Greylock McKinnon Data Security Litigation

A federal court authorized this Notice because you have the right to know about the Settlement of this class action lawsuit and about all your rights and options before the Court decides whether to grant Final Approval of the Settlement. This Notice explains the lawsuit, the Settlement, your legal rights, what benefits are available, who is eligible for the benefits, and how to get them.

The Honorable Denise J. Casper of the United States District Court for the District of Massachusetts is overseeing this class action. The lawsuit is known as In re Greylock McKinnon Associates Data Security Litigation, Case No. 1:24-CV-10797-DJC (“lawsuit”). The individuals who filed this lawsuit are called the “Plaintiffs” and/or “Class Representatives” and the company sued, Greylock McKinnon Associates, Inc., is called the “Defendant.”

Plaintiffs filed this lawsuit against Defendant, individually, and on behalf of Settlement Class Members whose Personal Information, which may have included names, Social Security numbers, Medicare Health Insurance Claim Numbers, medical information and/or health insurance information may have been accessible in the Data Incident.

Plaintiffs allege on or about May 30, 2023, because of the Data Incident, an unauthorized third party potentially gained access to Settlement Class Members’ Personal Information. Plaintiffs brought this lawsuit against Defendant.

Defendant denies the legal claims and denies any wrongdoing or liability. No court or other judicial entity has made any judgment or other determination of any wrongdoing by Defendant, or that any law has been violated. Instead, Plaintiffs and Defendant have agreed to a settlement to avoid the risk, cost, and time of continuing the lawsuit.

In a class action, one or more people (called class representatives) sue on behalf of all people who have similar legal claims. Together, all these people are called a class or class members. One court resolves the issues for all class members, except for those class members who timely exclude themselves (opt out) from the class.

The Class Representatives in this lawsuit are Plaintiffs Tim Isaac, Mary Gregel, Theresa McFadden, Valerie Gunther, LeLand Wooten Jr., Paulette Zalewski, Dale Robertson, Albert Waddington, Dina Crocetto-Waddington, John McLaughlin, Charles McCurdy, Lynn Kohler, Richard Lilly, Daniel Jaspserson, and Michael Rosen.

Plaintiffs and Defendant do not agree about the legal claims made in this lawsuit. The lawsuit has not gone to trial, and the Court has not decided in favor of Plaintiffs or Defendant. Instead, Plaintiffs and Defendant have agreed to settle the lawsuit to avoid the risks, delay, and expense of continuing the litigation. The Class Representatives and their lawyers believe the Settlement is best for all Settlement Class Members because of the benefits available to Settlement Class Members and the risks and uncertainty associated with continuing the lawsuit.

You are a Settlement Class Member if you are a member of the Damages Settlement Class or the Injunctive Relief Settlement Class.

The Injunctive Relief Settlement Class includes all individuals residing in the United States whose Personal Information was affected by the Data Incident.

The Damages Settlement Class includes all individuals residing in the United States whose Social Security number was affected by the Data Incident.

Yes. Excluded from the Settlement Class are (1) the judges presiding over this lawsuit, and members of their direct families; (2) the Defendant, its subsidiaries, parent companies, successors, predecessors, and any entity in which the Defendant or its parents have a controlling interest, and its current or former officers and directors; and (3) Damages Settlement Class Members who submit a valid Request for Exclusion prior to the Opt-Out Deadline.

If you are a Damages Settlement Class Member and you submit a timely and valid Claim Form, you may be eligible for the following Settlement Benefits:

Cash Payment A – Documented Losses

You may submit a timely and valid Claim Form and provide supporting documentation showing you spent money or incurred unreimbursed losses fairly traceable to the Data Incident for up to $10,000 per person.

Examples of documented losses include out-of-pocket expenses incurred as a result of the Data Incident, including (without limitation) bank fees, professional fees (such as fees for an attorney or accountant), credit repair services, costs for freezing or unfreezing credit, notary fees, photocopying costs, long distance phone charges (if charged separately), cell phone charges (only charged by the minute), data charges (only if charged based on the amount of data used), postage, mileage for local travel and fees for credit reports, credit monitoring (other than what was provided by Defendant or is available through this Settlement), or other identity theft insurance products (other than what was provided by Defendant).

