$4.4 Million Settlement Agreed to Resolve WellNow Urgent Care Data Breach Litigation
WellNow Urgent Care (formerly Five Star Urgent Care), a network of walk-in urgent care clinics in New York, Illinois, Michigan, and Ohio, has agreed to settle a class action data breach lawsuit for $4.4 million. The lawsuit was filed in response to a cyberattack and data breach detected on or around April 25, 2023, when ransomware was used to encrypt files. The ransomware group obtained names, dates of birth, Social Security numbers, state ID/driver’s license information, health and insurance information, banking information, and biometric data.
The data breach also affected WellNow Urgent Care’s parent company, ADMI Corp., which does business as TAG – The Aspen Group, and Aspen Dental, Aspen Dental Management, Physicians Immediate Care, and Physicians Immediate Care Chicago. In total, the protected health information of approximately 597,000 individuals was compromised in the attack. The affected individuals started to be notified about the data breach in February 2024.
In March 2024, lawsuits were filed in response to the data breach in the United States District Court for the Northern District of Illinois and the Circuit Court of Cook County, Illinois, by plaintiffs Genevieve Tambroni, John Lattimore, as parent for minor children S.L. and V.L., Ella Williams, James Beach, Caitlin McDaniel, Claudine King, Ian Curro, and Wesley Lumpkins. The lawsuits asserted claims of negligence, breach of implied contract, breach of the implied covenant of good faith and fair dealing, and unjust enrichment. The lawsuits were consolidated in the Circuit Court for Sangamon County, Illinois – Tambroni, et al. v WellNow Urgent Care, P.C., et al.
The defendants denied and continue to deny all claims and contentions in the lawsuits and all charges of wrongdoing or liability. The defendants sought to have the lawsuits dismissed; however, the attempt was unsuccessful. All parties opted to settle the litigation as they concluded that continuing with the litigation would likely be protracted and expensive with an uncertain outcome.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
There are two subclasses in the settlement class. The majority of class members – 541,870 – did not have their Social Security numbers compromised and are in the non-SSN subclass. The remaining 55,131 class members had their Social Security numbers compromised and are in the SSN subclass. The benefits for the non-SSN subclass have been capped at $3.3 million, and the benefits for the SSN class have been capped at $1.1 million. 90% of attorneys’ fees, costs, and service awards will come out of the non-SSN settlement fund, and the remaining 10% will come out of the SSN settlement fund. Attorneys’ fees and costs are $1,452,000, and each plaintiff will receive a service award of $2,000 ($16,000 in total).
Non-SSN subclass members can submit claims for up to 2 hours of lost time at $25 per hour and documented out-of-pocket losses incurred as a result of the data breach. Claims may also be submitted for extraordinary out-of-pocket expenses, up to a maximum of $7,500 per claimant. SSN subclass members may submit a claim for up to 3 hours of lost time at $25 per hour, and extraordinary out-of-pocket expenses up to a maximum of $7,500 per claimant. Alternatively, rather than submitting a claim for lost time and reimbursement of extraordinary out-of-pocket losses, SSN subclass members can choose to receive a pro rata cash payment. The cash payments will be paid after all costs have been deducted and claims have been paid.
The settlement has received preliminary approval from the court, and the final fairness hearing has been scheduled for August 15, 2025. Payments will be made within 75 days of the final approval of the settlement. Individuals wishing to object to or opt out of the settlement must do so by July 11, 2025, and claims must be submitted by the same date. Class members who do nothing will not receive any benefits. Further information can be found on the settlement website – https://wellnowdatasecuritysettlement.com/
