DAP Health’s $1.3 Million Breach Settlement Covers 129,973 People — $10 a Head Before Fees. The $25 Is an Estimate Paid Last, After Lawyers, Administration, Monitoring, Receipts and a $75 California Payment. Final Hearing October 1, Claims Close October 21.

A postcard is the form the court-approved notice in the dap health data breach settlement takes; here is how to check yours. Judge Hopp’s June 8 order appoints Epiq as settlement administrator and gave it 45 days to mail notice (July 23, 2026, by our count). Epiq’s notice plan, filed with the court, describes a double postcard with a detachable claim form, sent by first-class mail to the addresses DAP Health supplied after a check against the Postal Service’s change-of-address database, plus a quarter-page notice in The Press-Enterprise. Notice goes by mail. The claim page mentions a confirmation email after you file and says the administrator will contact you if more information is needed; the claim form adds that monitoring activation instructions come by email. The return address is DAP Data Incident, Settlement Administrator, P.O. Box 3245, Portland, OR 97208-3245; the toll-free line, 1-877-269-0487, plays recorded information only; the email address is info@DAPDataSettlement.com.

The safest route is to type DAPDataSettlement.com yourself and choose Submit a Claim. The login needs the 10-character alphanumeric Unique ID and 4-digit PIN printed on the postcard. The claim form asks for your name, mailing address, phone, email and Unique ID, and at the end for a payment choice: a paper check by default, PayPal, Venmo or Zelle, or a direct deposit that asks for a routing and account number. The bank details are optional — you can take a check — and nowhere does the form ask for a Social Security number. The long-form notice is also posted in Spanish and Arabic.

No postcard? The claim page says to email info@DAPDataSettlement.com or write to the P.O. box; its help box says to call 1-877-269-0487. The paper claim form can be downloaded from the Documents page and mailed. Epiq’s plan also calls for a reminder postcard before the claims deadline to class members who have not yet filed.

Does your letter mention Borrego Health? Same incident. DAP Health’s breach letter dated December 26, 2024 was written for “DAP Health, Inc., along with its subsidiary Borrego Health,” and the settlement lists Borrego Health among the released parties “as they were identified in the Defendant’s breach notification letters.” That letter came from DAP Health, Inc. c/o Cyberscout, PO Box 1286, Dearborn, MI, and offered 12 months of single-bureau credit monitoring from Cyberscout, a TransUnion company, with enrollment required within 90 days of the letter — for a letter dated December 26, 2024, a window that closed on March 26, 2025, by our count. Its helpline was 833-799-4324. The settlement’s two years of monitoring is a separate benefit that you claim on the form.

DAP Health is a nonprofit health provider based at 1695 N. Sunrise Way in Palm Springs, according to the complaint. Its letter describes the dap health data breach this way: “On July 22, 2024, DAP Health detected suspicious activity in its email environment,” and its investigation found that “an unauthorized actor accessed and/or acquired certain files and data stored within its email environment.” After reconstructing what the mailboxes held, DAP Health identified the affected people on November 26, 2024, and letters went out in December 2024. Its filing with the California Attorney General lists the date of the breach as July 8, 2024, two weeks before the detection date in the letter.

The information involved, as the settlement defines it, reads like a complete patient and identity file: names, Social Security numbers, addresses, dates of birth, phone numbers, driver’s license, passport and birth certificate numbers, vehicle license plate and VIN numbers, financial account numbers, Medicare/Medicaid numbers, health insurance plan and policy numbers, diagnoses, procedures and treatments, treatment dates, locations and costs, lab results and images, vital signs, medical histories, allergies, prescriptions and provider names. Not every element applies to every person; DAP Health’s letter says it had collected the information “from its employees, patients, and clients.” Donald Crosslin’s original complaint put the class at approximately 129,048 people, the same figure HIPAA Journal reports from DAP Health’s filing with the HHS Office for Civil Rights; the settlement class, at approximately 129,973, is slightly larger.

The dap health data breach lawsuit began on January 10, 2025, when Crosslin sued in Riverside County Superior Court; his complaint says his own letter arrived on or about December 16, 2024. Matthew Paone filed a second case on February 5, 2025 (No. CVRI2500382), dismissed it on May 13, 2025, and joined Crosslin in a first amended complaint on June 6, 2025. That complaint claims negligence, breach of implied contract, unjust enrichment, and violations of California’s Confidentiality of Medical Information Act, Unfair Competition Law and Consumer Privacy Act. After a full-day mediation with Jill Sperber of Judicate West, the parties signed the $1.3 million agreement, which also commits DAP Health, without admitting liability, “to implement and maintain certain cybersecurity, data privacy protocols, and deploy additional security measures.” The agreement names DAP Health’s insurer, Tokio Marine HCC, as the party that will fund the settlement. DAP Health denies all wrongdoing, and the court has not decided who was right. Judge Hopp granted preliminary approval on June 8, 2026.

