Hillcrest Convalescent Center Settles Class Action Over 2024 Data Breach
Hillcrest Convalescent Center, a Durham, North Carolina-based rehabilitation and skilled nursing facility, has reached a settlement in a class action lawsuit stemming from a June 2024 cyberattack. The breach exposed sensitive personal and health data of over 106,000 individuals, including names, Social Security numbers, medical records, and financial information.
Affected individuals were notified by mail in March 2025, prompting multiple lawsuits that were later consolidated in Durham County Superior Court. While Hillcrest denied wrongdoing, mediation in January 2026 led to a preliminary settlement agreement.
Under the terms, class members can claim up to $2,500 for documented out-of-pocket losses or receive an estimated $50 cash payment. All eligible individuals may also enroll in two years of credit monitoring with $1 million in identity theft insurance. Claims must be submitted by August 26, 2026, with a final approval hearing scheduled for August 24, 2026. Those who opt out by July 27, 2026, retain the right to sue independently, while objections to the settlement must also be filed by the same deadline.
Source: https://www.hipaajournal.com/hillcrest-convalescent-center-data-breach-settlement/
Hillcrest Rehabilitation & Healthcare Center cybersecurity rating report: https://www.rankiteo.com/company/hillcrest-rehabilitation-healthcare-center
"id": "HIL1782311028",
"linkid": "hillcrest-rehabilitation-healthcare-center",
"type": "Breach",
"date": "6/2024",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '106000',
'industry': 'Healthcare',
'location': 'Durham, North Carolina, USA',
'name': 'Hillcrest Convalescent Center',
'type': 'Healthcare Facility'}],
'customer_advisories': 'Affected individuals were notified by mail in March '
'2025',
'data_breach': {'number_of_records_exposed': '106000',
'personally_identifiable_information': ['Names',
'Social Security '
'numbers'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personal data',
'Health data',
'Financial information']},
'date_detected': '2024-06-01',
'date_publicly_disclosed': '2025-03-01',
'description': 'Hillcrest Convalescent Center, a Durham, North Carolina-based '
'rehabilitation and skilled nursing facility, has reached a '
'settlement in a class action lawsuit stemming from a June '
'2024 cyberattack. The breach exposed sensitive personal and '
'health data of over 106,000 individuals, including names, '
'Social Security numbers, medical records, and financial '
'information.',
'impact': {'data_compromised': 'Sensitive personal and health data, including '
'names, Social Security numbers, medical '
'records, and financial information',
'identity_theft_risk': 'High',
'legal_liabilities': 'Class action lawsuit settlement',
'payment_information_risk': 'High'},
'investigation_status': 'Settled',
'references': [{'source': 'Class action settlement announcement'}],
'regulatory_compliance': {'legal_actions': 'Class action lawsuit'},
'response': {'communication_strategy': 'Notified affected individuals by mail '
'in March 2025'},
'title': 'Hillcrest Convalescent Center Data Breach Settlement',
'type': 'Data Breach'}