Examples of reasonable documentation include (but are not limited to): (i) credit card statements; (ii) bank statements; (iii) invoices; (iv) telephone records; and (v) receipts. “Self-prepared” documents such as handwritten receipts are, by themselves, insufficient to receive reimbursement, but can be considered to add clarity or support other submitted documentation. You will not be reimbursed for expenses if you have been reimbursed for the same expenses by another source.

If you do not submit reasonable documentation or if your Claim Form is rejected by the Settlement Administrator for any reason, and you do not resolve the rejected Claim Form, your Claim Form will be treated as if you elected Cash Payment B only.

Cash Payment B – Cash Payment

In addition to Cash Payment A, you may also elect to receive Cash Payment B, which is a flat cash payment. The amount of the payment will be based upon the amount in the Net Settlement Fund, if any, after the payment of Valid Claims for Cash Payment A and for Credit Monitoring, and attorneys' fees and costs and settlement administration fees and costs; and the number of Valid Claims for Cash Payment B.

If the amount of timely and valid claims for Cash Payment A and cost of Credit Monitoring exceeds the amount of the Net Settlement Fund, no payments will be made for Cash Payment B, although that is not anticipated to occur.

Credit Monitoring

In addition to Cash Payments A and B, you may also elect to receive credit monitoring services consisting of one year of one credit bureau.

If you are only in the Injunctive Relief Settlement Class (meaning your Personal Information was affected by the Data Incident but not your Social Security number), your only remedies under the Settlement are the business practice changes made by the Defendant. Although the Defendant denies any wrongdoing or liability, Plaintiffs have received assurances that the Defendant has undertaken reasonable steps to further secure its computer systems and environments.

If you are a member of the Damages Settlement Class, unless you exclude yourself (opt out), you are choosing to remain in the Damages Settlement Class. If the Settlement is approved and becomes final, all Court orders and any judgments will apply to you and legally bind you. You will not be able to sue, continue to sue, or be part of any other lawsuit against the Defendant or any of the Released Parties relating to the Data Incident. The specific rights you are giving up are called “Released Claims” and are described under Question 10 below.

If you are a member of the Injunctive Relief Settlement Class, you cannot exclude yourself from the Injunctive Relief Settlement Class. You will receive the benefit of the injunctive relief (steps taken by Defendant to secure its computer systems and environments) and will give up all claims for injunctive relief that result from, arise out of, are based upon, or relate to the Data Incident.

The Released Claims for Damages Settlement Class Members include all claims that result from, arise out of, are based upon, or relate to (a) the Data Incident; (b) the lawsuit; or (c) any of the alleged violations of laws or regulations cited in the Complaint. The Released Claims for Injunctive Relief Settlement Class Members include all claims for injunctive relief that result from, arise out of, are based upon, or relate to the Data Incident. Section XIII of the Settlement Agreement describes the Released Claims and the Release, in necessary legal terminology, so please read these sections carefully. The Settlement Agreement is available here in the Important Documents section. For questions regarding the Release or Released Claims and what the language in the Settlement Agreement means, you can also contact Class Counsel listed in Question 14 for free, or you can talk to your own lawyer at your own expense.

The deadline to submit a claim passed on June 9, 2025.

If you change your mailing address or email address after you submit a Claim Form, it is your responsibility to inform the Settlement Administrator of your updated information. You may notify the Settlement Administrator of any changes by writing to:

Greylock McKinnon Data Breach Litigation
Settlement Administrator
P.O. Box 2648
Portland, OR 97208-2648

As of November 3, 2025, check and digital payments have been sent out to eligible Class Members who submitted a valid claim. Check payments are valid for 180 days.

Yes, the Court has appointed Raina Borrelli of Strauss Borrelli PLLC and Jeff Ostrow of Kopelowitz Ostrow P.A. as Class Counsel to represent you and the Settlement Class for the purposes of this Settlement. You may hire your own lawyer at your own cost and expense if you want someone other than Class Counsel to represent you in this lawsuit.

