Sherr Puttmann Akins Lamb $455,000 Data Breach Settlement, Who Qualifies, How to Claim and the December 28, 2026 Deadline

People whose private information may have been exposed in an August 2024 cyberattack on the Denver law firm Sherr Puttmann Akins Lamb PC (SPAL) can file a claim in a $455,000 class action settlement in Freeman, et al. v. Sherr Puttmann Akins Lamb PC, Case No. 2024CV33283. The settlement offers two years of credit monitoring, reimbursement of up to $100 for documented expenses and lost time, up to $900 for documented identity theft or fraud losses, or a cash payment of up to $50 in place of everything else.

You must file a claim to receive any benefit, and the deadline is December 28, 2026. The same date is the deadline to opt out or object. The Court’s final approval hearing is set for February 5, 2027, at 1:30 p.m. Mountain Time. SPAL has not been found liable, and the settlement is not final yet.

Research updated November 9, 2026, based on the official settlement website and FAQ run by the settlement administrator.

Sherr Puttmann Akins Lamb Settlement Quick Facts

Settlement detail	Information
Settlement amount	$455,000 Settlement Fund
Defendant	Sherr Puttmann Akins Lamb PC (SPAL), Denver, Colorado
Case	Freeman, et al. v. Sherr Puttmann Akins Lamb PC
Case number	2024CV33283
Court	2nd District Court of Denver, Colorado
Class representatives	Stephanie Freeman, Ryan Reddy and Holly Cook
Data incident	Files copied without permission between August 10 and 12, 2024
Credit monitoring	Two years of CyEx Identity Defense Complete, with $1 million identity theft insurance
Ordinary losses	Up to $100 (lost time of up to $60 counts toward this cap)
Extraordinary losses (identity theft or fraud)	Up to $900
Alternative cash payment	Up to $50, instead of all other benefits
Claim deadline	December 28, 2026
Opt-out deadline	December 28, 2026
Objection deadline	December 28, 2026
Final approval hearing	February 5, 2027, 1:30 p.m. MT, Courtroom 215, 1437 Bannock St., Denver, CO 80202
Class counsel	Finkelstein, Blankinship, Frei-Pearson & Garber, LLP and Levin Sitcoff PC
Settlement administrator	Simpluris
Official settlement website	www.spaldataincident.com
Administrator phone and email	(833) 360-6888; [email protected]
Status	Claims open; final approval pending

What Is the Sherr Puttmann Akins Lamb Data Breach Lawsuit About?

The lawsuit alleges that during a targeted cyberattack on SPAL’s computer systems in August 2024, files containing private information may have been accessed. The settlement notice says those files may have held:

• names
• Social Security numbers
• dates of birth
• state-issued identification, such as a driver’s license or non-driver ID
• financial account information
• health information

SPAL denies wrongdoing. The Court has not decided whether the plaintiffs or the firm are right. Both sides settled to avoid the cost and risk of a trial.

When Did the SPAL Data Breach Happen?

SPAL announced on September 5, 2024 that files on its computer network were copied without permission between August 10 and 12, 2024. That is why the settlement uses August 10, 2024 as the start date for claimable losses.

Because law firms keep information about more than their own clients, the class is not limited to people who hired SPAL. Former spouses, opposing parties and others who appear in a firm’s files could be affected.

Who Filed the Freeman v. Sherr Puttmann Akins Lamb Lawsuit?

Stephanie Freeman, Ryan Reddy and Holly Cook are the class representatives. They sued SPAL on behalf of themselves and other people whose information was potentially compromised. The case is pending in the 2nd District Court of Denver, Colorado, as Case No. 2024CV33283. Local reporting at the time said Freeman sued for negligence and sought class action status.

Which Laws Apply to the SPAL Data Breach Lawsuit and Settlement?

The settlement notice does not list the legal claims one by one, so readers who want the exact causes of action should check the operative complaint on the court docket. The legal framework below applies to cases like this one.

Negligence and Negligence Per Se

Data breach lawsuits against businesses and professional firms usually start with negligence. In Colorado, a negligence claim generally requires a duty of care, a breach of that duty, harm and a causal link between the breach and the harm. The plaintiffs’ argument is that a firm holding sensitive information must use reasonable security. A cyberattack alone does not prove negligence, because the question is whether the firm’s conduct fell below a reasonable standard.

