A revised $32 million settlement has received first approval from the court to resolve class action data breach litigation against GoodRx and Criteo related to the use of website tracking tools on the GoodRx website that disclosed user information to third parties without consent. GoodRx is a Santa Monica, California-based telehealth company that operates a free-to-use platform that tracks prescription drug prices and offers coupons providing discounts on medications. Criteo is a Paris, France-based digital advertising company that offers AI-driven performance marketing and retargeting solutions.

Both companies agreed to settle a consolidated class action complaint alleging unfair business practices and improper sharing of consumer data with digital advertising and analytics companies between 2017 and 2020. The litigation also named other companies as defendants, which are not included in the settlement agreement. The litigation stems from a Federal Trade Commission (FTC) complaint alleging GoodRx unlawfully disclosed the personal and health information of its users in violation of the FTC Act and the FTC’s Health Breach Notification Rule. GoodRx disagreed with the FTC’s allegations; however, the FTC complaint was resolved with a $1.5 million settlement.

On February 2, 2023, the first putative class action lawsuit was filed, followed by other class action complaints against defendants GoodRx, Criteo, Meta and Google. The lawsuits were consolidated into a single complaint – Doe et al. v. GoodRx Holdings, Inc., et al. – which is pending in the United States District Court for the Northern District of California, Oakland Division.

The consolidated lawsuit asserted claims for negligence, negligence per se, intrusion upon seclusion, unjust enrichment, and violations of the California Confidentiality of Medical Information Act, California Invasion of Privacy Act, California Consumers Legal Remedies Act, California Unfair Competition Law, New York’s General Business Law, and Illinois Consumer Fraud and Deceptive Business Practices Act.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The plaintiffs believe their claims are valid, and the defendants deny the claims in the lawsuit and maintain no laws were violated. After two mediation conferences and subsequent discussions, a settlement was agreed upon that was acceptable to all parties to avoid the cost, distraction, and risks associated with a trial and related appeals. The proposed $25 million settlement was agreed by the plaintiffs and the defendants; however, the settlement was rejected by District Court Judge Araceli Martinez-Olguin, as the parties failed to meet the legal standards for demonstrating that the settlement was fair to consumers.

In response, GoodRx and Criteo agreed to increase the settlement fund by $7 million and formally added Criteo to the settlement agreement. The claims against the other defendants, Meta and Google, are continuing separately. The renegotiated settlement agreement has received preliminary approval from the court. Under the terms of the settlement, GoodRx and Criteo will establish a $32,000,000 settlement fund from which attorneys’ fees and expenses, notification and settlement administration costs, settlement fund account costs, and service awards for the class representatives will be deducted. The remainder of the settlement fund will be paid pro rata to individuals who submit a valid claim. The settlement agreement includes a clause that allows the defendants to cancel the settlement if the number of individuals excluding themselves exceeds an agreed-upon number.

Class members wishing to object to the settlement or opt out must do so by December 29, 2026. Claims must be submitted by the same date, and the final fairness hearing has been scheduled for February 11, 2027.

December 4, 2024: GoodRx Agrees to $25 Million Settlement to Resolve Tracking Technology Lawsuit

GoodRx, a telemedicine platform provider and drug discounter, has agreed to settle a consolidated class action lawsuit for $25 million. The lawsuit was filed in response to its use of website tracking technologies that disclosed website visitor data to third parties such as Meta Platforms, Google, and Criteo for advertising purposes without user consent.

The tracking technologies, also known as pixels, are code snippets that are added to websites to track user interactions. The information gathered on visitors can be used to improve websites and is also transferred to third parties for advertising purposes. The Federal Trade Commission (FTC) investigated GoodRx over the use of tracking tools and determined the FTC Act had been violated. GoodRx had provided repeated assurances to its users that their sensitive data would not be shared with third parties, when the tracking tools on its website shared identifying information, including sensitive health information, with third parties without users’ knowledge or consent. The FTC also alleged a violation of its Health Breach Notification Rule as GoodRx failed to notify users about the data sharing.

