Carolina Arthritis Associates $600K Data Breach Settlement

Individuals who received a notice stating the September 2024 cyberattack involving Carolina Arthritis Associates compromised their private information may be eligible to submit a claim for up to $5,000 and other benefits from a class action settlement. The data breach compromised personally identifiable information and protected health information belonging to an estimated 39,961 people.

Carolina Arthritis Associates PA agreed to pay $600,000 to settle a class action lawsuit alleging it failed to adequately protect patient data, resulting in a September 2024 cyberattack that compromised sensitive information. Data exposed in the breach included names, dates of birth, Social Security numbers, health insurance information, treatment information, medical records and medical history.

Who can file a claim for a data breach payout?

Class members are individuals whose private information the September 2024 data breach allowed unauthorized individuals to access and/or acquire.

How much is the class action settlement payment?

Class members have the following options:

• Cash payment A – Documented losses: Class members can claim up to $5,000 for actual, documented out-of-pocket losses that occurred between Sept. 27, 2024, and Feb. 23, 2026, due to the data breach. Eligible expenses include monetary losses from identity theft or fraud, fees for credit reports or credit monitoring, costs to replace identification documents and postage for contacting banks.
• Cash payment B – Alternate cash: Class members who do not submit a documented losses claim can submit a claim to receive an estimated $100 pro rata cash payment. The settlement administrator will determine the final payment amount by the total number of valid claims filed.
• Medical monitoring services: All class members can elect to enroll in two years of medical monitoring services through CyEx Medical Shield Complete. This includes $1 million in medical identity theft insurance, health insurance ID and medical record number exposure monitoring, unauthorized HSA spending monitoring and access to fraud resolution agents in the event of suspicious activity.

How to claim a data breach class action rebate

To receive a settlement payment class members can file a claim online or print the PDF claim form to complete and mail or email to the settlement administrator.

Settlement administrator's mailing address: CAA Data Incident Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958

Settlement administrator's email address: info@CAADataSettlement.com

Required proof and claim information

• Online claims require the notice ID and PIN from the settlement notice.
• Documented losses claims require supporting documentation, which may include receipts, invoices, bank or credit card statements and other proof of identity theft or fraudulent charges caused by the data breach.

Payout options

• PayPal
• Venmo
• Zelle
• Virtual prepaid card
• Paper check mailed to address provided

$600,000 settlement fund breakdown

The settlement fund of $600,000 will include:

• Settlement administration costs: To be determined
• Attorneys' fees: Up to $200,000
• Attorneys' expenses: To be presented to the court for approval at a later date
• Service awards to class representatives: $2,500 each for four representatives ($10,000 total)
• Medical monitoring services: Total determined by number of claims filed
• Payments to approved claimants: Remaining settlement funds

Important dates

• Opt-out deadline: Feb. 6, 2026
• Deadline to file a claim: Feb. 23, 2026
• Final approval hearing: Mar. 10, 2026

When is the Carolina Arthritis Associates settlement payout date?

The settlement administrator will issue payments and medical monitoring enrollment codes to class members with eligible claims approximately 75 days after the court grants final approval of the settlement.

Why is there a class action settlement?

This class action lawsuit alleged a cyberattack in September 2024 compromised Carolina Arthritis Associates’ computer systems, allowing unauthorized parties to access files containing sensitive personal and medical information. The plaintiffs claimed that Carolina Arthritis Associates failed to adequately protect this information.

The practice denies any wrongdoing but agreed to settle to avoid the expense and uncertainties of ongoing litigation.

Sources

1. Official class action settlement notice
2. Settlement website FAQ page
3. Official settlement claim form