ModMed’s Nearly $3 Million Data Breach Settlement Covers About 386,000 Patients — $7.77 a Head Before Fees, While the Notice Estimates $75 Without Proof. Opt-Outs Close October 19, Claims November 2, 2026.

Modernizing Medicine, Inc. — ModMed, a medical software firm based in Boca Raton, Florida — has agreed to pay $2,999,750 to settle a class action over a July 2025 cyberattack. According to the settlement agreement, on July 21, 2025 ModMed “detected suspicious activity on two computer servers that were used to facilitate the conversion of limited data from retiring electronic health record (‘EHR’) platforms,” and later determined that an unauthorized third party had accessed and acquired information on those two servers between July 9 and July 10, 2025. The agreement adds that the intruder “did not have access to customer instances of EHR systems or full medical records.” ModMed denies that it did anything wrong, and the court has not decided who is right.

You are in the class if you were sent a notice of the breach. The court’s definition: “All living individuals residing in the United States who were sent a notice of the Data Incident indicating their Private Information was impacted in the Data Incident.” The proposed preliminary approval order filed with the agreement puts that group at approximately 386,000 individuals. They are patients, not ModMed’s customers. ModMed’s own breach letter, dated October 17, 2025 and filed with the Vermont Attorney General, describes the company as “a vendor that provides electronic health record and other services to podiatry providers” and says the affected servers held “limited data from some of our podiatry customers.” Each letter named the practice where the recipient may have received care. If you got that letter in the fall of 2025, or a settlement postcard or email since the notice mailing of July 29, 2026, you are very likely a class member; if you are unsure, the administrator will check at (833) 421-7331.

What was exposed differs by person. The settlement notice lists full names, addresses, dates of birth, phone numbers, email addresses, Social Security numbers, health insurance information and medical information — medical record and patient account numbers, dates of service, provider and practice names, billing and diagnostic codes, prescription information, and diagnosis and treatment information. ModMed sent two versions of its 2025 letter. One says the recipient’s “Social Security number, bank/financial account information, credit card information, driver’s license number, government ID card, and full medical records were not involved in this incident.” The other lists a Social Security number among the exposed data and offers free IDX credit monitoring for one or two years. Both groups are in the same class and get the same settlement options.

Every class member who files a valid claim chooses one cash option and can add medical data monitoring on top:

• Cash Payment B — Alternate Cash: “a one-time estimated $75.00 cash payment. You do not have to provide any proof or explanation to claim this payment.”
• Cash Payment A — Documented Losses: up to $5,000 for out-of-pocket losses related to the breach that occurred between July 9, 2025 and November 2, 2026 — identity theft or fraud losses, fees for credit reports, credit monitoring or credit freezes, the cost of replacing IDs, postage to contact banks. You need records made by a third party, such as receipts, phone records or emails: “Your personal certification, declaration, or affidavit does not constitute reasonable documentation.” A documented claim that is rejected and not cured is paid as the $75 option instead. Expenses already reimbursed through the monitoring product offered in ModMed’s 2025 letter, or by any other source, are not paid again.
• Medical Data Monitoring: two years of CyEx Medical Shield Complete, with “$1 million of medical identity theft insurance with no deductible,” monitoring with one credit bureau, dark web scanning, security freeze assistance and access to fraud resolution agents.

The $75 is an estimate, and every cash amount is pro rata. Under paragraph 71 of the agreement, the net fund pays monitoring first, then documented losses, then the $75 claims, and any increase or decrease is applied “on an equal percentage basis.” The fund is non-reversionary — nothing goes back to ModMed once the settlement is final — but it also pays the administrator and the lawyers, who will ask for “up to one-third of the Settlement Fund” plus litigation costs.

Our arithmetic, to show the scale: $2,999,750 spread over about 386,000 people is $7.77 a head before anything is deducted. If the court awards the full one-third ($999,917), about $2 million remains before administration and monitoring costs. That would cover the full $75 for about 26,660 claims — 6.9 percent of the class. If more people claim, every cash payment shrinks by the same percentage; if fewer claim, it grows. Nothing is paid until the court grants final approval and any appeals are resolved.

