William B. Federman

At 3:07 on the afternoon of Sunday, December 24, 2023, an email went to Dia Campbell-Detrixhe from a sender that called itself Dataleakege. Its subject line read “[INTEGRISOK BREACH] Your personal data is selling on the darknet.” It greeted her by her full name and told her that Integris Health had been breached in November and that the data of over two million patients had been compromised. “We provide a sample of your data as proof,” it said. “This data will sell on the darknet and be used for fraud and identity theft.” The sender said it had gone to the health system first: “We have contacted Integris Health, but they refuse to resolve this issue.”

The email then set out what she could do about it. She could install the Tor Browser, open an account in the sender’s online shop, buy credits in Bitcoin through Coinbase or Binance, find her own record and click REMOVE, at a price of $50. Viewing a record cost $3. A buyer who was not satisfied could have $45 refunded, after which the sender would “add the data back to the shop.” On January 5, 2024, the email said, the entire database would be sold to data brokers.

Integris Health has said that an intruder first got into its systems on November 28, 2023. Its patients found out on Christmas Eve, from the intruder. That day, people who had been treated at the largest Oklahoma-owned not-for-profit health system in the state began receiving emails from a group claiming responsibility for the attack. The group said it held their names, dates of birth, Social Security numbers, addresses, phone numbers, insurance information and employer information. Integris learned of the emails on December 24, the same day its patients did, and urged anyone who received one not to respond or contact the sender. In statements after Christmas it said that certain files may have been accessed on November 28. The attacker had copied data without encrypting the health system’s files. Integris’s own letters to patients came later.

An Edmond man whose December 24 extortion email recited his name, Social Security number, phone number and address received Integris’s notice on January 5—thirty-eight days after the intrusion and twelve days after the hackers wrote to him. “They breached in November, the bad guys let me know in December, and I don’t hear anything from INTEGRIS until the start of the new year?” he told a reporter, on the condition that he not be named. “It appears to me that INTEGRIS couldn’t organize a two-car funeral.”

William B. Federman, an Oklahoma City class-action lawyer with four decades of trial and appellate practice, had already sued. On December 29, 2023, five days after the Christmas Eve emails, he filed Zinck v. Integris Health, No. 5:23-cv-01208, in the U.S. District Court for the Western District of Oklahoma on behalf of Aaron Zinck and others whose data had been taken. The complaint alleged that Integris failed to put reasonable and appropriate security in place despite knowing the high risk of ransomware and other cyberattacks on hospitals, and then withheld information patients needed to protect their identities against fraud. The same day, in the same court, Campbell-Detrixhe’s Christmas Eve email was filed as Document 1-1 in No. 5:23-cv-01209, the next case number. “Why didn’t they tell people?” Federman asked in an interview with KFOR.

Over the next two years, the District Court of Oklahoma County appointed Federman and James J. Pizzirusso of Hausfeld LLP interim co-lead counsel for the patients. Integris denied wrongdoing, moved to dismiss five of the patients’ eight claims, and sued the vendor it blamed for the breach. The patients, through a mediator, made a best and final offer that Integris accepted: $30 million for a class of about 2.4 million people, 255,647 of them minors. The patients’ pleadings carried forward the two points Federman made in the first week—what Integris did to protect the data before November 28, and how long it waited to tell patients afterward.

Credit Monitoring and a Month of Silence

Federman’s first public account of the case named both failures. “They chose to not spend the money to harden their cybersecurity system,” he told KFOR. The information the hackers claimed to hold, he said, could be used to ruin credit, file fraudulent tax returns and create fake identification—enough to wreak havoc on people’s lives. “That’s not a merry Christmas,” he said.

He had made the same argument about another company fifteen months earlier. In September 2022 he represented at least four people in Illinois, Michigan and Kentucky suing AFNI, a collection agency in Bloomington, Illinois, over a breach that, one suit alleged, had happened in June 2021 and gone unreported for over a year. “Breaches should not occur,” he told 25 News in Peoria. They generally happen to corporations, he said, “when the companies do not spend the sufficient amount of money to secure.”

He objected as well to the order of events: Integris had released no statement until after the hackers had written to its patients. “They’ve withheld this information for over a month while people have been mucking around in your and everyone else in Oklahoma City’s personal information?” he said. Integris said that after its investigation it would offer free credit monitoring to the people affected. “Normally in this situation, the company will offer some type of ID theft and medical monitoring for a small snippet of time,” Federman said. “Whoever is advising them is simply wrong. They’ve done this wrong.”