This settlement does not make you choose between cash options. The claim form lets you take all four of these at once.

Cash Payment A — Documented Losses, up to $5,000. Losses incurred on or after July 22, 2024, up to the date you file, that are “more likely than not traceable to the Data Incident” and have not been reimbursed elsewhere. The form’s three categories are professional fees to deal with identity theft or fraud; other fraud losses such as unauthorized charges, bank fees and credit reports or monitoring you paid for; and incidentals such as notary, fax, postage, copying, mileage and long-distance calls. Card and bank statements, invoices, phone records, photographs and receipts count; a personal declaration alone, or a handwritten receipt alone, does not. By filling in the boxes you certify the costs do not relate to other breaches. There is no separate payment for lost time.

Cash Payment B — Pro Rata Cash, estimated at $25. No documents. The agreement is candid about where the number comes from: “Based on their collective experience from prior cases, Class Counsel estimates the approximate amount of the payment will be approximately $25.00.” The actual amount is whatever is left, divided by the number of valid B claims, so it can go up or down. A documented-loss claim that is rejected and not fixed is treated as a B claim.

Cash Payment C — California Statutory Payment, $75. For class members to whom DAP Health mailed breach notice and who were California residents on July 22, 2024, “in recognition of their release of claims under the California Consumer Privacy Act.” You check a box and affirm your residency under penalty of perjury. The agreement calls the $75 an estimated amount that “may be adjusted if the total amount of claims exceeds the Settlement Fund.”

Credit and medical record monitoring, two years. One-bureau credit monitoring plus medical record monitoring, fraud consultation, identity theft restoration and up to $1 million of identity theft insurance. Instructions and an activation code go to the email on your claim after the settlement is final; the form states that enrolling “will not subject you to marketing for additional services or any required payments.”

If Epiq finds a claim deficient, it must tell you within seven days of that decision, and you then have 20 days to fix it. Paper checks are void 90 days after they are issued, and uncashed money goes to the Electronic Frontier Foundation, which the agreement names as the recipient.

$1,300,000 across approximately 129,973 class members is $10.00 per person, by our arithmetic. Before any class member is paid, the agreement takes out administration and taxes, then attorneys’ fees, costs and service awards, then the cost of the monitoring. The notice says Class Counsel will ask for fees of up to one-third, $433,333.33, plus costs, which the agreement caps at $30,000, and up to $5,000 for each of the two class representatives. Epiq told the court it would cap its fees and expenses at $229,586 — a cap that excludes the monitoring and holds only if volumes stay as estimated. If the court grants every request, $597,080.67 is left — $4.59 per class member — before monitoring, documented losses and the California payments.

Then comes the part the $25 depends on. The money flows to monitoring, then to documented losses (A), then to the $75 California payments (C), and only then to the pro rata payment (B), which gets whatever is left. If monitoring and documented losses alone used up the pool, the agreement says no B or C payments would be made at all.

These are ceilings from dividing the $597,080.67: monitoring and documented-loss claims come out first, so real amounts are lower. Claimants who did not live in California get only the B share, and they share it with everyone else who claims it. At the other extreme, if nobody claimed the $75, the same pool would cover the $25 for about 23,880 claims, or 18 percent of the class. The settlement papers do not say how many class members lived in California. No claim count has been published, and as of September 27 the settlement website’s Documents page did not list a motion for final approval or the fee application.

As of September 27, 2026, the opt-out window is closed, the hearing is ahead and claims are open.

Mailing? The notice says postmarked by October 21, but warns that mail is not always postmarked the day it is dropped off and suggests mailing at least a week early; the agreement uses both wordings (postmarked in two places, received in one), and the claim page says postmarked to be received by the deadline. Earlier is safer, and filing online avoids the question.

What October 1 decides, and whether that ends it: Judge Hopp will decide whether to approve the settlement and the requested fees, costs and service awards. If he approves and there were no objections, the agreement makes the next day the Effective Date; if objections were filed, it is 30 days after the approval order, or later if anyone appeals. Whether anyone objected is not known from the documents posted so far. Cash is due within 30 days after the Effective Date or after all claims have been processed, whichever comes later. With claims open until October 21 and 20 days to fix a deficient claim after Epiq’s notice, that points to December 2026 at the earliest, by our reading — and there is no announced payment date.

One detail for people who moved: the agreement says that anyone whose postcard was re-mailed to a forwarding address has 90 days from the re-mailing to claim. The notice prints no separate date for that, so the safe course is still October 21.

Contact: Epiq, 1-877-269-0487 (toll-free, recorded information), info@DAPDataSettlement.com, DAP Data Incident, Settlement Administrator, P.O. Box 3245, Portland, OR 97208-3245. The notice asks class members not to call the court or the clerk’s office. Class counsel: John J. Nelson of Milberg, PLLC and Kristen Lake Cardoso of Kopelowitz Ostrow P.A. DAP Health’s counsel: James Monagle of Mullen Coughlin LLC.