CPAP Medical Supplies and Services Data Breach Settlement

Current and former customers who received a notice from CPAP Medical Supplies and Services that their private information may have been compromised in the December 2024 data breach could be eligible to submit a claim for up to $5,000 from a class action settlement. The cybersecurity incident impacted almost 90,000 individuals.

CPAP Medical Supplies and Services Inc. agreed to settle a class action lawsuit alleging a targeted cyberattack exposed sensitive customer information. The plaintiff claimed the company failed to adequately protect private data, including names, addresses, Social Security numbers, health insurance details, medical histories and financial information.

Who can file a claim for a data breach payout?

Class members are individuals residing in the United States whom CPAP Medical Supplies and Services sent a notice stating the December 2024 data breach may have impacted their private information.

How much are settlement payments?

Class members have the following benefit options:

• Cash payment for out-of-pocket losses: Class members can claim up to $5,000 for documented out-of-pocket losses that occurred between Dec. 13, 2024, and Nov. 26, 2026 and are traceable to the data breach. This includes monetary losses due to identity theft or fraud; fees for credit reports, credit monitoring or freezing/unfreezing credit; costs to replace IDs; and postage to contact financial institutions. Expenses or losses that a third party already reimbursed are not eligible.
• Medical data monitoring: All class members can elect to receive two years of CyEx Medical Shield Complete. Services include $1 million in medical identity theft insurance and monitoring for health care insurance ID and medical record number exposure and unauthorized health savings account spending along with access to a fraud resolution agent if needed.

How to claim a class action rebate

To receive a settlement payment, class members can file a claim online or print and complete the PDF claim form and mail it to the settlement administrator.

Settlement administrator's mailing address: CPAP Data Incident Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958

The claim deadline is Nov. 26, 2026.

Required proof and claim information

• To submit a claim online, class members must provide the login ID and PIN from the settlement notice they received.
• To submit an out-of-pocket losses claim, class members must provide supporting documentation, which may include receipts, bank or credit card statements and other proof of identity theft or fraud.

Payout options

• Zelle
• PayPal
• Venmo
• Virtual prepaid card
• Paper check mailed to the address provided

Settlement fund breakdown

The settlement fund will include:

• Settlement administration costs and medical data monitoring: Up to $60,000
• Attorneys' fees and costs: $400,000
• Service awards to class representatives: $1,000 each
• Payments to claimants: Up to $500,000

Important dates

• Opt-out deadline: Oct. 30, 2026
• Deadline to file a claim: Nov. 26, 2026
• Final approval hearing: Dec. 1, 2026

When is the CPAP Medical Supplies and Services data breach settlement payout date?

The settlement administrator will issue settlement payments and medical data monitoring codes to approved claimants no later than 75 days after the court grants final approval of the settlement.

Why did this class action settlement happen?

This class action lawsuit claimed a targeted cyberattack on CPAP Medical Supplies and Services Inc. in December 2024 allowed unauthorized parties to access files containing private information. The complaint alleges CPAP Medical Supplies and Services failed to adequately protect customer data.

The company denies the allegations but agreed to settle to avoid the expense and risk of further litigation.

Sources

1. Claim form
2. Settlement notice
3. Settlement agreement
4. Settlement website FAQ