Lumara Bio USA Data Breach Letter: What Happened and Your Legal Options
Got a data breach letter from Lumara Bio USA?
Dapeer Law, P.A. is investigating a potential class action against Lumara Bio USA, a U.S. division of Germany-based ITM SE, on behalf of current and former employees whose personal information may have been involved in a cyber-attack described in the notice Lumara Bio USA filed in Massachusetts.
Latest on the Lumara Bio USA data breach
- : Dapeer Law opened its investigation following notice filings posted by the Massachusetts Attorney General.
Who qualifies for the Lumara Bio USA data breach investigation
You may be eligible to participate in a class action if any of the following applies:
- You received a data breach notification letter from Lumara Bio USA.
- Your letter offered a complimentary 24-month Experian IdentityWorks membership. According to the notice text in the Massachusetts filing, the enrollment deadline is January 29, 2027.
- You are a current or former Lumara Bio USA employee. The notice text in the Massachusetts filing says the affected ITM systems contain personnel records relating to current and former Lumara Bio USA employees.
- No proof of harm required to consult with counsel. You do not need to have already suffered identity theft to explore your legal options.
- Excluded: individuals who did not receive a breach notice and whose information was not involved in the incident.
Not sure if you qualify?
Send us your notice, we'll confirm your eligibility at no cost.
What happened in the Lumara Bio USA data breach
According to the notice text in the Massachusetts filing, ITM SE, the Germany-based parent company of Lumara Bio USA, became aware of a cyber-attack affecting certain ITM information technology systems on September 12, 2026. The notice says ITM took affected systems offline, engaged external cybersecurity experts, and started an investigation. It says the ongoing forensic investigation identified unauthorized access to certain ITM systems containing personal information relating to current and former Lumara Bio USA employees.
The notice says the affected ITM systems contain personnel records. It says the personal information potentially involved may include names, addresses, dates of birth, Social Security numbers, driver's license numbers or other government identification information, salary and compensation information, and other employment-related information. The Massachusetts filing lists names, addresses, dates of birth, Social Security numbers, driver's license numbers, other government identification information, financial account information, salary and compensation information and other employment-related information, and it reports 2 Massachusetts residents affected. Lumara Bio USA is offering a complimentary 24-month Experian IdentityWorks membership; the notice text in the Massachusetts filing gives an enrollment deadline of January 29, 2027.
The notice does not say when the unauthorized access began, and it states that the investigation is continuing. Whether the company's practices for protecting employee personnel records met legal standards is among the issues being evaluated.
What to do if you got a Lumara Bio USA data breach letter
Keep your notice letter
Do not discard it. Your letter contains the activation code for Experian IdentityWorks and is important evidence if you decide to participate in a lawsuit.
Enroll in the free 24-month Experian IdentityWorks membership
Enroll in Experian IdentityWorks with the activation code in your letter before the deadline it states (January 29, 2027, according to the notice text in the Massachusetts filing). Accepting this benefit does not waive your right to pursue legal action.
Place a fraud alert or credit freeze
Contact Equifax, Experian, and TransUnion to place a fraud alert or freeze on your file. Request a free weekly credit report from AnnualCreditReport.com, and use the FTC's IdentityTheft.gov recovery guide. The notice also asks recipients to pay attention when submitting tax returns to protect against possible fraudulent submissions.
Speak with a data breach attorney
Consultations with Dapeer Law are free and confidential. We'll review your notice, explain your options, and advise whether you may be eligible to join a class action.
Submit your notice for a free review
Two minutes online. A licensed attorney reviews every submission.
Lumara Bio USA breach timeline
Compensation you may be entitled to
Out-of-pocket expenses
Credit freezes, identity restoration services, and other costs incurred responding to the breach.
Time spent monitoring
Hours spent reviewing accounts, disputing fraudulent charges, and dealing with identity theft issues.
Identity theft & fraud losses
Unreimbursed funds stolen from accounts, unauthorized credit lines, or tax refund fraud tied to the breach.
Statutory damages
Certain state data breach and consumer protection statutes provide for fixed damages regardless of actual loss.