The offer Integris eventually made was twenty-four months of free credit monitoring and identity restoration through IDX. An Integris communications manager, Brooke Cayot, wrote that the privacy, confidentiality and security of patients’ personal information were top priorities for Integris, and that the health system was working with outside specialists to determine the scope of the affected data and whose data it was. Integris’s letters told patients that the incident did not involve credit card or other financial or payment information.

Eleven Federal Suits and the Judge’s Own Clerks

Federman’s suit was one of eleven filed against Integris in federal court in Oklahoma City, and the federal cases went to Chief Judge Timothy DeGiusti. Integris was served with Federman’s complaint on January 2, 2024, and Zinck was reassigned to DeGiusti three days later. A federal complaint filed December 28 listed five causes of action: negligence, negligence per se, breach of implied contract, unjust enrichment, and declaratory and injunctive relief.

In a January 31, 2024 order, DeGiusti disclosed that the breach had reached his own chambers. The mother of one law clerk assigned to the case was a class member, and two other law clerks in his chambers were class members themselves. He gave the parties until February 5 to object; if anyone did, he would find a “conflict-free law clerk from another judge in the Western District.” The same order recorded the preliminary count from Integris’s lawyer, Amanda Harvey: about 2,285,646 patients affected, roughly 90 percent of them Oklahoma residents. It directed Integris to file, by February 13, its “most recent interpretation of the figures regarding residency” of the people who might make up the class.

Extortion Emails and a Growing Count

By mid-February 2024 Federman was describing the case at greater length. “INTEGRIS has not been forthcoming with many details,” he said. “It appears there was a ransomware attack.” He drew one conclusion from what his clients had received. “We’re fairly confident that information was exfiltrated,” he said, because the class members had been receiving “essentially blackmail emails from the bad actor.”

Patients told BleepingComputer that the emails contained accurate personal information. The shop the emails pointed to, on the Tor network, listed about 4,674,000 records containing names, Social Security numbers, dates of birth and hospital visit information, a count that may have included duplicates. Integris kept finding more. In letters dated March 26, 2024, it told patients of four Integris Health Community Hospitals that on or about January 29 it had determined that their information was in the accessed files too. The FBI’s Oklahoma City field office asked anyone who had been contacted by the group to fill out a short questionnaire, which it said could be useful in its investigation.

Federman faulted Integris for what it had not told its patients. “It’s very troubling that INTEGRIS is not ahead of the game here and seems to be behind the eight ball,” he said. “It’s essentially been silence from INTEGRIS. You just can’t be the ostrich with your head in the ground. You have to be proactive. You’re failing your customers, your patients.” He said he expected Integris to “stiff arm” class members as they sought more information about the attack and its reach. “It doesn’t behoove anyone—the class members, INTEGRIS, nobody—for INTEGRIS to simply keep a secret here,” he said. “That’s what they’re doing: Playing corporate amnesia.”

Co-Lead Counsel in Oklahoma County

The case that ended in a settlement ran in state court. On January 30, 2024, DeGiusti had held a telephone conference on the Class Action Fairness Act’s geography-based exceptions to federal jurisdiction, because so many of the patients appeared to live in Oklahoma. On February 12 Integris’s counsel reported that 2,431,693 of the 2,624,041 people notified nationwide lived in Oklahoma. On February 15 DeGiusti ordered the parties to show whether federal jurisdiction was proper over suits in which over 90 percent of the proposed class members were citizens of the same state as Integris. The plaintiffs asked him to dismiss their federal cases; by March 6 he had dismissed two, and all eleven federal suits were later voluntarily dismissed without prejudice.

In the District Court of Oklahoma County, Clendon Detrixhe had filed the first class action over the breach on December 28, 2023, and nine more followed there. On February 23, 2024, the Oklahoma County court appointed Federman and Pizzirusso interim co-lead class counsel. Lawyers from five other firms served on the plaintiffs’ steering committee. The court consolidated the Oklahoma County cases on March 7 under Case No. CJ-2023-7235, and on April 15 the patients filed a consolidated class action petition.

