American Vision Partners Says 1.6 Million People Were Hit by Its 2023 Breach. Only About 258,070 of Them — Those Whose Social Security Numbers Were Exposed — Can Claim Cash From the $1.75 Million Settlement: Up to $3,000 With Receipts or a Pro Rata Share Without, Not Both. That Is $6.78 per Eligible Person Before Fees, by Our Arithmetic. Claims Close November 12, 2026.
Hulewat et al. v. Medical Management Resource Group LLC d/b/a American Vision Partners, et al., Case No. 2:24-cv-00377-DJH, United States District Court for the District of Arizona, Judge Diane J. Humetewa. The Arizona eye-care management company discovered the cyberattack on or about November 14, 2023; the court-authorized notice puts the people affected at about 1,600,000. The $1,750,000 fund is non-reversionary, but only the Damages Settlement Class — about 258,070 U.S. residents whose Social Security numbers and other personal information were compromised — can file for money: either documented out-of-pocket losses up to $3,000, or a pro rata cash payment. Everyone whose information the company holds — the 258,070 included — is also in an Injunctive Relief Class that receives security commitments the notice values at about $2,787,630, paid separately; for the roughly 1.34 million people outside the Damages Class, that is the only benefit. Claims are due online or postmarked by November 12, 2026; opt-outs and objections by October 13, 2026; the final fairness hearing is December 10, 2026 at 10:00 a.m. MT in Phoenix. The official site is AmericanVisionSettlement.com, run by Kroll Settlement Administration; the line is (833) 630-5366.
By Settlement Insight Data Desk ·

1.6 million affected, one fund, two classes — and only one of them gets money
If your letter from American Vision Partners mentioned your Social Security number, you can file for money. If it did not, this settlement most likely gives you no cash. That is the part of the deal the headlines leave out. The court-authorized Long Form Notice says the cyberattack, which the company discovered on or about November 14, 2023, reached “the information of approximately 1,600,000 individuals” — names, dates of birth, Social Security numbers, contact details, and medical treatment and health insurance information. The settlement defines two classes, and they overlap.
The Damages Settlement Class is defined as “Approximately 258,070 U.S. residents whose Social Security Numbers and other personal information were compromised in the Data Incident.” Only this group may submit a claim for money from the $1,750,000 fund. The Injunctive Relief Class is “All individuals whose personal information is collected or maintained by Defendant” — a wider group that also contains the Damages Class; six plaintiffs are listed in both. What that class receives is a list of security commitments: a Chief Information Officer role, a cybersecurity steering committee, penetration testing by an outside vendor, third-party managed monitoring and firewall, better email security and disaster recovery, and regular risk assessments. The notice values those measures at “approximately $2,787,630” and says the defendants pay for them “separate and apart from the Damages Class Settlement Fund.”
By subtraction, about 1.34 million of the 1.6 million people affected are not in the Damages Class: for them the security measures are the whole settlement, and there is no claim form to file. The defendants are Medical Management Resource Group, L.L.C. (doing business as American Vision Partners), Barnet Dulaney Perkins Eye Center, PC, and Southwestern Eye Center, Ltd. They deny any wrongdoing, and no court has decided who was right. If you are not sure which group you are in, the notice points you to the administrator: (833) 630-5366, or in writing to Settlement Administrator – 83312, c/o Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY 10150-5391.
What you can claim: $3,000 with documents, or a pro rata share without — one, not both
Members of the Damages Settlement Class choose one of two payments. The notice says it twice, with an “OR” between them.
- Out-of-pocket expense claim, up to $3,000. Reimbursement of “documented out-of-pocket losses reasonably and fairly traceable to the Data Incident.” The notice lists unreimbursed fraud or identity-theft losses; professional fees, including attorneys’, accountants’ and credit-repair fees; costs of freezing or unfreezing credit; credit monitoring bought on or after November 2023 because of the incident; and smaller items such as notary, postage, copying, mileage, and per-minute phone charges. You need receipts or other documents you did not prepare yourself — “‘Self-prepared’ documents such as handwritten receipts are, by themselves, insufficient” — and an attestation that the loss came from this incident and not something else.
- Pro rata cash payment. No documents. The notice describes it only as a payment the administrator makes pro rata, “which may increase or decrease the pro rata cash payment, subject to the Settlement Fund cap.” It publishes no estimate of the amount.
That structure matters if you have a small documented cost. Unlike some recent breach deals that let you stack a no-proof payment on top of reimbursed losses, this one does not: a $40 credit-freeze fee claimed as an out-of-pocket loss replaces the pro rata payment rather than adding to it. There is no credit-monitoring benefit in the list of Damages Class Benefits.
To be paid electronically, the notice says in capitals, you must file online: “TO RECEIVE AN ELECTRONIC OR ACH PAYMENT FOR YOUR VALID CLAIM, YOU MUST FILE A CLAIM FORM ONLINE.” Paper claim forms go to the Kroll P.O. box above, postmarked by November 12, 2026.
The arithmetic: $6.78 per eligible person before fees, and why the pro rata check depends on how many file
These are our calculations from the numbers in the notice; neither the court nor the administrator has published a payment estimate. The notice says fees, costs and service awards are paid “from the Settlement Fund”; that the pro rata payments share what remains after them and after the documented-loss claims is our reading of a single $1.75 million fund, not a sentence in the notice.
- $1,750,000 ÷ 258,070 = $6.78 per member of the Damages Settlement Class, if every one of them filed and nothing came out first.