A related theory, negligence per se, can apply when someone violates a statute meant to protect a particular group from a particular harm. The plaintiff must still prove injury and causation.

Contract and Fiduciary Duty

Plaintiffs in cases against law firms often also argue that confidentiality was part of an express or implied agreement, or that a fiduciary relationship required the firm to protect their information. Whether a fiduciary relationship exists depends on the person’s actual relationship with the firm. It does not automatically extend to everyone whose name appears in a law firm’s records.

Colorado Law on Protecting and Reporting Personal Information

Two Colorado statutes are relevant background:

• C.R.S. § 6-1-713.5 requires covered entities that maintain personal identifying information to use reasonable security procedures.
• C.R.S. § 6-1-716 requires covered entities to notify affected Colorado residents of a security breach, generally no later than 30 days after determining that a breach occurred, and to notify the Colorado Attorney General when a breach affects 500 or more Colorado residents.

The settlement does not decide whether SPAL complied with either statute.

Related article: Hilton Grand Vacations $750,000 MarBrisa Hotel Fees Settlement, Who Qualifies, Payment Election and January 21, 2027 Deadline

Lawyers’ Duty of Confidentiality

Colorado lawyers are bound by Rule 1.6 of the Colorado Rules of Professional Conduct, which protects information relating to the representation of a client. That duty is one reason a data breach at a law firm draws close attention.

Is This a HIPAA Settlement?

No. The notice mentions health information among the data that may have been involved, but this is not a settlement of a HIPAA violation. HIPAA does not generally give individuals a private right to sue for damages, and a breach involving health information does not by itself prove a HIPAA violation.

Court Approval Under Colorado Rule of Civil Procedure 23

A class settlement in Colorado state court needs court approval under C.R.C.P. 23(e). At the February 5, 2027 hearing, the judge will decide whether the settlement is fair, reasonable and adequate, and will also rule on class counsel’s fees and the service awards.

Who Qualifies for the Sherr Puttmann Akins Lamb Settlement?

The Court defined the class as: “All persons whose Private Information was potentially compromised as a result of the Data Security Incident which occurred in or around August 2024.”

If you received a notice about this settlement, or an earlier breach notice from SPAL, SPAL’s records identify you as a likely class member. If you did not get a notice but think your information was involved, contact the administrator.

Excluded from the class:

1. SPAL and its officers, directors and related companies
2. Anyone who validly opts out
3. The judge in the case and the judge’s family and staff
4. Anyone who perpetrated the Data Security Incident

How Much Can You Get From the SPAL Data Breach Settlement?

SPAL will create a $455,000 Settlement Fund. Court-approved attorneys’ fees and costs, service awards and administration costs come out first. The remaining money pays the benefits below.

Credit Monitoring: Two Years of CyEx Identity Defense Complete

All class members can claim it. The service includes real-time credit file monitoring, dark web scanning, public records monitoring, access to a fraud resolution agent and $1 million in identity theft insurance.

Ordinary Losses: Up to $100

You can be reimbursed for actual, documented out-of-pocket expenses caused by the incident, such as fees for credit reports, credit monitoring, credit freezes and unfreezes, the cost to replace IDs and postage to contact banks. The expense must have occurred between August 10, 2024 and December 28, 2026. You must send proof, such as receipts. Notes you prepared yourself can support other proof but are not enough alone. Expenses already reimbursed by a third party cannot be claimed.

Lost Time: Up to $60

You can claim up to four hours at $15 per hour for time spent on the incident, such as changing passwords, checking accounts for suspicious activity or researching the incident. You must briefly describe how you spent the time. The lost time counts toward the $100 Ordinary Losses cap. It is not on top of it.

Extraordinary Losses: Up to $900

If you lost money to identity theft or fraud, you can claim up to $900. You must show that:

1. the theft or fraud was probably caused by the Data Security Incident;
2. the losses are not already covered under Ordinary Losses; and
3. you tried to prevent or recover the loss, for example by using insurance you already have.

You must send proof, and the loss must have occurred between August 10, 2024 and December 28, 2026.

Alternative Cash Payment: Up to $50

Instead of any of the other benefits, you can claim a one-time cash payment of up to $50. You do not need to provide proof or an explanation. Choosing this option means giving up the credit monitoring and the loss reimbursements. The actual amount depends on how much money is left after all other claims, costs and expenses are paid, so it may be less than $50.