Injunctive relief
Court orders requiring the company to implement stronger security practices for employee personnel records going forward.
Compensation categories depend on applicable state law, the types of data exposed, and documented losses. No recovery is guaranteed.
Lumara Bio USA data breach FAQ
I received a data breach letter from Lumara Bio USA. What should I do? +
Keep the letter. Enroll in the free 24-month Experian IdentityWorks membership with the activation code in your letter before the deadline it states (January 29, 2027, according to the notice text in the Massachusetts filing), and review your bank and credit card statements regularly. Consider a fraud alert or credit freeze, take care when submitting tax returns as the notice recommends, and contact a data breach attorney for a free consultation. Accepting the Experian membership does not waive your right to sue.
Is the Lumara Bio USA data breach letter real or a scam? +
Lumara Bio USA has reported this incident to the Massachusetts Attorney General. Compare your letter to the official filing linked in Sources below, and use only the enrollment website and phone number printed in your letter. Be cautious of unexpected calls, texts or emails about the breach that ask for your Social Security number or account login. If you are unsure, send your letter to Dapeer Law for a free review.
Am I eligible to join a class action against Lumara Bio USA? +
If you received a breach notice letter from Lumara Bio USA about this incident, you are likely eligible for a free case evaluation. The notice says the affected systems held personnel records relating to current and former Lumara Bio USA employees. Eligibility depends on your state of residence, the categories of your data that were involved, and any losses you have suffered. Dapeer Law will review your notice at no cost.
How much money could I receive from a class action lawsuit? +
Data breach class action recoveries vary significantly. Settlements typically range from a few hundred dollars for basic out-of-pocket losses to several thousand dollars for documented identity theft, with class size, damages, and negotiation all affecting the final amount. No payout is guaranteed, and this investigation has not yet resulted in a settlement.
What personal information was exposed in the breach? +
The notice says the affected ITM systems contain personnel records. It says the information potentially involved may include names, addresses, dates of birth, Social Security numbers, driver's license numbers or other government identification information, salary and compensation information, and other employment-related information, and that not all categories were necessarily involved for every individual. The Massachusetts filing lists names, addresses, dates of birth, Social Security numbers, driver's license numbers, other government identification information, financial account information, salary and compensation information and other employment-related information.
Did Lumara Bio USA offer free credit monitoring? +
Yes. Lumara Bio USA is offering a complimentary 24-month membership in Experian IdentityWorks, which the notice says provides credit monitoring and identity theft protection services, including identity theft recovery services. The notice text in the Massachusetts filing gives an enrollment deadline of January 29, 2027; check your letter for the deadline and your activation code. The notice also says Identity Restoration is available for 24 months from the date of the letter without any action on your part. Enrollment does not waive your right to pursue a claim.
How many people were affected by the Lumara Bio USA breach? +
Lumara Bio USA has not disclosed a total number of affected individuals in the sources reviewed. The Massachusetts filing reports 2 Massachusetts residents affected, which is a count for that state only. This page will be updated as more information becomes available.
Is there a deadline to take legal action? +
Yes. Statutes of limitations for data breach claims vary by state and legal theory, typically ranging from one to six years. Waiting can permanently bar your claim. Contact us as soon as possible for a free evaluation.
How do I get a copy of the official breach notice? +
The notice letter Lumara Bio USA filed in Massachusetts is posted on the Massachusetts government website (linked in Sources below). If you received a letter but no longer have it, Dapeer Law can assist you in obtaining a copy during your free consultation.
Sources & references
- Official breach notice filing · Massachusetts Office of Consumer Affairs and Business Regulation, Lumara Bio USA, Inc. notice letter
- Credit bureau freezes · Equifax · Experian · TransUnion
- Free weekly credit reports · AnnualCreditReport.com
- Identity theft recovery guide · FTC IdentityTheft.gov
Don't let the deadline decide for you. Submit your claim today.
You only have a limited window to act. Our team will review your notice, explain your options, and tell you whether you may be eligible to recover compensation, at no cost to you.