The consolidated petition pleaded eight claims: negligence; negligence per se; breach of implied contract; unjust enrichment; negligent training, hiring and supervision; deceit, nondisclosure and concealment; breach of fiduciary duty; and declaratory and injunctive relief. Three of them—negligent training, hiring and supervision; deceit, nondisclosure and concealment; and breach of fiduciary duty—had not appeared among the five causes of action in the December 28 federal complaint.

Integris moved to dismiss five of the eight: negligence per se, breach of implied contract, unjust enrichment, the deceit, nondisclosure and concealment claim, and the claim for declaratory and injunctive relief. It did not move against the negligence, negligent-training or fiduciary-duty claims. The parties fully briefed the motion, and on October 3, 2024, Integris filed a partial answer. Throughout, Integris denied every allegation of wrongdoing and liability and every material allegation of the consolidated petition.

Delta Petroleum’s Explanation and Orrick’s Breach

Federman founded Federman & Sherwood, which has offices on North Pennsylvania Avenue in Oklahoma City, in Dallas, and in Gainesville, Florida. He graduated cum laude from Boston University in 1979 and received his law degree from the University of Tulsa in 1982, and he is admitted in Oklahoma, Texas, New York and the District of Columbia. He published an Oklahoma Bar Journal article on the corporate attorney-client privilege in 1981, the year before he finished law school, and in 1983 an article in the Securities Regulation Law Journal on liability from indirect remuneration in private oil and gas offerings. In 1985 he served on the New York Stock Exchange arbitration panel.

Alongside its data-breach and consumer class actions, the firm brings securities class actions and shareholder derivative suits for investors. One reached the Tenth Circuit. In March 2010 Delta Petroleum had announced that Opon International would pay $400 million for a 37.5 percent non-operating interest in its Vega Area assets, and it repeated the price in statements through June. In July, Delta’s chairman, Daniel Taylor, announced that the deal was over because Opon could not arrange financing. A Delta shareholder, Patipan Nakkhumpun, alleged that Opon had in fact backed out after valuing the assets below $400 million. Stuart W. Emmons of Federman’s firm appeared for Nakkhumpun, with Federman on the briefs. On April 7, 2015, the court of appeals revived the claim against Taylor. “Together, these factual allegations entail a false statement when Mr. Taylor attributed the impasse to Opon’s inability to obtain financing,” Judge Bacharach wrote. The court also accepted Nakkhumpun’s account of when the truth reached the market: November 9, 2011, when Delta disclosed that it had found no buyer at that price.

In data-breach cases outside Oklahoma, the firm has served as interim lead counsel in the litigation over a breach at the law firm Orrick, Herrington & Sutcliffe in the Northern District of California and as executive lead counsel in the litigation over a breach at Intellihartx in the Northern District of Ohio. Companies including EyeMed Vision Care, Delta Dental and MultiPlan had hired Orrick to respond to breaches of their own. In March 2023 attackers got into Orrick’s systems, and the personal information of 637,620 people was exposed, many of them customers of those clients. Orrick agreed to pay $8 million into a fund that would not revert to it. On November 8, 2024, Judge Susan Illston approved the settlement, which offered up to $7,500 for extraordinary losses and three years of credit monitoring; at the hearing, plaintiffs’ counsel reported that tens of thousands of claims had already come in.

Integris Sues Tech Mahindra, Then Drops It

On October 17, 2024, Integris named someone else as responsible. It filed a third-party petition against Tech Mahindra, LLC, alleging that the breach was the direct result of TechM’s failure to implement or follow adequate and reasonable cybersecurity procedures. Integris sued the vendor for negligence, breach of express contract, unjust enrichment, and common-law defense and indemnity.

TechM responded on November 14 with a motion to compel arbitration and to dismiss. On November 26, 2024, Integris voluntarily dismissed TechM without prejudice. The settlement later released Tech Mahindra along with Integris. Integris continued to deny any wrongdoing and said it settled to avoid the cost, risk and uncertainty of continuing the litigation.

A Best and Final Offer Through the Mediator

Settlement talks ran alongside the fight over the vendor. The parties first met with mediator Daniel E. Holeman on October 8, 2024, and made progress without reaching an agreement. They met with him again on December 12, 2024. The second session also ended without an agreement. At its close the patients, through Holeman, made a best and final offer, and Integris ultimately accepted it.

