Wayne Memorial Hospital’s Breach Settlement Offers $25 Without Proof or Up to $5,000 With It — but the No-Proof Pool Is Capped at $300,000 for 163,440 People Notified. Claim Deadline December 7, 2026.

As of October 18, 2026, the Wayne Memorial Hospital breach settlement is open for claims, and the official site puts it plainly: submitting a claim form is “The only way to receive a cash payment.” If you got a notice letter, you can pick one of two cash options. The first is Cash Payment A, up to $5,000 for “reasonable documentation of losses related to fraud and/or identity theft as a result of the Data Incident.” The second is Cash Payment B, “a cash payment in the estimated amount of $25.00, which does not require any documentation.” The deadline is December 7, 2026, online or by mail postmarked by that date.

The hospital described the attack in its own notice: “On June 3, 2024, WMH detected a ransomware event, whereby an unauthorized third party gained access to WMH’s network, encrypted some of WMH’s data, and left a ransom note on WMH’s network.” Its forensic review found that the intruder had access between May 30 and June 3, 2024. The hospital posted a public notice on August 2, 2024, but individual letters did not go out until August 27, 2025, more than a year after the attack. Comparitech reported that the hospital “initially notified just 2,500 people of the breach in August 2024.” According to SecurityWeek, the hospital later told the Maine Attorney General’s office that 163,440 people were affected.

The plaintiffs claim the hospital failed to adequately protect patient data. Their legal claims are negligence, breach of implied contract and unjust enrichment. The hospital “denies any wrongdoing,” and no court has found otherwise.

Cash Payment A (documented losses). You can be reimbursed up to $5,000 for losses that are actual, documented and unreimbursed, and that were “more likely than not caused by the Data Incident.” Your own signed statement alone does not count as documentation. If you were already reimbursed for a loss from another source, including an identity-protection product, you will not be paid for it again.

Cash Payment B (about $25). This option needs no receipts, but the total paid out under it cannot exceed the $300,000 cap. If claims go over the cap, every payment is reduced “pro rata,” meaning by the same percentage. By our arithmetic, $300,000 covers 12,000 payments of $25, which is about 7.3% of the 163,440 people notified. If more of them file, each payment drops below $25. The final amount will not be known until claims close.

Credit monitoring for everyone. All class members are entitled to “two years of single bureau Credit Monitoring services” with $1,000,000 of identity theft insurance. The enrollment code came with the notice and starts working after final approval. You get the code even if you do nothing, but you get no cash unless you file a claim. This is separate from the 12 months of monitoring the hospital offered in its 2025 letters.

When the money arrives. No payment date has been set. The notice says payment comes “after the Settlement is approved by the Court and becomes final.” The final approval hearing is on January 27, 2027 at 1:30 p.m. ET at the Superior Court of Wayne County, 174 N. Brunswick Street, Jesup. Payments cannot start before that. Class counsel will ask for up to $525,000 in fees and costs, plus up to $2,500 for each of the seven named plaintiffs ($17,500 total). According to the notice, these amounts “will be paid by or on behalf of Defendant,” rather than out of the $300,000 cash pool.

File a claim by December 7, 2026. You can file online at WMHDataSettlement.com, or by mail with a claim form postmarked by that date. You need the “unique ID and Passcode provided in the Notice sent to you.” If you lost your notice, or never got one but think your data was involved, contact CPT Group at 1-888-716-0934 or WMHDataSettlement@cptgroup.com. You can also ask them to mail you a paper claim form.

Opt out or object by November 7, 2026. If you opt out, you keep the right to sue the hospital yourself, but you lose both the cash and the credit monitoring. To opt out, mail a signed request to Wayne Memorial Data Incident, c/o CPT Group, Inc., PO Box 19504, Irvine, CA 92623, postmarked by November 7. Objections must also be mailed by that date, to the clerk, class counsel, defense counsel and the administrator. This court asks for more than most: objectors must list their objections to other settlements over the past five years and say “whether the objector and/or the objector’s counsel used Artificial Intelligence (AI) to assist in drafting their objection.”

By our arithmetic, the court’s schedule sets the opt-out deadline 60 days and the claim deadline 90 days after the “Notice Date.” That puts the start of the mailing at about September 8, 2026. If you move after filing a claim, send your new address to the administrator by email or mail. Otherwise a check could go to your old address.

Is the notice real? Yes, as long as it points to WMHDataSettlement.com, the phone number 1-888-716-0934, the email address WMHDataSettlement@cptgroup.com or PO Box 19504 in Irvine, California. These are the administrator’s contact details on the official site. The long-form notice says you need your name, address, telephone number, email address (if applicable) and the unique ID and Passcode from your notice to file a claim. If a message points somewhere else, look up the official site yourself instead of using its links. The hospital’s own 2025 letters listed a different number, (833) 426-4616. That line was for questions about the breach, not about the settlement.

Which Wayne Memorial is this? The defendant is Wayne Memorial Hospital Auxiliary, Inc., the hospital in Jesup, Georgia, sued in the Superior Court of Wayne County, Georgia. In June 2024 the Monti ransomware group added Wayne Memorial Hospital to its leak site, but the listing noted it was “the Honesdale, Pennsylvania-based hospital,” according to SecurityWeek. The Jesup hospital is the one that published the notice in the Press Sentinel, sent the 2025 letters and is the defendant here.

Is Wayne Memorial Hospital part of the UNC? Not this one. The hospital in Goldsboro, North Carolina, is a different hospital. It was once called Wayne Memorial Hospital, and its name changed “when it entered into a management agreement with UNC Health in 2015”. It is now UNC Health Wayne. This settlement covers only the Georgia hospital’s 2024 incident.

What is a health information data breach? Here, it means an outsider reached files holding both identity data and medical data. The hospital lists names, dates of birth, Social Security numbers, driver’s license numbers, credit or debit card numbers with “expiration dates or CVV codes,” Medicare or Medicaid numbers, health insurance member numbers, “diagnoses, medical histories, treatment information, prescription information, and lab test results.” Not every category applies to every person. Your letter lists the data involved for you, and that list is what you should match against any fraud you document for Cash Payment A.

How did the Change Healthcare breach happen? That was a separate 2024 cyberattack on a national claims-processing company, and it has nothing to do with this case. This settlement pays nothing for it. Patients affected by Change Healthcare should look at the Change Healthcare FAQ page from the HHS Office for Civil Rights and any notice they received about that incident.

How this one compares. The settlement has the usual two parts: a no-proof payment and reimbursement for documented losses. What sets it apart is the small, fixed cap. With 163,440 people notified, a $300,000 pool for the no-proof payment means the advertised $25 is a ceiling that holds only if fewer than about 7% of class members claim it. For many class members, the two years of monitoring and the $1 million in insurance may be worth more than the cash. We will update this page when CPT Group or the court posts the claims count, the fee ruling or a payment date.