DAP Health Settles Data Breach Lawsuit for $1,300,000
DAP Health, a nonprofit community healthcare network based in Southern California, has agreed to settle a class action lawsuit that was filed in response to a cyberattack on its computer systems that exposed sensitive patient data.
Suspicious activity was identified within certain computer systems on or around July 22, 2024. An investigation was launched, which confirmed that an unauthorized third party gained access to an email server and exfiltrated emails and files containing personally identifiable information and protected health information. Data stolen in the incident included names, contact information, dates of birth, Social Security numbers, driver’s license numbers, passport numbers, birth certificate numbers, vehicle license plate and VIN numbers, financial account numbers, Medicare/Medicaid numbers, health insurance information, and a range of medical information.
Notification letters started to be sent to the affected individuals in December 2024, and the breach was reported to the HHS’ Office for Civil Rights as involving the protected health information of 129,048 individuals. The first class action lawsuit in response to the data breach was filed in January 2025, and a second lawsuit was filed in early February 2025. The plaintiffs agreed to work together, and an amended complaint – Donald Crosslin and Matthew Paone v. DAP Health, Inc. was filed in the Superior Court for the State of California for the County of Riverside in June 2025.
The lawsuit alleged that the data breach could have been prevented and was a result of a failure to implement reasonable and appropriate cybersecurity measures. The lawsuit asserted claims for negligence, breach of implied contract, unjust enrichment, and violations of the California Confidentiality of Medical Information Act, California’s Unfair Competition Law, and the California Consumer Privacy Act. DAP Health denies all material allegations, including claims of wrongdoing, fault, and liability.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Following extensive arm’s-length negotiations, all parties agreed to settle the litigation, with no admission of wrongdoing or liability by the defendant. Under the terms of the settlement, DAP Health has agreed to establish a $1.3 million settlement fund to cover attorneys’ fees and expenses, settlement administration costs, and service awards for the two class representatives. The remainder of the fund will be used to pay for class member benefits.
Class members may submit a claim for reimbursement of documented losses due to the data breach up to a maximum of $5,000 per class member. Regardless of whether a reimbursement claim is submitted, class members may claim a pro rata cash payment. The cash payments are estimated to be $25 per class member. Class members who were California residents on July 22, 2024, can also claim a statutory cash payment of $75. In addition, all class members can submit a claim for two years of complimentary credit monitoring and identity theft protection services.
The deadline for exclusion and objection is September 1, 2026. The deadline for submitting a claim is October 21, 2026. The settlement has received preliminary approval from the court, and the final fairness hearing has been scheduled for October 1, 2026.
