The $11 Million Asheville Settlement Went to One Family — Not to the Public. The Asheville Eye Data-Breach Deal for Up to 327,756 Patients Is the One With Benefits, and Its Claim Deadline Was April 6, 2026.

If you saw the headline that Asheville settled a lawsuit for $11 million and wondered whether you are owed something: you are not. The Asheville Citizen Times reported on September 11, 2026 that “The city and its insurance companies paid $11,000,000, and two contractors together paid $1,000,000, to Karol Ivy Roth,” the widow of a 62-year-old Asheville man killed when another driver’s vehicle “skidded on ice along Riverside Drive on Jan. 20, 2020.” She filed a wrongful-death lawsuit in 2021 against the city and the two general contractors on the River Arts District project. The money goes to her and to the estate — according to the paper, “$4.4 million individually and $6.6 million as the administrator of her husband’s estate.”

That is a private settlement between named parties. There is no class, no settlement administrator, no notice to the public and no claim form. Any email, text or website that invites you to “check your eligibility” for the Asheville $11 million settlement is not connected to this case.

The lawsuit alleged that the city “failed for years to repair a drainage problem in a road” — standing water on Riverside Drive that, according to the complaint, turned to ice in cold weather and had drawn complaints from motorists. The city did not concede that: “The city did not admit responsibility as part of the settlement agreement with Roth.” The family’s attorney told the paper on September 10 that after the crash he urged the city to fix the problem and that “a new storm water inlet was installed within about three weeks.”

Taxpayers’ direct share is the smallest part: “The city paid $500,000 to settle the lawsuit, with the city’s insurance companies, Safety National Casualty Corp. and Allied World National Assurance Co. paying the rest.” The case is not entirely over. The city sued the project contractors, alleging the drainage issue was caused by their work, and they in turn sued a subcontractor; the city attorney declined to discuss the negligence allegations because “the city’s litigation with the contractors is still ongoing.” We did not find a public court file for the Roth case; the figures here rest on the Citizen Times report.

Most people searching for an “Asheville settlement” who got a letter in the mail are looking for this one. Asheville Eye Associates PLLC, an eye-care practice in Western North Carolina, settled the consolidated class action over a data incident “in or about November 2024.” The plaintiffs allege the exposed information included “names, addresses, health insurance information, Social Security Numbers, and medical treatment information”; Asheville Eye “denies all claims and contentions in the lawsuit and maintains there was no wrongdoing,” HIPAA Journal reported. Notification letters began going out on February 4, 2025. The breach was reported to federal health regulators as affecting 204,984 individuals, while the settlement papers describe a class of “as many as 327,756 Settlement Class Members.”

The case is In re Asheville Eye Associates Data Incident Litigation, Civil Action No. 25CV000809-100, Business No. 2025CVS809, Buncombe County Superior Court, heard in the North Carolina Business Court. The suits were consolidated on May 9, 2025, mediated on July 31, 2025, and a Business Court judge granted preliminary approval on November 5, 2025, Law360 reported. Class counsel is Gary M. Klinger of Milberg Coleman Bryson Phillips Grossman PLLC; the administrator is Kroll Settlement Administration.

There is no cash fund. Asheville Eye pays the benefits directly, plus up to $500,000 in attorneys’ fees and expenses, $53,000 in administration costs and service awards of $1,250 to each of the five named plaintiffs ($6,250 in total). Class members get three things:

• A $10 voucher toward eyeglasses at any Asheville Eye location except 21 Medical Park Drive in Asheville. It is automatic, comes with the notice, needs no claim and is “valid for one year from the date of issuance.”
• One year of identity protection (Kroll’s one-bureau monitoring). The enrollment code also comes with the notice, but can only be activated after a court order granting final approval; “The enrollment period will end 90 days from the Effective Date.”
• Up to $1,250 for documented, unreimbursed out-of-pocket losses caused by the incident — bank, overdraft and card-reissue fees, late fees, credit reports or monitoring you bought — only for people who filed a claim with receipts or statements.

The deadline to file a claim, opt out or object was April 6, 2026. It has passed, so a new claim for the $1,250 reimbursement can no longer be filed, and anyone who did not opt out is bound by the settlement. The final fairness hearing was set for May 14, 2026 at 10:00 a.m. Eastern. As of October 7, 2026, we could not confirm whether the Business Court has entered a final approval order: the official site, aeadatasettlement.com, did not let us read it, and no final order appeared in the public sources we checked. Under the settlement, payments and benefits go out only “after the court resolves any appeals and grants final approval of the settlement.”

What that means in practice:

• Keep the notice. Your class member ID, the voucher and the identity-protection enrollment code are on it. Once final approval is granted, the code has to be activated before the 90-day enrollment window after the Effective Date closes — check the official site for that date.
• If you filed a reimbursement claim, payment comes the way you chose: online claimants could pick electronic transfer or check; “Class members who file by mail will receive their payment by check.”
• Questions go to Asheville Eye Associates Data Incident Litigation, c/o Kroll Settlement Administration LLC, PO Box 225391, New York, NY 10150-5391; the phone number listed for the case is 833-621-5559.

A letter or email from Kroll about Asheville Eye Associates is plausible and real if it matches the case: it names In re Asheville Eye Associates Data Incident Litigation, gives a class member ID, a $10 voucher and an identity-protection code, and points to aeadatasettlement.com or the PO Box 225391 address in New York. Kroll will not ask for your Social Security number to “release” a payment, and the settlement has no fee to pay. Go to the official site by typing the address yourself rather than clicking a link.

Anything that ties you to the $11 million Riverside Drive settlement, by contrast, is a red flag — that money was paid to one family under a private agreement. The same goes for messages that promise a fixed cash amount from Asheville Eye: there is no flat cash payment in that settlement, only the voucher, the monitoring and reimbursement of documented losses up to $1,250.

If your letter came from Asheville Arthritis and Osteoporosis Center P.A., it is a different settlement. According to ClaimDepot’s summary, the practice agreed to pay $500,000 over a data incident discovered in May 2024; the class includes 58,521 people; claims were due January 26, 2026, with a final approval hearing on February 9, 2026. The administrator is Epiq (P.O. Box 6075, Portland, OR 97228-6075), and payments are to go out “approximately 90 days after the court grants final approval.” The official site, arthritisdatabreach.com, did not let us read it, so we could not confirm the current payment status.

Put together: three different “Asheville settlements,” only two of which ever had a claim form, and both of those deadlines have passed. For a 2020 crash on a city road, the $11 million result came after more than five years in court and only for the family that sued.