Bradford Health Services, LLC, and Bradford Health Partners, LLC, have reached a proposed settlement to resolve consolidated litigation arising from a cybersecurity incident that affected current and former patients, subject to final court approval.
The cybersecurity incident was detected on December 8, 2023. A subsequent review determined that unauthorized access affected files containing personal information and protected health information (PHI). The information identified during the review included names, dates of birth, medical information such as diagnosis and treatment details, medical insurance information, financial account numbers, payment card numbers together with a means of accessing the account, driver’s license numbers, passport numbers, and Social Security numbers.
The published reports describe different figures for the number of affected individuals by this potential violation of HIPAA. The lawsuit states that 32,425 individuals were affected by the incident. The report submitted to the U.S. Department of Health and Human Services Office for Civil Rights identifies PHI for 28,543 individuals.
The file review continued until May 2025. Individual notification letters began to be mailed later that month. The reports state that notifications began approximately 18 months after the incident was identified.
Published reports also state that the Hunters International threat group was behind the cyberattack and asserted that more than 760 gigabytes of data had been exfiltrated from the defendants’ systems.
Bradford Health Services faced multiple class action lawsuits following the cybersecurity incident. Those cases were consolidated as In Re Bradford Health Services, LLC Data Breach Litigation in the Circuit Court of Jefferson County, Alabama, Birmingham Division. The plaintiffs allege that the defendants did not implement reasonable and appropriate cybersecurity measures and assert claims that include breach of express or implied contract, wantonness or negligence, negligence per se, and unjust enrichment.
The parties began discussions regarding an early resolution after the consolidated litigation was filed. Following mediation conducted in October 2025, the parties agreed on the material settlement terms. The proposed settlement has since been finalized and received preliminary court approval.
Under the proposed settlement, the defendants have agreed to fund attorneys’ fees, settlement management and notification costs, class representatives service awards, and benefits available to eligible class members. Eligible class members may enroll in medical data monitoring services for three years. They may also submit claims for reimbursement of documented losses of up to $5,000 per class member. An alternative cash payment is also available and is estimated to be approximately $150, although the amount may vary depending on the number of approved claims.
The settlement establishes several upcoming deadlines. Requests for exclusion and objections must be submitted by August 3, 2026. Claims must be submitted by August 17, 2026. A final fairness hearing is scheduled for September 1, 2026.