GoodRx disagreed with the FTC’s findings, claiming the issue had been addressed almost 3 years before the FTC started investigating and maintains there was no wrongdoing. GoodRx maintains tools were used for advertising purposes in a manner it believed was compliant with all regulations. GoodRx chose to settle the alleged violations with the FTC for $1.5 million rather than fight them in court. The settlement agreement also requires GoodRx to refrain from sharing users’ health information with third parties for advertising purposes and to obtain consent before sharing data for non-advertising purposes.

Shortly after the FTC settlement was announced, a class action lawsuit was filed in the U.S. District Court of the Northern District of California against GoodRx that made similar allegations to the FTC – that personal information was disclosed to third parties without users’ knowledge or consent, when they had been informed on the website – between October 2017 and March 2019- that their personal information would not be disclosed to third parties. Specifically, the plaintiffs claimed that the website stated, “We never provide advertisers or any other third parties with any information that reveals a personal health condition of personal health information.”

The lawsuit asserted claims of common law invasion of privacy, intrusion upon seclusion, unjust enrichment, violations of the California Confidentiality of Medical Information Act (CMIA), aiding and abetting violations of CMIA, violations of the California Invasion of Privacy Act, violations of the California Consumers Legal Remedies Act, and violations of the California Business and Professional Code. Several other lawsuits were filed over the privacy violations, which were consolidated into a single action, – Jane Doe et al. v. GoodRx Holdings, Inc., et al. The consolidated lawsuit also asserts claims of negligence, negligence per se, and violations of New York’s General Business Law and the Illinois Consumer Fraud and Deceptive Business Practices Act.

Meta, Google, and Criteo were also named in the lawsuit as co-defendants, and all three companies are attempting to have the claims against them dismissed. District Court Judge Araceli Martinez-Olguin is due to issue a ruling on the plaintiffs’ motion to approve the $25 million settlement. Should the judge approve the settlement, the plaintiffs will be permitted to continue to pursue claims against the other co-defendants, as they are not part of the proposed settlement.

If approved, individuals whose privacy was violated will be permitted to file claims for a share of the settlement fund, after attorneys’ fees, service awards, and legal costs and expenses have been deducted. The plaintiffs’ attorneys are seeking one-third of the settlement amount – $8.33 million.

Update: The $25 million settlement agreement was rejected by the judge, as both sides failed to adequately demonstrate that the settlement was fair to consumers. There was a lack of claim-by-claim analysis showing the economic value and legal strength of each claim, unjustified financial discounts, missing evidence of confirmatory discovery, and overly broad liability releases.

The post GoodRx & Criteo Revised $32 Million Data Privacy Settlement Gets First Approval appeared first on The HIPAA Journal.

A Ukrainian affiliate of the Nefilim & Hive ransomware operations who attacked hospitals, government entities, and businesses over a three-year period has received a 70-month jail term. Ukrainian national Artem Aleksandrovych Stryzhak, 35, was arrested in Spain in June 2024 and was extradited to the United States on April 30, 2025, to face charges of alleged involvement in the Nefilim and Hive ransomware operations. Co-conspirator, Ukrainian national Volodymyr Tymoshchuk, was also indicted but remains at large. An $11 million reward has been offered by the U.S. Department of State for information that leads to his arrest.

Stryzhak was alleged to have joined the Nefilim ransomware operation as an affiliate in June 2021, and agreed to pay the ransomware operator 20% of any ransom payments he generated in exchange for access to the Nefilim group’s infrastructure and encryptor. Between June 2021 and October 2021, Stryzhak used Nefilim ransomware in multiple attacks on entities in the United States.

Stryzhak was also alleged to have been a member of the Hive ransomware operation between June 2021 and January 2023, and along with his co-conspirators, conducted attacks on hospitals, government entities, and businesses. According to the prosecutors, along with his co-conspirators, Stryzhak deployed Hive ransomware against seven victims, including law firms, a dentist’s office, and a healthcare provider during the COVID-19 pandemic.

