Carolina Arthritis Associates Settles $600K Over 2024 Data Breach Impacting Nearly 40,000 Patients Carolina Arthritis Associates (CAA) has agreed to a $600,000 settlement following a September 2024 cyberattack that exposed the sensitive data of approximately 39,961 individuals. The breach compromised personally identifiable information (PII) and protected health information (PHI), including names, dates of birth, Social Security numbers, health insurance details, medical records, and treatment histories. The settlement resolves a class action lawsuit alleging CAA failed to implement adequate security measures to protect patient data. While the practice denies any wrongdoing, it opted to settle to avoid prolonged litigation. Eligibility and Compensation Affected individuals—those whose data was accessed or acquired in the breach—may file claims for financial compensation or medical monitoring services. Two payment options are available: - Documented losses (up to $5,000): Reimbursement for out-of-pocket expenses incurred between September 27, 2024, and February 23, 2026, such as identity theft-related costs, credit monitoring fees, or document replacement. - Alternate cash payment (~$100): A pro rata payment for claimants without documented losses, with the final amount determined by the number of valid claims. All class members may also enroll in two years of medical monitoring through CyEx Medical Shield Complete, which includes $1 million in medical identity theft insurance, fraud resolution support, and monitoring for unauthorized health insurance or HSA activity. Claim Process and Deadlines Eligible individuals can submit claims online or via mail using the notice ID and PIN provided in settlement notices. Required documentation for reimbursement claims includes receipts, bank statements, or proof of fraudulent activity. Payments will be distributed via PayPal, Venmo, Zelle, virtual prepaid cards, or paper checks. Key deadlines: - Opt-out deadline: February 6, 2026 - Claim filing deadline: February 23, 2026 - Final approval hearing: March 10, 2026 - Payout distribution: Approximately 75 days after final court approval. Settlement Fund Allocation The $600,000 fund will cover: - Settlement administration costs (TBD) - Attorneys’ fees (up to $200,000) - Class representative service awards ($10,000 total) - Medical monitoring services (based on claims filed) - Remaining funds for approved claimant payments. The breach underscores the growing risks of healthcare data exposure and the financial consequences for organizations failing to secure sensitive patient information.