Harvard Pilgrim Data Breach Settlement: $16 Million, Claims Closed
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
The Harvard Pilgrim settlement is the $16 million deal that resolved the class action over the April 2023 ransomware attack on Harvard Pilgrim Health Care and its parent, Point32Health. It covered 2,967,396 people who were sent breach notices. The claim deadline was August 25, 2025, and the administrator’s approximate disbursement date was December 3, 2025. As of October 2026 there is no open claim form and no new deadline.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What the Harvard Pilgrim Class Action Lawsuit Said Happened
Harvard Pilgrim is a New England health insurer. According to the forensic findings reported by HIPAA Journal, an outside group had access to its systems between March 28, 2023 and April 17, 2023, copied data and then deployed ransomware.
The official settlement website says the files may have contained names, addresses, phone numbers, dates of birth, health insurance account information, Social Security numbers, taxpayer identification numbers and clinical information such as diagnoses, treatment and provider names.
The Harvard Pilgrim class action lawsuit alleged negligence, breach of implied contract, breach of fiduciary duty and unjust enrichment, and that the company took too long to detect the attack and tell members. Harvard Pilgrim denied all wrongdoing and settled to avoid the cost and risk of litigation.
Case Details
The case is In re Harvard Pilgrim Data Security Incident Litigation, No. 1:23-cv-11211, in the U.S. District Court for the District of Massachusetts. The first suit was filed on May 30, 2023. An Amended Consolidated Class Action Complaint followed on April 26, 2024, folding in related state and federal cases. Defendants moved to dismiss on June 10, 2024; the court stayed the case on September 4, 2024 for mediation, and the parties reached an agreement in principle at a full-day mediation on October 28, 2024. The settlement administrator is Simpluris; the official site is harvardpilgrimdataincidentsettlement.com.
Status: Settled, Claim Deadline Passed, Payments Issued
The official site now states that the net fund was divided pro rata and distributed to class members. As of October 2026 there is no second claims round, no new Harvard Pilgrim data breach settlement and no deadline anyone can still meet.
Who Was in the Settlement Class
All U.S. residents whose personal information was affected by the Harvard Pilgrim data breach, including everyone who received a notice letter. Harvard Pilgrim began sending notices on May 24, 2023, and the settlement agreement puts the total at 2,967,396 individuals.
If you were in the class, your choices are behind you. If you filed a valid claim by August 25, 2025, your payment was issued in the distribution. If you did nothing, you receive no cash but are still bound by the release: you cannot bring your own lawsuit over the same claims. Only people who opted out by June 27, 2025 kept that right.
What the Harvard Pilgrim Settlement Paid
Claim options were: documented out-of-pocket losses up to $2,500 (including up to 7 hours of time at $30 an hour); extraordinary losses from identity theft or fraud up to $35,000; or an alternative cash payment originally estimated at $150. Every class member could also claim three years of credit monitoring.
The official site says the cash award was recalculated pro rata after fees and costs, so the final figure differed from the $150 estimate. The actual per-person amount has not been published.
How cases like this one end
Our copy of the federal courts’ own case database covers 123,245 other contract casesclosed in U.S. federal district courts between 2015 and 2025, 5.8% of them filed as class actions:
- 30.9% ended in a settlement recorded by the court. Another 20.2% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 30.9% and 51.1%.
- 7.6% were decided on a motion before any trial.
- 1 in 71 reached a trial (1.4%), after a median of 29.3 months.
- Median time from filing to the end of the case: 7.6 months.
- Only 7,369 of them (6%) record a money award at all; the median of those is $402,000.
These are base rates for this type of case (federal other contract cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
Harvard Pilgrim Data Breach Timeline
- 1
March 28 – April 17, 2023 — The Attack
Per the forensic findings, an outside group is inside Harvard Pilgrim’s systems, copies data and deploys ransomware.
