A two-week network intrusion at an upstate New York pharmacy and health sciences college reached the personal and clinical records of 26,411 people. Suspicious activity surfaced on September 14, 2024, and investigators traced the unauthorized access back to August 31; notification letters from Albany College of Pharmacy and Health Sciences went out in two waves during 2025.
Government identity documents, Social Security and financial details, insurance and medical information, and student records all sat inside the exposure. Four class actions followed, consolidated into a single case in the Supreme Court of Albany County alleging negligence, intrusion upon seclusion, implied contract, unjust enrichment, and a violation of New York’s breach-notification law. Every claim was denied, and mediation failed before the material terms came together. Class members can now claim two years of identity monitoring plus reimbursement of documented losses up to $5,000, or up to four hours of lost time at $20 per hour, with a $25 cash payment available instead. Objections and opt-outs are due October 16, 2026, claims close November 16, and a final fairness hearing is set for December 10.
