FMC Services Settles $2.15M Data Breach Lawsuit After 2022 Cyberattack
FMC Services LLC, which operates primary care clinics in Amarillo and Canyon, Texas, has agreed to a $2.15 million settlement to resolve a class action lawsuit stemming from a 2022 cyberattack. The breach, detected on July 26, 2022, exposed sensitive data including names, addresses, dates of birth, Social Security numbers, and health information affecting 233,948 individuals, though notification letters were sent to 266,540 people.
Four affected individuals filed lawsuits, later consolidated into Sharber, et al. v. FMC Services, LLC in the District Court of Potter County, Texas. The plaintiffs alleged negligence, breach of fiduciary duty, and other claims, arguing that FMC Services failed to implement adequate cybersecurity measures. While FMC Services denied wrongdoing, settlement negotiations began in mid-2024 after mediation and litigation, including the plaintiffs’ successful opposition to the defendant’s summary judgment motion.
The settlement, preliminarily approved by the court, establishes a $2.15 million fund to cover reimbursements, attorneys’ fees, and administrative costs. Affected individuals may claim up to $5,000 for documented losses or opt for an estimated $75 cash payment. All class members are also eligible for two years of medical data monitoring. Deadlines for objections, exclusions, and claims are set for August 2026, with a final fairness hearing scheduled for September 15, 2026.
Source: https://www.hipaajournal.com/fmc-services-data-breach-settlement/
FMC Health cybersecurity rating report: https://www.rankiteo.com/company/family-medicine-centers-network
"id": "FAM1781691815",
"linkid": "family-medicine-centers-network",
"type": "Breach",
"date": "7/2022",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '266,540 (notification letters '
'sent), 233,948 (confirmed '
'affected)',
'industry': 'Healthcare',
'location': 'Amarillo and Canyon, Texas, USA',
'name': 'FMC Services LLC',
'type': 'Healthcare Provider'}],
'customer_advisories': 'Notification letters sent to affected individuals; '
'settlement details include reimbursements and medical '
'data monitoring',
'data_breach': {'number_of_records_exposed': '233,948',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Names',
'Addresses',
'Dates of birth',
'Social Security numbers',
'Health information']},
'date_detected': '2022-07-26',
'description': 'FMC Services LLC, which operates primary care clinics in '
'Amarillo and Canyon, Texas, has agreed to a $2.15 million '
'settlement to resolve a class action lawsuit stemming from a '
'2022 cyberattack. The breach exposed sensitive data including '
'names, addresses, dates of birth, Social Security numbers, '
'and health information affecting 233,948 individuals, though '
'notification letters were sent to 266,540 people.',
'impact': {'data_compromised': 'Sensitive data including names, addresses, '
'dates of birth, Social Security numbers, and '
'health information',
'financial_loss': '$2.15 million settlement',
'identity_theft_risk': 'High',
'legal_liabilities': 'Class action lawsuit'},
'investigation_status': 'Settled',
'post_incident_analysis': {'root_causes': 'Alleged failure to implement '
'adequate cybersecurity measures'},
'references': [{'source': 'Class action lawsuit settlement announcement'}],
'regulatory_compliance': {'legal_actions': 'Class action lawsuit (*Sharber, '
'et al. v. FMC Services, LLC*)'},
'response': {'communication_strategy': 'Notification letters sent to affected '
'individuals',
'enhanced_monitoring': 'Two years of medical data monitoring for '
'affected individuals'},
'title': 'FMC Services Settles $2.15M Data Breach Lawsuit After 2022 '
'Cyberattack',
'type': 'Data Breach'}