Summit Medical Group Reaches $500,000 Settlement Over 2024 Data Breach
Summit Medical Group has agreed to a $500,000 settlement following a class action lawsuit alleging inadequate protection of patient data during a September 2024 cyberattack. The breach potentially exposed sensitive information, including names, contact details, medical record numbers, treatment and prescription details, health insurance data, and Social Security numbers.
Eligibility and Compensation
Individuals in the U.S. who received a breach notification from Summit Medical Group may qualify for reimbursement. Claimants can seek up to $2,500 for documented out-of-pocket losses such as credit monitoring fees, ID replacement costs, or postage or up to $45 for time spent responding to the incident (calculated at $15 per hour for up to three hours). Additionally, affected individuals are eligible for two years of CyEx Medical Shield Complete monitoring, which includes $1 million in medical identity theft insurance.
If total claims exceed the $500,000 settlement fund, payouts will be reduced proportionally. Payments will be distributed via PayPal, Venmo, Zelle, eMasterCard, or physical check after final court approval.
Settlement Details and Deadlines
The $500,000 fund covers administrative costs, up to $575,000 in attorneys' fees, and $12,500 in service awards for class representatives, with the remainder allocated to eligible claimants. Key deadlines include:
- Opt-out deadline: October 20, 2026
- Claim submission deadline: November 4, 2026
- Final approval hearing: November 19, 2026
Summit Medical Group denies wrongdoing but settled to avoid prolonged litigation. The breach stemmed from a targeted cyberattack on its systems in September 2024.
Source: https://www.claimdepot.com/settlements/summit-medical-data-settlement
Summit Medical Group cybersecurity rating report: https://www.rankiteo.com/company/summit-medical-group
"id": "SUM1787683936",
"linkid": "summit-medical-group",
"type": "Breach",
"date": "9/2024",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Individuals in the U.S. who '
'received a breach notification',
'industry': 'Healthcare',
'location': 'United States',
'name': 'Summit Medical Group',
'type': 'Healthcare Provider'}],
'customer_advisories': 'Eligibility for reimbursement and monitoring services '
'communicated to affected individuals',
'data_breach': {'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Names',
'Contact details',
'Medical record numbers',
'Treatment and prescription '
'details',
'Health insurance data',
'Social Security numbers']},
'date_detected': '2024-09-01',
'description': 'Summit Medical Group has agreed to a $500,000 settlement '
'following a class action lawsuit alleging inadequate '
'protection of patient data during a September 2024 '
'cyberattack. The breach potentially exposed sensitive '
'information, including names, contact details, medical record '
'numbers, treatment and prescription details, health insurance '
'data, and Social Security numbers.',
'impact': {'data_compromised': 'Names, contact details, medical record '
'numbers, treatment and prescription details, '
'health insurance data, Social Security '
'numbers',
'financial_loss': '$500,000 (settlement)',
'identity_theft_risk': 'High (Social Security numbers exposed)',
'legal_liabilities': 'Class action lawsuit'},
'investigation_status': 'Settled',
'post_incident_analysis': {'root_causes': 'Inadequate protection of patient '
'data'},
'references': [{'source': 'Settlement Notice'}],
'regulatory_compliance': {'legal_actions': 'Class action lawsuit'},
'response': {'communication_strategy': 'Breach notifications sent to affected '
'individuals',
'enhanced_monitoring': 'Two years of CyEx Medical Shield '
'Complete monitoring for affected '
'individuals'},
'title': 'Summit Medical Group Data Breach Settlement',
'type': 'Data Breach'}