Benefit Summary

Benefit	Maximum	Proof required?
Credit monitoring	Two years	Claim required
Ordinary losses	$100	Yes, such as receipts
Lost time	$60 (counts toward the $100)	Brief description
Extraordinary losses	$900	Yes
Alternative cash payment	Up to $50, in place of all other benefits	No

The ordinary and extraordinary loss limits add up to $1,000 for someone who qualifies for both. That is a ceiling, not a typical payout. Each benefit has its own proof requirements, and the notice does not guarantee any amount.

How Will the $455,000 SPAL Settlement Fund Be Used?

Item	Amount
Total Settlement Fund	$455,000
Attorneys’ fees and costs requested	$145,600 (32% of the fund)
Service awards requested	$2,500 for each of three class representatives, $7,500 total
Left for benefits and administration costs	$301,900 before administration costs are deducted

The fee and service award requests are subject to Court approval. The administration costs also come out of the fund. The $301,900 figure is arithmetic from the notice’s amounts and is not an amount the notice states.

Class counsel are Todd Garber of Finkelstein, Blankinship, Frei-Pearson & Garber, LLP, and Bradley A. Levin, Jeremy A. Sitcoff and Robyn Levin of Levin Sitcoff PC. You are not charged for their services.

How to File a Sherr Puttmann Akins Lamb Settlement Claim

1. Go to the claim page. File online at www.spaldataincident.com/form/claim. The notice you received includes the information the portal uses to identify you.
2. Choose your benefits. Pick credit monitoring and loss reimbursements, or pick the alternative cash payment. You cannot do both.
3. Attach proof. Add receipts or other records for ordinary and extraordinary losses, and a short description for lost time.
4. Submit by December 28, 2026. Online claims must be completed by that date. If you mail a paper claim form, it must be postmarked by December 28, 2026, and the signed form should include your supporting documentation.

To get a paper form, download it from the settlement website or ask the administrator by phone, email or mail. Mail completed forms to: SPAL Data Security Incident Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958.

What If You Did Not Receive a Notice?

Contact the administrator at (833) 360-6888 or [email protected] and ask whether you are on the class list. They offer free help with eligibility questions.

Deadlines for the SPAL Data Breach Settlement

Action	Deadline
File a claim	December 28, 2026
Opt out	December 28, 2026
Object	December 28, 2026
Final approval hearing	February 5, 2027, 1:30 p.m. MT

How to Opt Out of the SPAL Data Breach Settlement

If you opt out, you get no settlement benefits and keep any right to sue SPAL on your own. To be valid, your Request for Exclusion must include:

1. the case name and number: Freeman, et al. v. Sherr Puttmann Akins Lamb PC, Case No. 2024CV33283, 2nd District Court of Denver, Colorado;
2. your full name, mailing address, telephone number and email address;
3. your personal signature; and
4. the words “Request for Exclusion” or a clear statement that you do not want to take part.

You can only exclude yourself, not anyone else. Mail it to the administrator at the address above, or email it, with a postmark or email date no later than December 28, 2026.

How to Object to the SPAL Data Breach Settlement

You can object only if you stay in the class. You cannot both opt out and object. Your written objection must include:

1. the case name and number;
2. your full name, mailing address, telephone number and email address;
3. whether the objection applies only to you or to other class members too;
4. all your reasons, with any legal support, such as documents;
5. if you have your own lawyer for the objection, the lawyer’s name, bar number and contact information;
6. any other cases in the past five years in which you, your lawyer or the lawyer’s firm objected, with names, courts, orders and case numbers;
7. whether you or your lawyer want to speak at the final approval hearing;
8. a list of any witnesses or documents you plan to use at the hearing; and
9. your signature (your lawyer’s signature is not enough).

File the complete objection with the Clerk of the Court (1437 Bannock Street, Courtroom 215, Denver, CO 80202) by December 28, 2026. Also send a copy to the Settlement Administrator, Class Counsel and counsel for the defendants, who are Gordon Rees Scully Mansukhani, LLP in Denver and New York. The full addresses are in the FAQ on the settlement website.

When Will SPAL Data Breach Settlement Payments Be Sent?

There is no payment date. The Court will hold the final approval hearing on February 5, 2027. If the settlement is approved there may be appeals, and benefits will be distributed only after any appeals are resolved. Filing your claim early does not speed up payment.

When Is the SPAL Final Approval Hearing?