- Attorneys’ fees. Class counsel will ask for “33.33% of the value of the settlement” plus costs. The notice does not say whether that “value” includes the $2,787,630 put on the security measures. If the percentage is taken on the $1.75 million fund, it comes to about $583,300.
- Service awards. Up to $2,500 each for the plaintiffs; the notice names 15, which would be up to $37,500.
- That leaves about $1.13 million before administration costs, which the notice does not quantify, and before the documented-loss claims.
Almost nobody files in breach settlements, and that is what sets the pro rata amount. If 5% of the 258,070 eligible people chose the pro rata option — about 12,900 claims — $1.13 million would come to roughly $88 each; at 10%, roughly $44; at 2%, roughly $219. Administration costs and every approved out-of-pocket claim would push those figures down. Treat them as the shape of the outcome, not a promise: the actual number will be known only after the claim deadline and final approval.
Four dates, how to reach the right administrator, and when money could arrive
- October 13, 2026 — last day to opt out (a signed letter mailed to the Kroll P.O. box) or to object (postmarked by that day; it may also be filed with the court). Opting out is the only way to keep your own right to sue these defendants over the incident.
- November 12, 2026 — claim deadline, online at AmericanVisionSettlement.com or by mail postmarked that day.
- December 10, 2026, 10:00 a.m. MT — final fairness hearing before Judge Humetewa, Sandra Day O’Connor U.S. Courthouse, Courtroom 605, 401 W. Washington St., Phoenix. The court will also rule on fees and service awards. The notice warns the hearing can move without further notice.
- After that — “Damages Class Benefits will be distributed after the settlement has obtained Court approval and the time for all appeals has expired.” The notice gives no date.
The notice names the only authorized website as AmericanVisionSettlement.com and the phone line as (833) 630-5366. It asks class members not to contact the court or class counsel for information. Class counsel are Gary M. Klinger (Milberg PLLC), Raina C. Borrelli (Strauss Borrelli PLLC), Terence Coates (Markovits, Stock & DeMarco, LLC) and J. Austin Moore (Stueve Siegel Hanson LLP).
Do not confuse this case with the separate Total Vision data breach settlement, another eye-care network with its own $475,000 fund and an October 5, 2026 claim deadline. Kroll runs many settlements at once; its letters and envelopes are explained on our Kroll settlement administration page.
The Data Behind This Story
- Case
- Hulewat et al. v. Medical Management Resource Group LLC d/b/a American Vision Partners, et al., Case No. 2:24-cv-00377-DJH
- Court
- U.S. District Court for the District of Arizona, Judge Diane J. Humetewa
- Defendants
- Medical Management Resource Group, L.L.C. (d/b/a American Vision Partners); Barnet Dulaney Perkins Eye Center, PC; Southwestern Eye Center, Ltd. — deny wrongdoing
- Incident
- Cyberattack discovered on or about November 14, 2023; about 1,600,000 people affected (per the notice)
- Data involved
- Names, dates of birth, Social Security numbers, contact information, medical treatment and health insurance information
- Who can claim cash
- Damages Settlement Class only: about 258,070 U.S. residents whose Social Security numbers and other personal information were compromised
- Injunctive Relief Class
- Everyone whose information the company holds, including the Damages Class — security measures valued at about $2,787,630, paid separately; the only benefit for the ~1.34 million outside the Damages Class
- Fund
- $1,750,000, non-reversionary — $6.78 per Damages Class member by our arithmetic
- Payment options (choose one)
- Documented out-of-pocket losses up to $3,000 OR a pro rata cash payment (no estimate published)
- Claim deadline
- November 12, 2026 — online (required for electronic/ACH payment) or postmarked by mail
- Opt-out / objection deadline
- October 13, 2026 (postmarked)
- Final fairness hearing
- December 10, 2026, 10:00 a.m. MT, Courtroom 605, 401 W. Washington St., Phoenix
- Fees and awards (requested)
- 33.33% “of the value of the settlement” plus costs; service awards up to $2,500 per plaintiff
- Administrator
- Kroll Settlement Administration LLC — AmericanVisionSettlement.com · (833) 630-5366 · Settlement Administrator – 83312, P.O. Box 225391, New York, NY 10150-5391
- Source: Long Form Notice of Proposed Class Action Settlement, Hulewat v. Medical Management Resource Group, Case No. 2:24-cv-00377-DJH (D. Ariz.), 11 pages, read September 26, 2026 (copy published by ClassAction.org): class definitions and the 258,070 figure, benefit options and the “OR”, documentation rules, $2,787,630 security measures, deadlines October 13 / November 12 / December 10, hearing location, fee and service-award requests, class counsel, Kroll addresses and phone
- Source: AmericanVisionSettlement.com — named in the notice as the only authorized settlement website (blocked our automated fetch with HTTP 403 on September 26, 2026; not read directly)
- Source: ClassAction.org, “$1.75M American Vision Partners Settlement Ends Data Breach Lawsuit Over 2023 Incident” — cross-check of deadlines and benefits
- Source: HIPAA Journal, “American Vision Partners Settles Data Breach Litigation for $1.75M” — cross-check of defendants and the Damages Subclass size
- Source: Settlement Insight arithmetic: $1,750,000 ÷ 258,070; 33.33% of $1,750,000; 15 × $2,500; claim-rate scenarios at 2%, 5% and 10% — estimates, not figures from the court or the administrator
Journalists: these figures are free to cite with attribution to Settlement Insight. Custom data pulls: press@settlementinsight.com.