbers

• Medical record numbers (MRNs)

• Diagnosis and treatment information

• Health insurance claims data

When clinical data and Social Security numbers are exposed together, individuals face heightened risks of medical identity theft, falsified health insurance claims, and financial account fraud.

Allegations Raised in the Kansas Medical Privacy Lawsuit

The class action lawsuit alleged that WPM Pathology Laboratory and Salina Regional Health Center failed to uphold basic standards of medical data privacy by omitting industry-standard administrative and technical safeguards.

Plaintiffs in the case brought legal claims including negligence, breach of implied contract, unjust enrichment, and invasion of privacy. The lawsuit claimed that the providers failed to deploy necessary encryption, firewalls, and access controls, forcing victims to spend time and money monitoring their credit files, placing fraud alerts, and securing their identity profiles.

Both WPM Pathology Laboratory and Salina Regional Health Center deny all allegations of wrongdoing and maintain that their security measures were appropriate. However, to avoid the high costs, delay, and distraction of continued litigation, the organizations agreed to a class action settlement. The court granted preliminary approval to the deal on July 20, 2026.

What Compensation and Benefits Can You Receive From the Settlement?

Eligible class members can choose between multiple cash reimbursement options based on their situation, along with free credit monitoring tools.

1. Reimbursement for Ordinary Out-of-Pocket Expenses (Up to $400)

Class members who incurred documented routine expenses resulting directly from the breach can claim up to $400 in cash reimbursement. Eligible expenses incurred between November 4, 2024, and October 19, 2026, include:

• Fees paid for credit reports, credit monitoring, or credit freezes and unfreezes.

• Costs associated with obtaining replacement driver’s licenses or government identification cards.

• Postage, notarization, and communication fees tied to addressing the incident.

2. Reimbursement for Extraordinary Losses (Up to $4,000)

Class members who suffered documented, unreimbursed monetary losses due to identity theft or fraud tied to the breach between November 4, 2024, and October 19, 2026, can claim up to $4,000. Supporting proof, such as bank statements, receipts, or police reports, is required for both ordinary and extraordinary expense claims.

3. Compensation for Lost Time

All class members can submit a claim to receive reimbursement for up to four hours of lost time spent responding to the breach, calculated at $20 per hour (up to $80 total). This covers time spent changing passwords, researching the incident, or investigating suspicious account alerts.

4. Alternative Flat Cash Payment ($45)

In lieu of submitting claims for documented expenses or lost time, class members can elect to receive a one-time flat cash payout of $45. No receipts or proof of financial loss are required to receive this benefit.

5. Two Years of CyEx Identity Defense Complete

All class members, regardless of the cash option chosen, can enroll in two years of complimentary CyEx Identity Defense Complete. This service includes active credit monitoring, dark web scanning, public records monitoring, and identity theft insurance coverage.

Understanding Healthcare Data Privacy Rights

Under federal standards such as the Health Insurance Portability and Accountability Act (HIPAA) and state privacy laws, healthcare providers and clinical labs have a strict legal duty to safeguard protected health information against unauthorized access.

When medical institutions collect sensitive items like Social Security numbers and diagnosis records, they assume a legal obligation to defend those systems with modern cybersecurity protocols. Class action lawsuits serve as a vital mechanism for everyday people to join together, hold corporations accountable when security vulnerabilities are exploited, and obtain meaningful financial recovery.

Who Is Eligible to File a Settlement Claim?

You may be eligible to participate in the settlement if you reside in the United States and received an individual notice from WPM Pathology Laboratory or Salina Regional Health Center stating that your private information was potentially compromised in the November 2024 data breach.

Court documents indicate that approximately 5,619 individuals fall within the settlement class.

If you received a notice in the mail, it contains a unique Login ID and PIN required to access your claim form online. To review settlement terms or file a claim, you can visit the court-approved settlement portal at WPMPLDataBreach.com.

Critical Deadlines and Court Hearing Dates

To claim settlement benefits or preserve your legal rights regarding this security incident, you must meet several court-ordered deadlines:

If you take no action, you will forfeit your right to receive cash compensation or identity monitoring, and you will give up your legal right to participate in future litigation regarding this incident. Payouts will begin only after the court grants final approval and any potential appeals are resolved.

How to Submit Your Claim Step-by-Step

Submitting a claim takes only a few minutes online:

1. Visit the Settlement Portal: Go to WPMPLDataBreach.com.

2. Log In: Enter the Login ID and PIN found on your mailed notice.

3. Choose Your Payout: Select whether you are requesting documented expense reimbursement (up to $4,000 extraordinary / $400 ordinary), lost time compensation (up to $80), or the alternative $45 flat cash payment.

4. Upload Proof (If Required): If claiming out-of-pocket losses, attach digital copies of receipts, bank notices, or fraud reports.

5. Select Identity Protection: Check the box to enroll in two years of free CyEx Identity Defense Complete monitoring.

6. Submit Before Deadline: Complete your online submission by 11:59 p.m. on October 19, 2026, or ensure paper claim forms mailed to the administrator are postmarked by October 19, 2026.

Everyday people entrust medical laboratories and regional hospitals with their most personal health records. When computer systems are compromised due to inadequate security, patients should not have to pay out of pocket to protect their identities.

Don’t stand alone. If your personal or medical records were exposed in the November 2024 WPM Pathology data breach, exercise your rights and file your claim before the October 19, 2026 deadline.