Stryzhak pleaded guilty to conspiracy to commit fraud and related activity such as extortion in connection with international ransomware operations and faced up to 10 years in jail. At sentencing in federal court in Brooklyn on October 27, 2026, Stryzhak received a 70-month prison term. “Artem Stryzhak chose to deploy ransomware that extorted money from victims, leaving businesses and individuals facing devastating losses.  His actions serve as a strong reminder of the real-world damage cybercriminals can cause and underscore the FBI’s commitment to stopping these schemes and protecting the public,” stated FBI Assistant Director in Charge Barnacle.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The post Hospital Ransomware Attacker Receives 70 Month Jail Term appeared first on The HIPAA Journal.

Massachusetts-based Brockton Neighborhood Health Center has agreed to pay up to $825,000 to settle class action litigation over a 2024 cyberattack and data breach that affected 97,488 individuals. The data breach that sparked the lawsuits was identified on November 3, 2024. The forensic investigation confirmed that an unauthorized third party accessed its network between November 1 and November 3, 2024. That third party was a ransomware group called Interlock, which obtained files containing patient information such as names, addresses, dates of birth, diagnoses/conditions, lab test results, medications, other treatment information, medical record numbers, and health insurance information.

Multiple class action lawsuits were filed in response to the data breach, alleging that the data breach could have been prevented and occurred as a result of cybersecurity failures. The lawsuits were consolidated into a single complaint – Howard, et al. v. Brockton Neighborhood Health Center, Inc. – which is pending in the Plymouth County Superior Court for the Commonwealth of Massachusetts.

The consolidated lawsuit asserts claims for negligence, breach of implied contract, unjust enrichment, and invasion of privacy. Brockton Neighborhood Health Center maintains there was no wrongdoing and disagrees with all claims and contentions in the lawsuit. After weighing up the risks and uncertainties of continued litigation, all parties agreed to a settlement.

Brockton Neighborhood Health Center has agreed to pay attorneys’ fees and expenses, settlement administration costs, and service awards for the class representatives. An $850,000 settlement fund has been established to cover those costs and pay benefits to the class members. All class members may claim three years of credit monitoring services. A claim may also be submitted for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $2,500 per class member. An alternative cash payment of up to $50 per class member may be claimed if a reimbursement claim is not filed.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The settlement has received preliminary approval from the court. The deadline for objection is November 9, 2026, and claims must be submitted by December 8, 2026. The final fairness hearing has been scheduled for January 12, 2027.

The post Brockton Neighborhood Health Center to Pay Up to $850,000 to Settle Breach Lawsuit appeared first on The HIPAA Journal.

Washington Gastroenterology has agreed to pay $4,600,000 to settle class action litigation stemming from a cybersecurity incident that was identified on January 28, 2025. Hackers gained access to its network on October 23, 2024, and potentially stole the personal and protected health information of 583,741 individuals, including names, Social Security numbers, financial and banking information, medical information, and health insurance information. The affected employees were notified about the incident on May 23, 2025, and patients were notified on August 22, 2025.

Several class action lawsuits were filed in response to the breach. The lawsuits were consolidated into a single complaint – In re Washington Gastroenterology, PLLC Data Breach Litigation – as they asserted similar claims and had overlapping classes. The consolidated lawsuit is pending in the Superior Court of Washington, County of Pierce.

The consolidated lawsuit alleged that the cybersecurity incident and data breach could have been prevented and occurred as a result of security failures. The lawsuit asserted claims for negligence, breach of implied contract, unjust enrichment, invasion of privacy, and violations of the Washington Consumer Protection Act, Washington Data Breach Notification Disclosure Law, and the Uniform Health Care Information Act. The defendant maintains there was no wrongdoing and disagrees with all claims and contentions in the lawsuit.

All parties attended mediation and agreed to accept the mediator’s proposal. The settlement agreement has been preliminarily approved by the court, and the final fairness hearing has been scheduled for January 29, 2027. Under the terms of the settlement, Washington Gastroenterology has agreed to establish a $4,600,000 settlement fund, from which attorneys’ fees and expenses, settlement administration and notice costs, and service awards for the class representatives will be deducted. The remaining funds will be used for benefits for the class members.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

All class members are entitled to claim two years of single-bureau medical record and credit monitoring services. In addition, a claim may be submitted for one of two cash payments. A claim may be submitted for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $4,000 per class member. Alternatively, class members may choose to receive a pro rata cash payment, estimated to be $75 per class member. The alternative cash payment may be higher or lower depending on the number of claims received. Individuals wishing to opt out of the settlement or file an objection have until December 11, 2026, to do so. The deadline for submitting a claim is January 10, 2027.

