Essen Medical Associates decided to settle a class action litigation for $4,000,000. A cyberattack occurred in March 2023 that impacted 904,672 current and former patients.
Incident Overview
Essen Medical Associates, a New York-based healthcare provider, experienced unauthorized access to its network between March 14, 2023, and March 22, 2023. The incident resulted in exposure of personally identifiable information (PII) and protected health information (PHI), which is an issue associated with HIPAA compliance.
The breached data included names, driver’s license numbers and state ID numbers, U.S. alien registration numbers, non-U.S. ID numbers, passport numbers, financial account details, dates of birth, Social Security numbers, medical treatment information, and medical insurance information.
Litigation Details
Following the incident, Essen Medical Associates faced multiple class action lawsuits, which were later consolidated under Rivera, et al. v. Essen Medical Associates, P.C filed in the Supreme Court of the State of New York, County of Bronx. The consolidated complaint alleged that the cyberattack could have been avoided and claimed that the organization did not maintain adequate cybersecurity procedures and protocols. The plaintiffs also asserted that sensitive information was stored on systems susceptible to cyberattacks.
The lawsuit claims included negligence, unjust enrichment, breach of fiduciary duty, breach of implied contract, and violation of the New York Deceptive Trade Practices Act. The defendant denies all allegations and maintains that it is not liable for the claims asserted. The parties agreed to resolve the matter through a settlement.
Settlement Terms
The agreement establishes a $4,000,000 settlement fund. This fund will be used to pay attorneys’ fees and expenses, provide service awards to class representatives, and cover settlement-related administrative costs.
Attorneys’ fees are limited to no more than 33.33 percent of the total fund. Service awards for each class representative are capped at $3,000. Remaining funds will be distributed to eligible class members. Individuals may submit claims for documented, unreimbursed losses related to the data breach, with reimbursement available up to $5,000 per person. Class members may also request a cash payment of up to $100.
Court Status and Deadlines
The court has granted preliminary approval of the settlement, and final approval is pending. Class members have until May 4, 2026, to submit objections or request exclusion from the settlement. Claims must be filed by June 1, 2026. The final fairness hearing is scheduled for July 7, 2026. Class counsel and the six class representatives have stated that they consider the settlement to be fair.
