GRIPA $2.15M MOVEit Data Breach Data Class Action Settlement

People who received notice from the Greater Rochester Independent Practice Association that the MOVEit data breach may have compromised their personally identifiable or protected health information could may be eligible to claim up to $12,500 from a class action settlement.

GRIPA agreed to pay $2.15 million to resolve a class action lawsuit alleging it failed to adequately protect sensitive information, resulting in a data breach in May 2023. The breach involved the MOVEit file transfer software and impacted patients, health care providers and physicians. It potentially exposed names, dates of birth, Social Security numbers, health and treatment information, health insurance details, pharmacy prescription data and prescriber information.

Who can file a claim?

Class members include GRIPA patients, individual health care providers or physicians in the United States whose personally identifiable information and/or protected health care information the MOVEit data breach impacted.

GRIPA notified those affected by the breach.

How much can class members receive?

• Ordinary losses: Up to $2,500, including out-of-pocket expenses and up to four hours of lost time at $25 per hour
• Extraordinary losses: Up to $10,000 for documented, unreimbursed monetary loss directly related to the breach, including professional fees, such as those for attorneys or credit repair
• Alternative cash payment: In lieu of ordinary and extraordinary losses, a payment estimated at $100 but up to $1,000 (depending on the number of claims and the net settlement fund after deductions for settlement administration costs, attorneys' fees and costs and service awards to class representatives)
• Identity theft protection: Two years of services, including medical and credit monitoring, dark web monitoring and $1 million in medical identity theft insurance

How to claim a class action payment

Class members can file a claim online or download and print the PDF claim form, complete it and mail it to the settlement administrator.

Settlement administrator's mailing address: GRIPA Data Settlement, c/o RG/2 Claims Administration LLC, P.O. Box 59479, Philadelphia, PA 19102-9479

The claim deadline is Sept. 3, 2026.

What proof or documentation is required to submit a claim?

• To claim reimbursement for ordinary or extraordinary losses, class members must provide documentation showing the amount of the loss and how it is reasonably attributable to the MOVEit data breach. Acceptable documentation includes:
• Receipts, bank or credit card statements, invoices or other records for out-of-pocket expenses
• Proof of purchase for credit monitoring or identity theft insurance
• Invoices or statements for professional fees (attorneys, accountants, credit repair, etc.)

• To claim the alternative cash payment or credit monitoring, class members must attest to their eligibility as a class member and select the appropriate option on the claim form.
• To file an online claim, class members must provide the claimant ID and PIN from the settlement notice they received.

Payout options

• PayPal (provide PayPal email address)
• Venmo (provide mobile number associated with the Venmo account)
• Zelle (provide mobile number or email address associated with the Zelle account)
• Physical check (provide mailing address address)

$2.15 million settlement fund breakdown

The $2,150,000 settlement fund covers:

• Settlement administration costs: To be determined
• Attorneys' fees: Up to $716,666.67
• Attorneys' expenses: To be determined
• Service award to class representative: Up to $2,500
• Credit monitoring costs: Dependent on number of valid claims for this option
• Payments to eligible class members: Remainder of the fund

The fund is non-reversionary, meaning any unclaimed money will not return to GRIPA. If any money remains in the fund 180 days after the settlement becomes effective, the administrator will extend the duration of identity theft protection services for class members who claimed them.

Important dates

• Deadline to opt out: Aug. 4, 2026
• Deadline to file a claim: Sept. 3, 2026
• Fairness hearing: Sept. 3, 2026

When is the MOVEit GRIPA settlement payout date?

The settlement administrator will issue payments after the court resolves any appeals and grants final approval of the settlement.

Why is there a class action settlement?

This class action lawsuit claimed cybercriminals exploited a vulnerability in the MOVEit file transfer software GRIPA used, resulting in unauthorized access to sensitive personal and health information. The plaintiffs alleged GRIPA was negligent in its data security practices, leading to the breach.

GRIPA denies any wrongdoing but agreed to settle to avoid the costs and risks of further litigation.

Sources

1. Class notice
2. Claim form
3. Settlement agreement