File online at the official site, ModernizingMedicineDataSettlement.com, using the LoginID and PIN printed on your postcard notice if you have them, or download the paper claim form and mail it to ModMed Data Incident Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958. The claim deadline is November 2, 2026. The notice says a mailed form must be “postmarked no later than November 2, 2026,” but the claim form itself says paper forms must be “received by the Settlement Administrator no later than November 2, 2026” — so mail well ahead or file online. Only one claim per person.

Payment is electronic only. The claim form says “NO CHECKS WILL BE SENT” and offers PayPal, Venmo, Zelle or a virtual prepaid card delivered by email. The administrator has to pay no later than 45 days after the settlement’s Effective Date, which is 31 days after the final approval order if nobody appeals. If the order were entered on November 17, 2026 and no appeal followed, the Effective Date would be December 18, 2026 and the payment deadline February 1, 2027 — our calculation; an appeal would push both back.

The deadline to opt out or object is October 19, 2026 — two weeks before the claim deadline. An opt-out request must name the case, give your full name, mailing address, phone number and email address, carry your personal signature and say “Opt-Out Request” or state clearly that you do not want to take part; mail it to the administrator, ATTN: Exclusion Request, at the same P.O. Box. Opting out keeps your right to sue ModMed on your own and gives up every settlement benefit. An objection has to be filed with the Clerk of Court by October 19, 2026 and copied to the administrator, class counsel and ModMed’s counsel. Among its nine requirements: “a statement confirming whether the objector and or the objector’s counsel utilized any form of artificial intelligence in the preparation of the objection.” The final approval hearing is set for November 17, 2026 at 2:30 p.m. Eastern at the Paul G. Rogers Federal Building and U.S. Courthouse, 701 Clematis Street, West Palm Beach. Doing nothing means no money and giving up the claims the settlement releases.

It is, if it leads back to the official site. ModernizingMedicineDataSettlement.com is run by Simpluris, the settlement administrator; its toll-free line is (833) 421-7331, its email address info@ModernizingMedicineDataSettlement.com, and its mailing address P.O. Box 25226, Santa Ana, CA 92799-9958. Genuine notices carry the case name, Cavallaro-Kearins v. Modernizing Medicine, Inc., and the case number 9:25-cv-81443-EA. The official claim form asks for your name and contact details, your benefit choice, a PayPal, Venmo, Zelle or email address for payment, and your signature — it has no field for a Social Security number or a bank account number. If a message asks for either, check it against the phone number on the official site before you answer.

Two older contacts were also genuine but are not the settlement. ModMed’s breach letter of October 17, 2025 was signed by the “ModMed Privacy Office,” came from a return-mail center in Suwanee, Georgia, and listed a call center at 1-833-353-4513. The version sent to people whose Social Security numbers were involved offered IDX monitoring with an enrollment deadline of January 17, 2026, which has passed. The settlement’s monitoring is a different product, CyEx Medical Shield Complete, and it is claimed only on the settlement claim form.

The lawsuit was filed on November 19, 2025 in the Southern District of Florida and alleged negligence, breach of implied contract, invasion of privacy, unjust enrichment and breach of fiduciary duty. The named plaintiff, according to the complaint, “received podiatric medical care from a healthcare provider that used Defendant’s software.” The parties paused the case, mediated in person in Miami on April 2, 2026, agreed on terms after a full day of negotiations and filed the settlement agreement on May 26, 2026 as Document 16-1. Class counsel are Jeff Ostrow of Kopelowitz Ostrow P.A., Mariya Weekes of Milberg PLLC and Raina Borrelli of Strauss Borrelli PLLC; ModMed is represented by Alston & Bird LLP. The proposed orders filed with the agreement carry the signature block of U.S. District Judge Ed Artau, matching the “EA” in the case number.

Under the agreement, money still in the fund 180 days after the first electronic payments goes to a court-approved cy pres recipient; the parties propose the Legal Aid Society of Palm Beach County. As of September 30, 2026 the Modernizing Medicine settlement website does not publish the date of the preliminary approval order, the number of claims filed or the administration costs, so the real size of the $75 payment is not yet knowable. For other data breach settlements that are still taking claims, see our list of open class action settlements; to estimate what a documented-loss claim might be worth, try the data breach settlement calculator.