The post Washington Gastroenterology Pays $4.6 Million to Settle Data Breach Lawsuit appeared first on The HIPAA Journal.

American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data. The data breach sparked multiple lawsuits, which were consolidated – In re American Renal Management LLC Data Breach Litigation – in the U.S. District Court for the Middle District of Tennessee. A $900,000 settlement has recently been proposed to resolve the litigation.

The data breach that sparked the litigation was identified on February 29, 2024. The forensic investigation determined that its network had been accessed by an unauthorized third party between February 21, 2024, and March 1, 2024, and files containing patient information were copied. The files contained a wide range of personal and protected health information, including names, contact information, birth dates, Social Security numbers, driver’s license numbers, financial account information, health insurance information, billing and claims information, medical information, and more.

The affected individuals started to be notified on February 14, 2025, almost a year after the intrusion was first identified. The HHS was notified on April 29, 2024, using a placeholder figure of at least 501 affected individuals. That total has not been updated since it was initially reported. According to the lawsuit, the defendant notified 59,400 living individuals that they had been affected.

The consolidated complaint names five plaintiffs, who allege that the defendant was at fault for the cyberattack due to the failure to implement reasonable and appropriate cybersecurity measures. The lawsuit also claims that the defendant unreasonably delayed issuing notification letters, depriving the affected individuals of the opportunity to take steps to protect themselves against identity theft and fraud. The lawsuit asserted claims for negligence, negligence per se, breach of implied contract, invasion of privacy, unjust enrichment, and violations of the California Consumer Privacy Act and California Unfair Competition Law.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Innovative Renal Care denies all claims and contentions in the lawsuit, including wrongdoing and liability; however, mediation was successful, and a settlement was agreed. The $900,000 settlement fund will be used to pay attorneys’ fees and expenses, settlement administration costs, service awards for the class representatives, and the remainder will be used to pay benefits to the class members.

Class members may submit a claim for reimbursement of up to $5,000 for documented, unreimbursed losses due to the data breach and/or claim a pro rata cash payment, estimated to be $100 per class member but may be higher or lower depending on the number of claims submitted. The deadline for opting out of the settlement and filing an objection is November 20, 2026. Claims must be submitted by December 21, 2026, and the final fairness hearing has been scheduled for February 1, 2027.

The post Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation appeared first on The HIPAA Journal.

Jefferson County Health Department, a public health agency for Jefferson County in Hillsboro, Missouri, has agreed to settle class action litigation that was initiated in response to a 2022 data security incident.

The incident that sparked the litigation was identified on or around November 15, 2022. The forensic investigation determined that its network was accessed by an unauthorized third party between October 31 and November 15, 2022, who potentially viewed or obtained personal and protected health information such as names, dates of birth, Social Security numbers, driver’s license numbers, financial account information, medical information, and health insurance information. The data breach was reported to the HHS’ Office for Civil Rights on January 13, 2023, as involving the protected health information of 115,940 individuals.

The first class action lawsuit was filed on January 27, 2023, and was consolidated with a second complaint on October 2, 2023. The consolidated lawsuit – J.D., et al. v. Jefferson County Health Center d/b/a Jefferson County Health Department – is pending in the Circuit Court of the City of St. Louis, State of Missouri.

The consolidated lawsuit alleged that the plaintiffs would not have sought healthcare services from Jefferson County Health Center if they knew that their personal and health information would not be adequately protected. They claim that the failure to implement appropriate cybersecurity measures constituted negligence, breach of contract, breach of fiduciary duty, and violated the covenant of good faith and fair dealing. Jefferson County Health Department maintains that there was no wrongdoing and does not believe there is any liability or that there were any damages. A motion to dismiss the lawsuit was denied by the court, and a settlement was ultimately negotiated that was acceptable to all parties and avoids the cost and risks associated with a trial and related appeals.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Under the terms of the settlement, Jefferson County Health Department has agreed to establish a $2.25 million settlement fund, from which attorneys’ fees and expenses, settlement administration costs, and service awards for the three class representatives will be deducted. The remainder of the fund will be used to pay for benefits to the class members.