- 2
May 2023 — Notices and First Lawsuit
Notice letters start going out on May 24, 2023. The first federal class action is filed in Massachusetts on May 30, 2023.
- 3
April 26, 2024 — Cases Consolidated
Plaintiffs file an Amended Consolidated Class Action Complaint. Harvard Pilgrim moves to dismiss on June 10, 2024.
- 4
October 28, 2024 — Deal at Mediation
After the court stays the case, a full-day mediation produces an agreement in principle. The $16 million agreement is filed in February 2025.
- 5
April 4, 2025 — Preliminary Approval
Notices mail May 27, 2025. Opt-out and objection deadline June 27, 2025; claim deadline August 25, 2025.
- 6
August – December 2025 — Approval and Payments
Final approval hearing July 28, 2025; ClaimDepot reports approval on August 4, 2025 and payments from December 3, 2025.
Three Things to Watch For
A closed settlement with nearly three million class members, and payouts sent by PayPal, Venmo, Zelle and prepaid card, leaves room for imposters:
“Late claims still accepted” sites
The claim deadline was August 25, 2025, and the official site is harvardpilgrimdataincidentsettlement.com. A different site asking for your Social Security number or member ID to “file a late Harvard Pilgrim claim” is collecting data, not filing anything.
“Release your unclaimed payment” messages
Texts or emails saying your Venmo, PayPal or Zelle payout is “on hold” until you pay a fee or confirm bank details are a classic follow-up scam. Check by calling the number on the official site, 1-833-296-0892, not one in the message.
Ads for a “new Harvard Pilgrim lawsuit”
If you stayed in the class, the release bars a new suit over the same breach. Ads promising a fresh payout for the 2023 attack should be read with that in mind before you sign anything.
Harvard Pilgrim Settlement — Questions People Actually Ask
Can I still file a Harvard Pilgrim data breach settlement claim?
No. The deadline was August 25, 2025, for online claims and for mailed claims by postmark. As of October 2026 no new claim period has been announced.
How much did the Harvard Pilgrim settlement pay per person?
It depended on the claim. Documented losses up to $2,500, extraordinary losses up to $35,000, or an alternative cash payment first estimated at $150. The official site says the cash award was recalculated pro rata after fees and costs; the final per-person figure has not been published.
When were payments sent?
The official site lists an approximate disbursement date of December 3, 2025, and ClaimDepot reports payments began that day. The official site now says the pro rata award was distributed to class members.
I filed a claim but never got paid. What do I do?
Contact the administrator, Simpluris, at 1-833-296-0892 or info@HarvardPilgrimDataIncidentSettlement.com, or write to P.O. Box 25245, Santa Ana, CA 92799. Have the Unique ID from your postcard notice ready. A claim can be denied for missing documentation, so ask whether yours was approved.
How many people were affected by the Harvard Pilgrim data breach?
The settlement agreement says Harvard Pilgrim notified 2,967,396 individuals. An early federal disclosure in 2023 put the count at 2.5 million; notices kept going out until at least June 2024 as more people were identified.
Is the credit monitoring still available?
Class members who claimed it were offered three years of credit monitoring from Cyex, with identity-theft insurance and monitoring at Equifax, Experian and TransUnion. It had to be claimed by the claim deadline.
Did Harvard Pilgrim admit fault?
No. Harvard Pilgrim and Point32Health denied all wrongdoing and liability. The court never decided who was right; the parties settled to avoid the cost and risk of trial.
I did nothing. Can I sue on my own now?
Generally no. Unless you opted out by June 27, 2025, the release means you cannot bring or join another lawsuit over the claims this settlement resolved. For a specific situation, ask a licensed attorney.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Settlement Check Problems
Lost, expired or missing class action payments and what to do
Data Breach Settlement Calculator
Estimate what a data breach claim is typically worth
Open Class Action Settlements
Settlements still accepting claims right now
Change Healthcare Data Breach
The largest health-data breach case and where it stands