Federman and Pizzirusso signed the settlement agreement for the class on July 3, 2025, and Integris’s chief financial officer signed on July 10. Integris agreed to pay $30 million into a settlement fund for everyone whose personal or health information was compromised in the incident—about 2,426,868 people, including 255,647 minors. The fund pays notice and administration costs, taxes, service awards to the named plaintiffs, and the fees and expenses the court allows; the rest goes to class members.

The agreement names fourteen class representatives. Joseph Bointy’s name heads the caption; Clendon Detrixhe, who had filed the first Oklahoma County suit, and Dia Campbell-Detrixhe, whose Christmas Eve email had gone into the federal record five days after she received it, are among the others. Class counsel asked the court to award each of the fourteen $5,000 for that service.

Postcards, Claim Forms and Receipts

Each class member may claim three years of credit monitoring from all three bureaus, with up to $1 million in identity-theft insurance, against the twenty-four months Integris had offered on its own. A class member may also claim either reimbursement of up to $25,000 for documented out-of-pocket losses fairly traceable to the breach or an equal share of what remains in the fund after those costs and claims, estimated at about $100 and adjusted by the number of claims.

Notice went out on September 22, 2025, by postcard and email, with a longer notice posted on the settlement website. A class member could file online with the ID printed on the notice or mail a paper form; either way the claim was made under a sworn affirmation, with no notary required. The documented losses the notice gave as examples included unreimbursed fraudulent charges made on or after November 1, 2023, overdraft and late fees, the cost of credit reports and credit freezes, card replacement, and the cost of closing and opening accounts. Receipts were required; handwritten receipts and other self-prepared documents were not enough on their own.

Integris also made business-practice improvements and commitments to strengthen its data security, set out in a declaration it provided with the agreement, and estimated their cost at about $900,000. Integris has paid or will pay that cost separately; none of it comes out of the $30 million.

Notice to the Attorney General

Oklahoma had two health-system breaches within a week. Ardent Health Services, parent of northeast Oklahoma’s Hillcrest Healthcare System, announced a cyberattack it dated to November 23, five days before the Integris intrusion. In December, Sen. Brent Howard of Altus filed Senate Bill 1337, which he said grew out of an initiative the Attorney General’s Office had begun the previous August or September. At the time, Oklahoma’s Security Breach Notification Act set no deadline for notifying the attorney general. Howard’s bill proposed requiring notice to the attorney general within sixty days of discovering a breach, adding hospitals to the entities covered, and allowing civil penalties of $150,000 or $2,000 per affected person per breach, whichever was greater.

Howard returned to the issue in 2025 with Senate Bill 626, which became law without the governor’s signature on May 28, 2025, and took effect January 1, 2026, for breaches determined or reported on or after that date. When a breach affects 500 or more Oklahoma residents, an entity that must notify them must also notify the attorney general no more than sixty days after notifying them. The attorney general or a district attorney may seek actual damages and a civil penalty of up to $150,000 per breach, based on the size of the breach, how far the entity’s conduct contributed to it, and any failure to give the required notice. An entity that used reasonable safeguards and gave the required notice faces no civil penalty; one that gave notice without reasonable safeguards faces actual damages and a $75,000 penalty.

Final Judgment and the Money Left Over

The Oklahoma County court preliminarily approved the Integris settlement on July 22, 2025. Class members had until November 21, 2025, to opt out or object and until December 22 to file claims, and the final approval hearing was set for December 12, 2025, in Judge Brent C. Dishman’s courtroom. The court then entered final judgment approving the settlement. That judgment is on appeal. Under the agreement, Integris funds the balance of the $30 million, beyond an initial deposit for notice and administration, only after appeals are resolved, and no class member is paid until then; the settlement administrator has given no estimate of when the appeal will be decided. The three years of credit monitoring wait as well: the administrator is to send enrollment instructions within sixty days after the settlement’s effective date, which follows the end of any appeal.

The agreement also decides what happens to money that goes unclaimed. If funds remain in the net settlement fund 150 days after the first payments, the administrator splits them evenly among the participating class members in a second payment, so long as the average second payment would be at least $5. Whatever is left after that goes to Infant Crisis Services, an Oklahoma City nonprofit that supplies food, formula, diapers and clothing to babies and toddlers from birth to their fourth birthday.