A person who received an Inotiv breach notice could choose a $45 payment without producing receipts. To seek more, that person would need to document expenses, time, fraud, or identity-theft losses and satisfy the settlement administrator’s review. If the same person stayed in the class and filed nothing, the person would get no benefit and could still lose the right to pursue related claims.

That tradeoff sits at the center of a proposed settlement involving an August 2025 cyberattack on Inotiv’s systems. The agreement defines the incident as potential unauthorized access by a cyber threat actor from approximately August 5 through August 8. It identifies Social Security numbers, dates of birth, and financial information as examples of personally identifiable information that may have been involved.

The filing does not establish how many records were accessed, how many people experienced fraud, or what security weakness allowed the incident to occur. Beginning December 2, 2025, according to the agreement, Inotiv notified people whose information may have been compromised and provided instructions for credit monitoring.

The case moved toward settlement before the allegations were decided

Plaintiff Laramie Doyal filed a proposed federal class action on August 21, 2025. Later cases brought by Emily Merrell and Stefanie Wagner were consolidated. The plaintiffs alleged negligence, negligence per se, breach of implied contract, unjust enrichment, and, in an amended complaint, invasion of privacy.

Inotiv moved to dismiss the amended complaint and argued, among other things, that the plaintiffs lacked standing to bring certain claims in federal court. The agreement states that the motion was never decided. After mediation and further negotiations, the parties agreed to dismiss the federal action and refile in state court to eliminate jurisdictional issues.

1. August 5-8, 2025The settlement defines this as the period of potential unauthorized access to data stored by Inotiv.
2. August 21, 2025The first proposed federal class action was filed.
3. November 26, 2025The plaintiffs filed a consolidated complaint.
4. December 2, 2025Inotiv began notifying people whose information may have been compromised.
5. January 30, 2026An amended complaint added an invasion-of-privacy claim.
6. March 5, 2026The parties mediated. They reached no agreement that day but continued negotiating.
7. May 27, 2026The supplied settlement packet was filed in Marion County, Indiana.

Five benefit paths, with different evidentiary gates

The proposal combines a no-document cash option with reimbursement categories requiring progressively stronger proof. Identity-theft protection can be requested in addition to a cash benefit.

Lost time

Class members could claim up to four hours spent responding to the incident, including time dealing with replacement cards, reversing fraudulent charges, or monitoring accounts. A claimant must describe the work and attest that it was reasonably related to the breach.

Ordinary expenses

Up to $500 would be available for documented expenses such as credit monitoring, credit freezes, professional fees, postage, copying, mileage, and related costs. The administrator would decide whether an expense was reasonably connected to the breach.

Extraordinary losses

Payments of up to $4,000 would require an actual, documented, unreimbursed monetary loss associated with misuse, fraud, or identity theft. A claimant would need to show that the breach more likely than not caused the loss and that reasonable efforts were made to prevent or recover it, including using available insurance.

For both ordinary and extraordinary losses, the stated eligibility period runs from the date of the breach until seven days after settlement notice is sent. Self-prepared records can add context but are not enough by themselves.

A monitoring-service inconsistency needs clarification

The main agreement describes two years of credit monitoring covering one of the three major credit bureaus. The attached long-form notice and claim form instead name CyEx Medical Shield Complete and list monitoring for health insurance identifiers, medical record numbers, and unauthorized Health Savings Account spending. Final approved materials would need to make clear precisely which monitoring package class members receive.

Claims would be reviewed one person at a time

There is no automatic payment. A class member must submit a signed claim by the eventual deadline. The settlement administrator would verify membership and decide whether claims for lost time and documented expenses satisfy the agreement.

If a documented claim is deficient, the administrator must provide 21 days to attempt a cure. If the claim is ultimately denied, other than because the claimant is not a class member, or approved for less than $45, the claimant would instead receive the $45 alternative payment.

No fixed settlement total appears in the agreement

The proposal does not create a stated common fund or identify a maximum amount available to the class. Instead, it requires Inotiv to provide enough money to satisfy the full amount of approved claims and the requested monitoring benefits. The final cost therefore depends on the number and type of claims that pass review.

Doing nothing could still surrender legal rights

The release is broader than the claims-payment process. Once the settlement becomes effective, participating class members would release Inotiv and a long list of related parties from known and unknown claims arising from or related to the data breach and conduct that was or could have been alleged in the litigation.

A class member does not need to file a claim to become bound. Unless the person submits a valid exclusion request, doing nothing would mean receiving no settlement benefit while still giving up covered claims.

Inotiv denies liability, and no merits ruling resolved the dispute

Inotiv denies all allegations of wrongdoing or liability and states that it has meritorious defenses. The agreement also says the settlement cannot be used as an admission of fault. The plaintiffs and their lawyers describe the compromise as fair in light of litigation risks, delay, expense, and the possibility of no recovery.

The supplied record does not contain a judicial finding that Inotiv failed to protect personal information. It also does not establish that the cyberattack caused any particular person’s fraud or identity-theft loss. Those questions were not resolved because the dismissal motion was never decided and the parties negotiated a settlement before trial.

The dates in the consumer forms are still blank

The attached notices contain placeholders for the settlement website, claim deadline, opt-out deadline, objection deadline, and final approval hearing. The agreement supplies formulas for calculating those dates, but not completed calendar dates.

The packet includes proposed preliminary and final approval orders, but both are unsigned forms with blank dates. Their findings are requested language, not evidence that the court has already approved the settlement or made final findings about the class.

The core bargain

The proposal prices the simplest resolution at $45, places heavier proof requirements on people claiming larger losses, and secures a broad release from everyone who remains in the class. Whether that bargain becomes binding depends first on court approval, then on notice, claims, exclusions, and the passage of any appeal period.

The most important facts are therefore not only the advertised payment limits. They are the absence of an automatic payment, the evidence demanded for larger claims, the rights surrendered by inaction, and the unanswered question of how many people will ultimately receive each benefit.