Class Counsel will file a motion asking the Court to award the attorneys’ fees and costs of up to 33.33% of the $600,000 Settlement Fund. Class Counsel will also ask the Court to approve Service Awards for the Class Representatives of up to $2,500 each for their efforts in achieving the Settlement. If awarded by the Court, the attorneys’ fees and costs, and the Service Awards will be paid from the Settlement Fund. The Court may award less than these amounts.

Class Counsel’s application for the attorneys’ fees and costs and the Service Awards will be made available here in the Important Documents section no later than May 28, 2025.

The deadline to request exclusion from this Settlement passed on June 9, 2025.

If you are in the Damages Settlement Class and you opt out, you will not be entitled to receive Damages Settlement Class Benefits, but you will receive the benefit of the injunctive relief requiring that Defendant maintain certain steps taken to secure its systems and environments. You will release only all claims for injunctive relief that result from, arise out of, are based upon, or relate to the Data Incident. You can only get Damages Settlement Class Benefits, including money and/or credit monitoring, if you stay in the Settlement and submit a timely and valid Claim Form.

If you are a member of the Injunctive Relief Settlement Class only, you cannot exclude yourself from the Injunctive Relief Settlement Class.

No. Unless you are in the Damages Settlement Class and you opt out, you give up any right to sue any of the Released Parties for the legal claims this Settlement resolves and Releases relating to the Data Incident. You must opt out of this lawsuit to start or continue with your own lawsuit or be part of any other lawsuit against the Released Parties. If you have a pending lawsuit, speak to your lawyer in that case immediately.

If you are a member of the Injunctive Relief Settlement Class only, you cannot exclude yourself from the Injunctive Relief Settlement Class. You will not give up any right you may have, if any, to sue for damages, but you will release, all claims for injunctive relief that result from, arise out of, are based upon, or relate to the Data Incident.

The deadline to object to this Settlement passed on June 9, 2025.

Objecting is simply telling the Court you do not like something about the Settlement or the requested attorneys’ fees and costs. You can object only if you stay in the Settlement Class (meaning you do not opt out of the Settlement if you are in the Damages Settlement Class). Opting out of the Settlement is telling the Court you do not want to be part of the Damages Settlement Class or the Settlement. If you opt out, you cannot object to the Settlement.

The Court granted final approval on July 9, 2025. As of November 3, 2025, check and digital payments have been sent out to eligible Class Members who submitted a valid claim. Check payments are valid for 180 days.

The Court granted final approval on July 9, 2025. As of November 3, 2025, check and digital payments have been sent out to eligible Class Members who submitted a valid claim. Check payments are valid for 180 days.

The Court granted final approval on July 9, 2025. As of November 3, 2025, check and digital payments have been sent out to eligible Class Members who submitted a valid claim. Check payments are valid for 180 days.

If you are a Damages Settlement Class Member and you do nothing, you will not receive Damages Settlement Class Member Benefits, and you will give up rights explained in the “Opting Out from the Settlement” section of this Notice (Question 16), including your right to start a lawsuit, continue with a lawsuit, or be part of any other lawsuit against any of the Released Parties about the legal issues in this lawsuit that are released by the Settlement relating to the Data Incident. If you are an Injunctive Relief Settlement Class Member and do nothing, the Defendant’s business practice changes (reasonable steps to further secure its systems and environments) will still apply to you and your claims for certain injunctive relief will be released as described under Question 10 above.

This is only a summary of the proposed Settlement. If you want additional information about this Action, including a copy of the Settlement Agreement, the Complaint, the Court’s Preliminary Approval Order, Class Counsel’s Application for Attorneys’ Fees and Costs when available, and more, please visit the Important Documents page where the documents can be downloaded or call 1-888-859-8494. You may also contact the Settlement Administrator by writing to:

Greylock McKinnon Data Breach Litigation
Settlement Administrator
P.O. Box 2648
Portland, OR 97208-2648