This Mental Health Settlement Has No Opt-Out. Once the Judge Signs Off, Your Claims Are Released Whether You File or Not — and the $40 Is the Only Payment That Can Be Cut.

Every class settlement notice you have ever read has a box at the top listing your rights, and it normally has three or four rows: file a claim, exclude yourself, object, do nothing. This one has two. There is no exclusion row.

We did not want to report an absence on a reading, so we checked it as a measurement: across the full notice and the settlement agreement, the word “objection” appears 43 times. “Opt-out” and “request for exclusion” appear zero times. The control is the 43 — the search works; the term simply is not there.

The consequence is plain and worth stating without drama: the class is everyone whose private information was accessible in the incident, so if you received a letter from MHA you are in it, and the release will bind you whether or not you file, once the court grants final approval at the December 15 hearing. There is no version of doing nothing that preserves a right to sue later. So the only question left is whether you take the money. The class is put at 12,633 people, and the data at stake is unusually sensitive even by breach standards: diagnoses, medication and medical record numbers alongside Social Security numbers.

There is no common fund. The cash side runs against a $300,000 cap, and the agreement is specific about what happens if it is hit: “If the Settlement Cap is exceeded, the alternate cash payment awards will be reduced pro rata.” Only the flat payment shrinks. Documented losses and time payments are not touched.

The $40 is an alternative, not an add-on: “Instead of any other cash payment option, you may claim a one-time $40.00 cash payment.” So the two real routes are $5,075 with documentation or $40 with none — and the three years of monitoring comes with either.

One caveat on the monitoring, in fairness to readers comparing settlements: the agreement describes it as single-bureau. Three years is generous; one bureau is less than the three-bureau products other settlements offer.

Fees of up to $250,000, service awards of $2,500 per plaintiff and all administration costs are paid by MHA outside the $300,000 cap. They do not reduce anyone's payment.

There are dozens of organisations by that name, and search results mix them freely. The defendant here is Mental Health Association, Inc., 350 Memorial Drive, Chicopee, Massachusetts — a non-profit founded in 1960 serving western Massachusetts, supporting people with mental illness, developmental disabilities, acquired brain injury and addiction, and people who are homeless. The federal breach portal lists it as a healthcare provider.

Four independent records line up: the case caption sits in Hampden County, where Chicopee is; the Maine attorney general filing gives the same Memorial Drive address; the same law firm that filed that breach notice defends the case; and the notification date matches at May 30, 2025 in the agreement, the state filing and the specimen letter.

It is not Mental Health America, nor the associations in Rochester, Frederick County or Essex County. And it is not the case that keeps surfacing next to it: Mitchell v. Gándara Mental Health Center, No. 2479CV00652, is a different settlement in the same courthouse — $900,000, 17,543 people, and its claim deadline expired on July 23, 2026.

The settlement agreement defines the event precisely: “'Data Incident' means the cyberattack against Defendant … which occurred on or around November 28, 2024.” MHA's own notice says it “discovered that its systems were potentially compromised by an unauthorized actor” on December 2, 2024. Both are right; they describe different moments. Coverage that treats them as contradictory has simply conflated attack and discovery.

MHA reported to the federal regulator on January 31, 2025 — exactly sixty days after discovery, the last day the rule allows. The list of people to notify was finalised on May 20, 2025 and letters went out from May 30.

The case itself: filed June 10, 2025 in Hampden County Superior Court; a motion to dismiss on November 17, 2025; an amended complaint on January 6, 2026 adding a second plaintiff; the settlement signed in February 2026 and preliminarily approved on July 24, 2026, with notice mailed August 21, 2026. Neither the notice nor the agreement names the judge — we checked, and the word “Court” appears 125 times in the agreement, so the text is searchable; the name is simply not in it.

Practical note for filing: the paper claim form labels the identifier field “LoginID (if known),” so a missing code is not a bar by post, and the administrator will supply one on request.