Palomar Health Medical Group's $3.1 Million Breach Settlement Covers 1,132,116 People — $2.74 Each — and Its $60 Estimate Only Holds If About 97% of Them Never File. Claims Close October 22.

The timeline in the plaintiffs' motion is unusually specific about how this one unfolded. On May 5, 2024, Palomar Health Medical Group detected unauthorized activity on its network, “including a ransom note and encryption of certain systems.” The intruder had been inside since April 23 and, according to the same filing, accessed or acquired files containing patient information before executing the ransomware that encrypted the systems — the exfiltrate-then-encrypt pattern that turns an outage into a data breach.

Patients got email notices on or about May 21 and June 12, 2024. The written notice by mail went out on or about October 15, 2025 — seventeen months after detection, which is why a letter about a 2024 incident may have arrived only last autumn. The lawsuit itself was filed in San Diego Superior Court on May 28, 2024, three weeks after the ransom note, by Clarissa Castro; an amended class complaint on September 16, 2024 added Amber Friedrich, Duncan Meadows, John South and Nyree Zapata, and the other related cases were dismissed into it.

The data at stake is the full medical-group set. The settlement agreement's definition of “Private Information” lists name, address, date of birth, Social Security number, medical history, disability, diagnostic, treatment and prescription information, physician information, medical record number, health insurance information including subscriber and group numbers, credit or debit card number with security code and expiration date, and email addresses and passwords or usernames and passwords — “which varied among individuals.” The parties mediated for a full day on July 30, 2025 before the Hon. David E. Jones (ret.), agreed on terms, and Judge Loren Freestone granted preliminary approval in Department C-64 on July 17, 2026.

The notice offers two cash options and one that stacks on top of either.

Cash Payment A — Documented Losses: up to $5,000 per class member for “reasonable documented losses related to the Data Incident.” The documentation standard is the usual one: records “contemporaneously generated or prepared by a third party or the Settlement Class Member” — phone records, correspondence, receipts. Your own declaration “does not constitute reasonable documentation” on its own; it can accompany real records, not replace them. Losses already reimbursed elsewhere, including through the monitoring product Palomar offered in its notification letter, are excluded.

Cash Payment B — Alternative Cash: “a cash payment in the estimated amount of $60.00 that does not require documentation.” The notice is explicit that the figure floats: “The final amount of the flat cash payment will not be determined until all Claim Forms have been received and evaluated,” and every cash payment is subject to a pro rata increase if valid claims fall short of the net fund, or a decrease if they exceed it.

Credit monitoring: two years of single-bureau monitoring with $1,000,000 of identity fraud insurance and dark web monitoring, “which may be claimed alone or in addition to either cash payment benefit.” Whatever you decide on cash, there is no reason to leave the monitoring unclaimed.

The court also noted a feature most notices bury: any money left 240 days after class members are emailed to choose a payment method goes to a cy pres recipient, proposed as the Electronic Privacy Information Center. Nothing reverts to Palomar.

Most write-ups of this settlement lead with the $60 and stop. The plaintiffs' own motion for preliminary approval does not. It states that “Defendant has confirmed there are approximately 1,132,116 members of the Settlement Class” and, in the paragraph defending the deal's fairness, converts the fund to “$3,100,000.00 for a class of 1,132,116 (which equates to a value of $2.74 per Settlement Class Member).” The court repeated the 1,132,116 figure in its July 17 minute order. (Trade coverage of the breach reported a slightly higher 1,140,221 individuals notified; we use the settlement's own number.)

So where does $60 come from? From an assumption about how few people file. Here is our arithmetic, using only figures in the court papers: the minute order caps attorneys' fees at $1,033,230 (one-third), and service awards total $12,500 ($2,500 for each of five representatives). Before administration costs and the credit monitoring that claimants take — neither quantified in the papers, both paid from the fund ahead of the cash — that leaves about $2,054,000. At $60 a head, that money covers roughly 34,000 no-proof claims, or about 3 percent of the class. Every documented-loss claim paid at up to $5,000 and every dollar of administration reduces that headroom further.

None of that is a reason not to file; a claim is free and the documented-loss track keeps its $5,000 ceiling regardless. It is a reason to read “estimated” as the operative word, and to treat the $60 the way the notice itself does — as the outcome of a low claims rate, not a promise.

The settlement site lists three deadlines and a hearing. As of September 17, 2026, all of them are ahead.

The opt-out deadline is only relevant if you intend to sue Palomar Health on your own; letting it pass costs nothing and keeps you in the class. The claim deadline is the one that costs money. If you do nothing by October 22, you receive no benefits and are still bound by the release, because everyone who did not opt out is bound whether or not they filed.

On payment timing, the notice says what these notices always say and no more: even after approval, “there may be appeals, and resolving them may take additional time,” and processing depends on the volume of claims. With a November 6 hearing, 2027 is the realistic window for money to move.

Claims are filed online at PHMGDataSettlement.com or on a paper form requested by phone. The administrator is Angeion Group; the toll-free line is 1-844-440-4203 and the email is info@PHMGDataSettlement.com. If you received a notice by mail, you are eligible to file. If you are unsure, the administrator can check you against the list; the class is defined as everyone whose private information “was accessed, acquired, disclosed, or compromised in the Data Incident,” which in practice means the people Palomar notified. If the administrator asks for more information and you do not answer in time, “your claim may not be paid” — the most common way a valid claim dies.

Class counsel are Kristen Lake Cardoso of Kopelowitz Ostrow P.A., Danielle L. Perry of Mason LLP, Bart D. Cohen of Bailey Glasser LLP and Jason M. Wucetich of Wucetich & Korovilas LLP; they will ask for up to one-third of the fund plus costs, and the court has already said the fee “will not exceed $1,033,230.” Palomar is defended by Freeman Mathis & Gary, LLP. Separately from the fund, and at its own expense, Palomar says it has since deployed endpoint detection and response tools, new backup storage and additional network monitoring — the three measures the notice lists, and the ones most directly aimed at the exfiltrate-then-encrypt sequence that produced this case.

One practical note for the documented-loss track: the loss must be “related to the Data Incident,” which for a breach detected in May 2024 means losses from that point on, with contemporaneous paper behind them. Credit freezes, replacement cards and identity-theft fallout with statements to show for it belong there; a claim built on your own written account belongs on the $60 track, with the monitoring on top.