Class members may either submit a claim for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $300 per class member, including up to three hours of lost time at $20 per hour. Individuals who do not submit a claim for reimbursement of losses and lost time may claim a one-time cash payment of $150. The deadline for exclusion from the settlement, objection, and submitting a claim is November 16, 2026. The final fairness hearing has been scheduled for December 10, 2026.

The post Jefferson County Health Department Pays $2.25M to Settle Data Breach Lawsuit appeared first on The HIPAA Journal.

In July, a coalition of 42 state attorneys general agreed to an $18 million settlement with 23andMe to resolve claims that the company violated state laws by failing to implement appropriate data security measures to prevent credential-based attacks. California did not participate in the action, having opted to pursue its own legal claims against the company. A settlement has now been agreed between 23andMe and California to resolve the alleged violations of California laws.

The data breach, covered by the HIPAA Journal in this post, exposed the personal information and genetic information of approximately 6.9 million individuals, including 855,000 California residents. While the attack involved credential stuffing and took advantage of 23andMe customers’ poor password security practices, the states argued that the company should have been aware that there was a risk of customer accounts being targeted, and the company should therefore have implemented security measures for detecting and blocking attacks on customer accounts.

Following the security incident, 23andMe filed for bankruptcy protection and the company was bought for $305 million by TTAM Research Institute, a non-profit controlled by 23andMe co-founder Anne Wojcicki. California attempted to block the sale of the company, claiming it violated the California Genetic Information Privacy Act because 23andMe customers had not given their consent to the sale, which involved the transfer of their personal and genetic information to TTAM Research Institute. The state’s attempt to block the sale was unsuccessful, and a bankruptcy court judge ruled that California could not sue TTAM Research Institute over the data breach to recover money.

California planned to appeal the ruling; however, under the data breach settlement agreement, the state has agreed to drop further appeals. Under the terms of the settlement, California will be paid $6 million. While the sale of the company and transfer of customer data to TTAM Research Institute will go ahead, 23andMe customers have the right to request that their personal and genetic data be deleted.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

“I am proud to fight for the privacy rights of Californians and to deliver this settlement for consumers ​who put their trust in 23andMe,” said California Attorney General Rob Bonta. “I want to remind Californians that customers of 23andMe can delete their private, genetic data — no matter who owns it.” In addition to the $24 million in settlements, 23andMe agreed to settle class action data breach litigation and will pay $46.75 million to its customers. The settlement was approved by the court in July 2026.

The post California Settles 23andMe Data Breach Lawsuit for $6 Million appeared first on The HIPAA Journal.

An $80 million settlement has been proposed to resolve a consolidated class action lawsuit against Conduent Business Services, LLC, over its 2024 cybersecurity incident and data breach. Conduent, a leading provider of front-office and back-office solutions, notified the U.S. Securities and Exchange Commission (SEC) in April that it had experienced a cybersecurity incident. An unauthorized third party first breached its network on October 21, 2024, and maintained access until January 13, 2025. The SafePay ransomware group claimed to have exfiltrated 8.5 terabytes of data in the attack.

Conduent’s forensic investigation determined that the personal and protected health information of approximately 62.2 million individuals was stolen in the incident, including names, addresses, dates of birth, medical information, health insurance information, and Social Security numbers. It was the largest healthcare data breach reported in 2025 and ranks as the third-largest healthcare data breach of all time.

Conduent Business Services LLC, Conduent State & Local Solutions, Inc., and Conduent Incorporated faced multiple class action lawsuits in response to the data breach. The lawsuits were consolidated into a single complaint – In Re Conduent Business Services Data Breach Litigation – as they had overlapping claims and classes. The lawsuit is pending in the U.S. District Court for the District of New Jersey.

