ModMed Data Breach Settlement: 7,715 Claims From 371,652 Class Members by October 1 — About 2 Percent — While Lawyers Ask for $999,916.66. Opt-Outs Close October 19, Claims November 2, 2026.

As of October 13, 2026, nobody has been paid from the Modernizing Medicine data breach settlement, and nobody will be before the court decides on final approval at the hearing on November 17, 2026. What is new is a court filing. On October 2, 2026, class counsel filed “Plaintiff’s Unopposed Motion for Final Approval of Class Action Settlement and Application for Attorneys’ Fees and Costs,” entered as Document 28 and now posted on the official settlement site. It contains the first numbers from the administrator, Simpluris:

• 371,652 settlement class members — “There are 371,652 Settlement Class Members.”
• 7,715 claim forms received as of October 1, 2026 — about 2.1 percent of the class, by our arithmetic. The motion adds: “These numbers are preliminary.” Claims are still subject to audits and a duplicate check.
• One opt-out request and no objections the administrator or the parties know of.
• Individual notice “reached approximately 95.22%” of the identified class; the settlement site had 9,174 unique visits and the toll-free line 341 calls by October 1.

The case is about a cyberattack on two ModMed servers “used to facilitate the conversion of limited data from retiring electronic health record (‘EHR’) platforms.” According to the motion, ModMed detected suspicious activity on July 21, 2025, and an unauthorized actor accessed and acquired information between July 9 and July 10, 2025; notice letters went out from about October 17, 2025. The files may have contained names, addresses, dates of birth, contact details, Social Security numbers, health insurance information and medical information. ModMed denies liability; it does not oppose the motion.

Each class member who files a valid claim picks one cash option and can add monitoring:

• Cash Payment B: “a one-time estimated $75.00 cash payment. You do not have to provide any proof or explanation to claim this payment.”
• Cash Payment A: up to $5,000 for documented out-of-pocket losses that occurred between July 9, 2025 and November 2, 2026, such as identity theft losses, credit report or freeze fees and postage. You need third-party records; “Your personal certification, declaration, or affidavit does not constitute reasonable documentation.”
• Medical Data Monitoring: two years of CyEx Medical Shield Complete with “$1 million of medical identity theft insurance with no deductible.”

How much do data breach settlements pay? In this one, the fund pays fees and administration first, and the cash payments then adjust. The site warns that “your payment may be slightly higher or lower than the amount you claim.” The new filing lets us run the numbers for the first time. If the court grants everything requested — $999,916.66 in fees, $17,994.40 in costs and $335,713 in administration costs — about $1,646,126 is left for benefits, by our calculation. That would cover the full $75 for roughly 21,948 claims before the cost of monitoring and documented-loss payments. The 7,715 claims counted by October 1 would need about $578,625 at $75 each. Claims keep arriving until November 2, monitoring costs and the number of documented claims are not public, and the court may cut the fee, so we cannot predict the final amount. On the October 1 count, though, the fund was not yet the limit.

Payment is electronic only. The claim form says “NO CHECKS WILL BE SENT” and offers PayPal, Venmo, Zelle or a virtual prepaid card. The FAQ says payments and monitoring codes “will be distributed if the Court grants final approval, and after any appeals are resolved.”

How do I check if I’ve been data breached? For this settlement the test is simple: you are in the class if you were sent a notice. The court’s definition covers “All living individuals residing in the United States who were sent a notice of the Data Incident indicating their Private Information was impacted in the Data Incident.” That includes ModMed’s breach letters from October 2025 and the settlement postcards mailed from July 29, 2026. If you are not sure, call the administrator at (833) 421-7331 or email info@ModernizingMedicineDataSettlement.com.

• Claim: online at ModernizingMedicineDataSettlement.com by November 2, 2026, or on the paper form to ModMed Data Incident Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958. The FAQ says mailed forms must be “postmarked no later than November 2, 2026,” but the claim form itself says “Claims must be received by November 2, 2026.” File online or mail early. One claim per person.
• Opt out: by October 19, 2026. The request must be “postmarked or emailed by October 19, 2026,” with the case name, your contact details, your signature and the words “Opt-Out Request.”
• Object: file with the Clerk of Court by October 19, 2026 and send copies to the administrator and both sides’ lawyers. You can object to the fee request too. One of the requirements is a statement on whether the objector or their lawyer “utilized any form of artificial intelligence in the preparation of the objection.”

Can you sue a hospital for a data breach? This settlement does not answer that question for your doctor’s office. The defendant here is ModMed, the software vendor, not the medical practice. If you stay in, you cannot join “any other lawsuit against ModMed or the Released Parties related to the Released Claims.” If you opt out, you “keep any rights you may have to sue ModMed on your own,” but you give up all settlement benefits. Whether a claim against a particular practice is covered depends on the release in the settlement agreement. Ask a lawyer before October 19 if that matters to you.

Yes, if it points to ModernizingMedicineDataSettlement.com. Simpluris runs that site. Its toll-free number is (833) 421-7331, its email address info@ModernizingMedicineDataSettlement.com and its mailing address P.O. Box 25226, Santa Ana, CA 92799-9958. Real notices name the case Cavallaro-Kearins v. Modernizing Medicine, Inc., case no. 9:25-cv-81443. The claim form asks how you want to be paid electronically. We found no field on it for a Social Security number. If a message asks for one, or asks you to pay a fee to file, call the number on the official site before you answer.

One detail may cause confusion. The settlement website and notice give the case number with the suffix “EA.” The October 2 motion is captioned “CASE NO.: 9:25-cv-81443-BER.” It is the same case, and the suffix is part of the court’s case designation and can change. A suffix change is not a sign of fraud.

The record so far: complaint filed November 19, 2025; settlement agreement executed May 22, 2026; preliminary approval motion filed May 26, 2026; and, “following a hearing,” the preliminary approval order entered on June 29, 2026. At that hearing, according to the motion, “the Court asked for additional information” about the named plaintiff’s Article III standing. The motion answers with a declaration from her and cites, among others, a 2025 data breach decision listed as “(Reinhart, J.),” in a case whose number also ends in BER. The posted filing does not say whether the court asked anything else. Counsel note that the settlement does not depend on the fee award, so a lower fee would leave more money for class members.

The class count is smaller than earlier figures. Our September 30 report quoted approximately 386,000 people from the proposed preliminary approval order. The administrator now counts 371,652, and the sources do not explain the difference. A claim rate of 2.1 percent a month before the deadline is low. Class Counsel will update the court on the number of claims at the final approval hearing on November 17, 2026 at 2:30 p.m. Eastern, in the Paul G. Rogers Federal Building, 701 Clematis Street, West Palm Beach. We will update this story when the court rules. For the full background on the breach, see our Modernizing Medicine data breach settlement guide.