CPAP Medical Supplies and Services Agrees to Pay Up to $500K to Resolve Data Breach Lawsuit
CPAP Medical Supplies and Services, a Jacksonville, Florida-based provider of durable medical equipment for treating sleep apnea, has agreed to pay up to $500,000 in benefits to individuals affected by a December 2024 cyberattack and data breach.
The cybersecurity incident was identified in late December 2024, and the forensic investigation determined that an unauthorized third party accessed its network between December 13, 2024, and December 21, 2024, and potentially obtained the personal and protected health information of current and former patients and employees. The HHS’ Office for Civil Rights was notified that the electronic protected health information of 90,133 individuals was compromised in the incident. The affected individuals were notified around August 15, 2025.
Four class action complaints were filed in response to the data breach in the District Court for the Middle District of Florida. Since the lawsuits asserted similar claims and had overlapping classes, they were consolidated into the first complaint filed. The defendant denies wrongdoing, fault, and liability, disagrees with all claims and contentions in the lawsuit, and sought to have the lawsuit dismissed. The motion to dismiss was granted in part and denied in part, and the lawsuit was allowed to proceed. The plaintiffs maintain that the defendant was at fault for failing to implement sufficient cybersecurity measures and should have prevented the cyberattack and data breach.
All parties engaged in negotiations, and on September 4, 2026, the terms of a settlement were agreed upon by all parties. The federal complaint was dropped, and the consolidated lawsuit – Brett Conner v. CPAP Medical Supplies and Services, Inc. – was refiled and is pending in the Circuit Court for Broward County, Florida. The defendant has agreed to pay attorneys’ fees and expenses, settlement administration costs, service awards for the class representatives, and up to $500,000 in benefits for the class members.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The benefits are two years of medical data monitoring services, and claims may also be submitted for up to $5,000 as reimbursement for documented, unreimbursed losses due to the data breach. If that total is exceeded, claims will be paid pro rata. There is no alternative cash payment. The deadline for opting out and objecting to the settlement is October 30, 2026. Claims must be submitted by November 26, 2026, and the final fairness hearing was scheduled for December 1, 2026.