The consolidated lawsuit alleged that the defendants failed to implement reasonable and appropriate safeguards to protect individuals’ sensitive personal and protected health information. The lawsuit had 16 causes of action, including negligence and violations of the California Consumer Privacy Act, California Confidentiality of Medical Information Act, and California Customer Records Act. The defendants disagree with the claims and contentions in the lawsuit, including claims of wrongdoing and liability.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The $80 million settlement was proposed following mediation and covers the 62.2 million individuals affected by the breach, approximately 40 million of whom are in Subclass A and 22 million are in Subclass B. Individuals in Subclass A had data stolen in the attack, but it was stored in complex backup files that made their data difficult to access. Individuals in Subclass B had private information stolen in a readily accessible format.

All class members are entitled to claim one year of single-bureau credit monitoring services, valued at $179.40 per year. All class members may also submit a claim for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $3,500 per class member. Members of subclass B may also submit a claim for a pro rata cash payment, the value of which will depend on the remaining funds after attorneys’ fees and expenses, settlement administration costs, service awards for the class representatives, credit monitoring services, and claims have been paid. The attorneys are seeking 34% of the settlement fund, and the class representatives will be paid $1,500 each. Individuals who were California residents at the time of the breach will also be eligible for an additional payment, equal to the pro rata cash payment plus 20%. The settlement awaits approval from the court, after which the dates for objection, exclusion, and submitting a claim will be set.

The post $80 Million Settlement Proposed to Resolve Conduent Data Breach Litigation appeared first on The HIPAA Journal.

A settlement has been agreed to partly resolve litigation stemming from a cyberattack on American Collection Medical Agency (AMCA).  The settlement resolves the “Other Labs Track” of the litigation and has been agreed to by the plaintiffs and AMCA clients Sonic Healthcare U.S.A., Aurora Diagnostics LLC, Clinical Pathology Laboratories, Inc., and Austin Pathology Associates. The defendants have agreed to pay $6,438,578.20 to resolve all claims against them related to the AMCA data breach.

AMCA, a subsidiary of Retrieval-Masters Creditors Bureau, Inc., specializes in recovering small-balance medical debt for clinical laboratories and healthcare providers. The company identified a cyberattack on March 30, 2029, and the forensic investigation determined that an unauthorized third party had access to sensitive data between August 1, 2018, and March 30, 2019, following an attack on AMCA’s web payment portal. Data compromised in the incident included names, contact information, government-issued identifiers, medical billing information, financial account and payment information. More than 27 million individuals are believed to have been affected in total.

Many lawsuits were filed against AMCA and its clients in response to the data breach, asserting claims for negligence, breach of contract, and other claims. The lawsuits were consolidated in the U.S. District Court for the District of New Jersey, and after six years of hard-fought litigation, the defendants on this track – In Re: American Medical Collection Agency, Inc. Customer Data Security Breach Litigation (All Actions Against Other Labs Track) – have agreed to a settlement to avoid further litigation costs and the uncertainty of a trial and any associated appeals. The defendants continue to deny wrongdoing and liability and maintain that the plaintiffs and class members have not suffered any injury or damage as a result of the cyberattack or data breach.

The defendants have agreed to establish a $6,438,578.20 settlement fund to cover all costs and expenses related to the litigation, including attorneys’ fees and expenses, settlement administration and notice costs, service awards for the class representatives, and claims from the class members. Class members are entitled to claim two years of medical and health information monitoring through the CyEx Medical Shield Pro service. In addition, a claim may be submitted for compensation for documented, unreimbursed out-of-pocket losses due to the data breach up to a maximum of $5,000 per class member, which may include up to 10 hours of documented lost time at $25 per hour.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Class members who choose not to submit a claim for compensation of losses and/or lost time may choose to receive a one-time cash payment, the value of which will depend on the claims received, but has been estimated to be approximately $50. The important dates for class members are a deadline of December 3, 2026, for objecting to and opting out of the settlement, and January 4, 2027, for submitting a claim. The final fairness hearing has been scheduled for January 7, 2026.

The post $6.4 Million Settlement Agreed in AMCA Customer Data Breach Litigation appeared first on The HIPAA Journal.