Gandara Mental Health Center in Springfield, Massachusetts, has agreed to settle class action litigation stemming from a June 2024 cyberattack and data breach that affected 17,543 individuals. The cyberattack was detected on June 20, 2024, and Gandara Mental Health Center determined that personal and protected health information, such as names, addresses, dates of birth, driver’s license numbers, Social Security numbers, diagnoses, treatment information, and health insurance information, had been compromised. The hackers claimed to have exfiltrated approximately 450 GB of data.

A class action lawsuit was filed in the Court in the Commonwealth of Massachusetts, Hampden County – Eugene Mitchell v. Gandara Mental Health Center, Inc. – in response to the data breach that alleged that the defendant failed to properly secure its network, leading to the theft of the plaintiffs’ personal and protected health information. The lawsuit asserted claims for negligence, negligence per se, breach of implied contract, unjust enrichment, and breach of fiduciary duty. Gandara Mental Health Center denies all claims and contentions in the lawsuit, including claims of wrongdoing, fault, and liability.

All parties agreed upon a settlement to avoid further legal costs and expenses and the uncertainty of a trial and any related appeals. Under the terms of the settlement, class members are entitled to enroll in three years of identity theft protection and medical data monitoring services. A claim may also be submitted for reimbursement of up to $500 in ordinary losses, including up to four hours of lost time at $25 per hour, and up to $5,000 in extraordinary losses incurred as a result of the data breach. If a claim is not submitted for reimbursement of losses and lost time, an alternative one-time cash payment of $60 can be claimed. Benefits for the class members have been capped at $900,000 and will be reduced pro rata if that total is exceeded.

The deadline for objection to and exclusion from the settlement is July 24, 2026. Claims must also be submitted before that date. The final approval hearing has been scheduled for August 25, 2026.

The post Gandara Mental Health Center Settles Class Action Data Breach Lawsuit appeared first on The HIPAA Journal.