Community Dental Care Told Regulators 134,903 People Were Hit. Its Settlement Pays $50 to Anyone Who Asks, Up to $5,000 With Receipts, Has No Fund to Run Out — and Claims Close October 19.

The court-authorised website is CDDataBreach.com, run by Simpluris. The company's own account of the breach is in its April 1, 2025 notice: “On December 20, 2024, CDC found unauthorized activity in its computer system. … The investigation revealed certain personal information was accessed or acquired without authorization by an unknown actor on or about December 6, 2024.” The file review finished on March 24, 2025, letters went out on March 28, and the data types listed were “names, addresses, dates of birth, Social Security numbers, driver's license or other government identification numbers, passport numbers, medical information, and health insurance information” — “not all data elements were affected for all individuals.” CD offered identity protection through IDX at the time, with an enrollment deadline of June 28, 2025.

Two numbers describe the size of the class, and they do not match. The federal breach report filed on March 28, 2025 with the U.S. Department of Health and Human Services listed 134,903 people, as GovInfoSecurity reported at the time. The settlement agreement's own recital, written more than a year later, says the intruder “potentially had access to the Personal Information belonging to up to approximately 130,583 individuals,” and adds a detail that appears in neither the company's press release nor the coverage we found: “Defendant has represented that only approximately 7,100 of the potentially impacted individuals' Social Security numbers” were involved. The class definition does not depend on either number — if CD's records say your information was accessed, or you received a breach letter, you are in.

The lawsuits were consolidated in Ramsey County under eight named class representatives, three of them suing for minor children — Tracy Knight, Aaron Brown (for a minor child), Tina Ihrke, Sheila Schutz, Danelle Whittaker, Kathy McKenzie, Keiryn Kuehn (for two minor children) and Ka Vang; the agreement counts nine class representatives for the service awards. CD moved to dismiss the consolidated complaint on September 5, 2025; the plaintiffs opposed on October 14; on January 26, 2026 the court granted the motion in part and denied it in part; the parties also briefed two motions to stay discovery before settling. Notices were mailed on August 14, 2026. CD “denies the allegations, and denies that it violated any laws or harmed any persons,” and the court has not decided who is right.

Cash Payment A — Documented Losses pays “up to $5,000.00” for “actual, unreimbursed, documentarily provable out-of-pocket losses arising from and actually caused by the Data Breach,” incurred between December 20, 2024 and October 19, 2026. The notice's examples are losses from identity theft or fraud, fees for credit reports, monitoring or freezes, the cost of replacing IDs, and postage. Lost time is out: the agreement says the “claimed loss must be monetary.” Proof means documents made at the time, by a third party or by you — “telephone records, correspondence including emails, or receipts” — and “self-prepared documents, including personal certifications, declarations, or affidavits … do not, by themselves, constitute reasonable documentation.”

Cash Payment B — Alternative Cash is “a one-time $50.00 cash payment. You do not have to provide any proof or explanation to claim this payment.” The rule between them is one-way. Claim A and you cannot also claim B — but a rejected A claim does not leave you with nothing. The agreement, at paragraph 64: if a class member “fails to cure his or her Claim, the Claim will be rejected and the Settlement Class Member's Claim will be as if he or she elected Cash Payment B.” In practice, a documented-loss claim carries a $50 safety net.

Medical and Credit Monitoring is two years of CyEx Medical Shield Complete, with “$1 million of medical identity theft insurance” and monitoring for health-insurance ID exposure, medical record number exposure and unauthorised HSA spending. It requires no claim: “Enrollment codes have been sent to all Class Members by postcard,” and they “shall become active on the Effective Date.” The notice's summary table says a claim form is “the only way to receive benefits or payments from this Settlement,” but Question 7 and paragraph 65 of the agreement put the monitoring outside the claim: “Settlement Class Members do not need to submit a Valid Claim to receive this benefit.” Lost the postcard? The administrator reissues codes. This is the second monitoring offer — the IDX enrollment CD offered in 2025 closed on June 28 of that year.

What is missing from all of this is a dollar figure for the settlement, and that is by design. The notice says “CD has agreed to pay for a number of Class benefits”; the agreement has the administrator invoice valid claims and CD pay the invoice within 25 days. There is no cap on the $50 payments and no pro rata language anywhere in the notice or the benefits section of the agreement. Our arithmetic: $50 for each of the 130,583 people in the recital would be about $6.5 million if every one of them filed, and nobody expects that — but a low claim rate here shrinks CD's bill, not your cheque. Fees are separate: class counsel will ask for $400,000.00 in fees and costs and $2,500.00 for each of the nine representatives, “no more than up to $22,500.00 total,” all paid by CD.

The final approval hearing is November 23, 2026 at 11:00 a.m. Central Time, via Zoom. Nothing is paid before then, and not immediately after. The agreement defines the Effective Date as 60 days after the final approval order if nobody appeals — or, if someone does, 30 days after the appeal is affirmed or dismissed — and then: “No later than 30 days after the Effective Date, the Settlement Administrator shall” send the payments. The notice's own words on timing are the cautious ones: “If the Court approves the Settlement, there may be appeals. We do not know if appeals will be filed, or how long it will take to resolve them if they are filed.” With no appeal, that puts payments in the first quarter of 2027. Paper cheques “must be negotiated within 90 days of issuance.”

The monitoring runs on the same clock — the codes on the postcard activate on the Effective Date, not on the day you file. Anyone who wants coverage in the meantime has to buy it, and the cost of doing so is, on the notice's list, a documentable loss.

October 19, 2026 is the claim deadline: online at CDDataBreach.com by that date, or a paper form “postmarked no later than October 19, 2026” to CD Data Breach Settlement, c/o Settlement Administrator, PO Box 25226, Santa Ana, CA 92799-9958. The postcard's identifier lets the administrator match you to CD's records; if you have a breach letter but no postcard, the toll-free line — (866) 675-2314, 24 hours — and info@CDDataBreach.com confirm membership for free.

September 24, 2026 is the deadline to leave or to object. A Request for Exclusion is a signed letter naming the case, with your name, address, phone and email and the words “Request for Exclusion,” submitted, postmarked or emailed to the administrator, marked ATTN: Exclusion Request. An objection is filed with the Clerk of Court, District Court for Ramsey County, 15 West Kellogg Boulevard, St. Paul, MN 55102, and copied to the administrator, to class counsel — Raina C. Borrelli of Strauss Borrelli PLLC in Chicago and Christopher P. Renz of Chestnut Cambronne PA in Minneapolis — and to CD's counsel at Hinshaw & Culbertson LLP. The notice lists nine required elements, including a list of any other objections you or your lawyer have filed in the past five years; miss one and “waives the right to object.”

Doing nothing costs the release and the money: “If you do nothing, you will not receive a benefit from this Settlement” and you give up the right to sue CD over the breach. For most class members the sensible sequence is to file the $50 claim now, keep the postcard for the monitoring code, and — if fraud tied to the breach turns up before October 19 — switch to a documented-loss claim with the paperwork attached, knowing it falls back to $50 if the proof does not hold. Our data breach settlement calculator shows how this $50-or-documented structure compares with other medical-record settlements.