The hearing is set for February 5, 2027, at 1:30 p.m. Mountain Time in Courtroom 215 of the 2nd District Court of Denver, 1437 Bannock St., Denver, CO 80202. The date and time may change without further notice, so check the settlement website. You do not have to attend. If you object on time, the Court will consider your objection even if you are not there.

What Happens If You Do Nothing in the SPAL Settlement?

You get no settlement benefit, and you give up the right to be part of any other lawsuit against SPAL over the issues this settlement covers. The release is described in Section XII of the Settlement Agreement, which is posted on the settlement website.

How to Protect Yourself After the SPAL Data Breach

A claim does not stop identity theft. Whether or not you file, you can:

• Freeze your credit. Federal law, 15 U.S.C. § 1681c-1, makes credit freezes free at all three credit bureaus.
• Place a fraud alert with a credit bureau if you suspect misuse.
• Review your financial statements and credit reports for accounts you do not recognize.
• Report identity theft at the FTC’s IdentityTheft.gov and keep a record, since documented losses can support an Extraordinary Losses claim.

Who Is the SPAL Settlement Administrator?

Simpluris administers the settlement.

• Official settlement website: www.spaldataincident.com
• Toll-free: (833) 360-6888
• Email: [email protected]
• Mail: SPAL Data Security Incident Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958

Do not contact the Court or the Clerk about the settlement.

Frequently Asked Questions About the Sherr Puttmann Akins Lamb Settlement

Is the Sherr Puttmann Akins Lamb $455,000 settlement real?

Yes. The 2nd District Court of Denver authorized the notice, and the settlement website posts the notice, Settlement Agreement and claim form for Freeman, et al. v. Sherr Puttmann Akins Lamb PC, Case No. 2024CV33283. Final approval is still pending.

Who qualifies for the SPAL data breach settlement?

Anyone whose private information was potentially compromised in the August 2024 incident. You do not have to have been an SPAL client.

How much can I get from the SPAL settlement?

Up to $100 for documented expenses and lost time, up to $900 for documented identity theft or fraud losses, and two years of credit monitoring. Or you can choose up to $50 instead of all of those benefits.

Can I get the $50 payment and credit monitoring?

No. The alternative cash payment replaces all other benefits, including credit monitoring.

Is the $50 guaranteed?

No. It is a maximum, and the final amount depends on how much is left in the fund after other claims, costs and expenses.

Do I need receipts?

For ordinary and extraordinary losses, yes. Self-prepared notes alone are not enough. For lost time, you need a brief description of how you spent the time. For the alternative cash payment, you need no proof.

Is lost time paid on top of the $100 limit?

No. Up to $60 for lost time counts toward the $100 Ordinary Losses cap.

What is the SPAL claim deadline?

December 28, 2026, for online claims. Mailed claims must be postmarked by that date.

Does the settlement cover Social Security numbers and health information?

The notice lists Social Security numbers and health information among the types of information that may have been in the accessed files. The settlement does not depend on proving which of your information was taken.

Is this a HIPAA class action?

No. The settlement is a data security class action. It does not resolve a HIPAA violation claim.

When will I get paid?

No date has been set. Payments will be sent only after the Court gives final approval and any appeals are resolved.

Can I object and also file a claim?

Yes, if you stay in the class. You cannot object if you opt out.

Official Sources for the SPAL Data Breach Settlement

• Official settlement website (administrator: Simpluris)
• Frequently Asked Questions
• Online claim form
• Official Notice
• Settlement Agreement
• Important Dates
• C.R.S. §§ 6-1-713.5 and 6-1-716; C.R.C.P. 23(e); 15 U.S.C. § 1681c-1

Related Data Breach Settlement Coverage

• Red Coats Inc. Data Breach Settlement, Claim Up to $5,000 and Free Credit Monitoring by January 7, 2027
• Benworth Capital Partners Data Breach Settlement, Claim $50 or Up to $5,000 by December 21, 2026
• Pillsbury Winthrop Shaw Pittman $2.34M Data Breach Settlement, Who Qualifies and How to Claim by December 7, 2026

This article is for general information only and is not legal advice. AllAboutLawyer.com is an independent information website, not a law firm.

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against the official FAQ and settlement website run by the administrator, Simpluris (www.spaldataincident.com), and the Colorado statutes cited, as of November 9, 2026. Last Updated: November 9, 2026.