Asheville Arthritis $500K Data Breach Class Action Settlement

Individuals who received a notification from Asheville Arthritis and Osteoporosis Center P.A. about a data breach that was discovered in May 2024, may be eligible to submit a claim to receive up to $5,000 from a class action settlement. The settlement class includes 58,521 individuals.

Asheville Arthritis and Osteoporosis Center P.A. has agreed to pay $500,000 to settle a class action lawsuit for alleged failures to safeguard patient data, which led to a data breach that exposed sensitive personal and medical information. Compromised information included names, addresses, dates of birth, telephone numbers, Social Security numbers, medical chart notes, lab results, diagnoses and health insurance information.

Who can file a claim for a data breach payout?

Class members are individuals that received a notice from Asheville Arthritis and Osteoporosis Center P.A. stating their information was affected by the data breach.

How much is the settlement payment?

Class members can submit a claim to receive one of the following payments:

• Cash Payment A – Documented losses: Class members can claim up to $5,000 for out-of-pocket losses traceable to the data breach. Eligible expenses and losses include:
• Unreimbursed losses due to fraud or identity theft
• Professional fees for credit repair services, attorneys and accountants
• Costs for freezing or unfreezing credit
• Credit monitoring expenses incurred after the data incident through the claim deadline
• Miscellaneous costs such as notary, postage and mileage

• Cash Payment B – Pro rata alternative cash payment: Class members that do not submit a documented losses claim can submit to receive a pro rata cash payment, estimated at $100. The final payment amount will be determined by the total number of valid claims filed.

How to claim a class action rebate

To receive a settlement payment, class members must submit a claim form. Individuals can file a claim online or print and mail the PDF claim form to the settlement administrator.

Settlement administrator's mailing address: Asheville Arthritis Data Breach Settlement Administrator c/o Epiq, P.O. Box 6075, Portland, OR 97228-6075

Claim forms must be submitted online or postmarked by January 26, 2026.

Required proof and claim information

• Unique ID and PIN from official settlement notice required to submit a claim online or by mail.
• Documented losses claims require supporting documentation of losses and expenses that were more likely than not caused by the data breach. This may include receipts, bills, invoices and other proof showing fraudulent charges due to identity theft.

Payout options

Class members have the following payment options:

• PayPal
• Venmo
• Zelle
• Paper check mailed to the address provided

$500,000 data breach settlement fund

The $500,000 settlement fund will include:

• Settlement administration costs: To be determined
• Attorneys' fees: Up to $166,666.67
• Service awards to class representatives: Up to $2,500 each
• Payments to approved claimants: Remaining settlement funds

Important dates

• Deadline to file a claim: January 26, 2026
• Deadline to exclude yourself: January 26, 2026
• Final approval hearing: Feb. 9, 2026

When is the Asheville Arthritis data Breach settlement payout date?

Payments will issued to class members with valid claims approximately 90 days after the court grants final approval of the settlement.

Why did this class action settlement happen?

This class action lawsuit was filed after medical practice became aware of a data incident in May 2024 that compromised the personal and medical information of approximately 58,000 people. The plaintiffs alleged that the company failed to adequately protect this information.

Asheville Arthritis and Osteoporosis Center P.A. denies the allegations but agreed to settle to avoid the expense and risk of continued litigation and a possible trial.

Sources

1. Class notice
2. Settlement website FAQ page
3. Settlement agreement