ApolloMD Data Breach Settlement: Claims Closed September 30, 2026 — Hearing October 5
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
You may never have heard of ApolloMD — but if you were treated in an emergency room whose physicians it supports, ApolloMD may have held your records when ransomware hit in May 2025. The $4.02 million settlement stopped taking claims on September 30, 2026; the final approval hearing is October 5, 2026.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened
ApolloMD is an Atlanta-based company that supports emergency medicine, hospital medicine, anesthesia and radiology physician groups — which is why its systems held data on patients who never dealt with it directly. A ransomware actor accessed ApolloMD's network between May 22 and May 23, 2025 and acquired files containing patient information: names, dates of birth, addresses, diagnosis and treatment information, provider names, dates of service, health insurance information and Social Security numbers. In February 2026 ApolloMD confirmed more than 626,000 people were affected. The consolidated class action alleged the attack succeeded because ApolloMD failed to implement reasonable cybersecurity measures.
Case Details
The cases were consolidated as In re ApolloMD Data Breach Litigation, No. 1:25-cv-05439-SEG in federal court in Georgia. After mediation in January 2026, the parties agreed on a $4,020,000 settlement fund, which has received preliminary approval. The final approval hearing is October 5, 2026. Notification went out in two waves — starting September 2025, with a second wave in March 2026 — so class members received letters as much as ten months after the attack.
Status as of 24 August 2026
Who Is Covered — Including Patients Who Never Heard of ApolloMD
The class covers the 626,000+ current and former patients whose information was in the files taken in the May 2025 attack. The confusing part is the vendor relationship: your ER visit was with a hospital, but the physician group staffing that ER may have been an ApolloMD client — so your records sat on ApolloMD systems. If you received a letter from ApolloMD in September 2025 or March 2026 and did not recognize the name, that letter was real, and it contained the class member ID that was required to file a claim.
What the Settlement Pays
How This Unfolded
- 1
May 22–23, 2025 — the ransomware attack
An unauthorized third party accesses ApolloMD's IT environment and acquires files containing patient information from its client physician groups.
- 2
September 2025 — first notification wave
The first batch of notification letters goes out to affected patients; class actions follow and are consolidated in January 2026.
- 3
January–February 2026 — mediation and scope
Mediation produces agreement on settlement terms; ApolloMD confirms more than 626,000 people were affected. A second notification wave follows in March.
- 4
August 31 and September 30, 2026 — both deadlines passed
Exclusions and objections were due August 31; claim forms — with the class member ID from the notice — were due September 30.
- 5
October 5, 2026 — final approval hearing
The court decides whether to grant final approval of the $4.02 million settlement. Payments follow approval and any appeals.
Three Things to Watch
A settlement that requires an ID from a mailed notice creates its own scam surface. These are the patterns.
“We can file without your class member ID — for a fee”
Only the administrator can help you recover a lost class member ID, and that help is free through ApolloMDDataSettlement.com. Anyone charging to “locate your claim” is not part of this settlement.
Calls quoting your own breach data back to you
The stolen files included SSNs, diagnoses and insurance details — exactly what a caller needs to sound legitimate. The administrator does not cold-call for personal information; hang up and use the official site.
“Claim your $5,000 ApolloMD payment now”
The $5,000 is a documented-loss cap, not a standard payout. The no-documentation payment is approximately $75. Any ad promising everyone the cap is bait.
Common Questions
When are the deadlines?
Both have passed. Exclusion or objection: August 31, 2026. Claim filing: September 30, 2026. The final approval hearing is October 5, 2026.
I lost my notice. Can I still file?
Not anymore. The claim deadline was September 30, 2026, and the official site showed no extension on October 1, 2026. If you already filed and have lost your notice, the settlement administrator can still help you through ApolloMDDataSettlement.com.
Why did I get a letter from a company I have never visited?
ApolloMD supports physician groups in emergency medicine, hospital medicine, anesthesia and radiology. If you were treated by one of its client groups — say, in an ER — your records could sit on ApolloMD systems. The letter is genuine and contains the ID you need.
Should I take the $75 or claim documented losses?
That choice had to be made on the claim form by September 30, 2026. For people who filed: if you have receipts for breach-related costs — fraud losses, monitoring you purchased, bank fees — the documented route pays up to $5,000 and is worth the paperwork. Without documentation, the approximately $75 pro rata payment plus the free year of monitoring is the sensible claim.
What was in the stolen files?
Names, dates of birth, addresses, diagnosis and treatment information, provider names, dates of service, health insurance information and Social Security numbers. The SSN-plus-medical combination is the reason the monitoring benefit includes identity theft insurance.
When will payments arrive?
After the October 5, 2026 final approval hearing and any appeals — realistically 2027. From attack (May 2025) to likely payment, this case will have run about two years, which is fast by data breach standards.
How do I verify this?
Through ApolloMDDataSettlement.com and the federal docket for In re ApolloMD Data Breach Litigation, No. 1:25-cv-05439. Figures here reflect what we could confirm as of 24 August 2026; your notice and the official site control where anything differs.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.