Wayne Memorial Hospital Settlement: $25 or Up to $5,000, Claim by December 7, 2026
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
This is the Wayne Memorial Hospital in Jesup, Georgia, and the 2024 ransomware attack on its network. The consolidated Wayne Memorial Hospital lawsuit, Bates v. Wayne Memorial Hospital Auxiliary, Inc., has settled. Claims are open until December 7, 2026: an estimated $25 with no proof, or up to $5,000 for documented losses. Nothing has been paid yet, and the court decides on final approval at a hearing on January 27, 2027.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What the Wayne Memorial Hospital Class Action Is About
Wayne Memorial Hospital is a rural 84-bed hospital in Jesup, Georgia. In its notice to patients, the hospital said it detected a ransomware event on June 3, 2024: an unauthorized party got into its network, encrypted some data and left a ransom note. The forensic review found access between May 30 and June 3, 2024. HIPAA Journal reported that the ransom was not paid and files were restored from backups.
The slow part was telling people. The hospital first announced the incident on August 2, 2024 and initially reported it to federal regulators as affecting up to 2,500 individuals. Individual letters went out on or around August 27, 2025 — and reports put the total at 163,440 people.
The letters list names with some or all of: date of birth, Social Security number, driver’s license number, card numbers with expiration date or CVV code, Medicare or Medicaid number, health insurance member number, diagnoses, medical history, prescriptions and lab results. The Wayne Memorial Hospital class action alleges negligence, breach of implied contract and unjust enrichment. The hospital denies all wrongdoing and admits nothing by settling.
Case Details
The case is Bates, et al. v. Wayne Memorial Hospital Auxiliary, Inc. d/b/a Wayne Memorial Hospital, Case No. SUCV2025000239, in the Superior Court of Wayne County, Georgia — a state court, not a federal one. Several suits were filed after the letters went out and were consolidated. The parties settled after mediation in May 2026, and the court granted preliminary approval on August 19, 2026, according to ClassAction.org. The settlement administrator is CPT Group, Inc. The official website is WMHDataSettlement.com.
Status: Settled, Claims Open Until December 7, 2026
Claim deadline: December 7, 2026 (online, or by mail postmarked by that date).
Opt-out and objection deadline: November 7, 2026 (postmarked).
Final approval hearing: January 27, 2027 at 1:30 p.m. ET, Superior Court of Wayne County.
Payments go out only after the court grants final approval and the settlement becomes final. That includes any appeals, so no payment date exists yet.
Don't miss the claim deadline
Claims are due by December 7, 2026. We'll email you 7 days and 1 day before the deadline.
Who Is in the Wayne Memorial Hospital Settlement
You are in the settlement class if your private information was accessible because of the incident discovered on or around June 3, 2024. If you got a breach letter from the hospital, the notice says you are included. Excluded: the hospital’s directors and officers, government entities, the judge and court staff, and anyone who opts out.
The practical test is your settlement notice. It carries a unique ID and passcode. You need them to file online, and the notice also includes your credit-monitoring enrollment code. Lost it? Contact CPT Group at 1-888-716-0934 or WMHDataSettlement@cptgroup.com.
This case covers only the Wayne Memorial Hospital in Jesup, Georgia. Hospitals elsewhere with similar names are not part of it.
What the Settlement Pays
Cash Payment A — documented losses: up to $5,000 per person for unreimbursed losses from fraud or identity theft that were more likely than not caused by the breach. You need documentation; a signed statement alone does not count. Top Class Actions lists bank statements, credit card statements, IRS letters and police reports as examples.
Cash Payment B — flat cash: an estimated $25, with no proof required. All Option B payments together are capped at $300,000. If claims exceed that, each payment shrinks pro rata.
Credit monitoring for everyone: two years of single-bureau monitoring with $1,000,000 of identity theft insurance. It starts after final approval, and you do not need a claim form for it.
The total settlement amount has not been published. Separately, class counsel may ask for up to $525,000 in fees and costs, plus up to $2,500 for each of the seven named plaintiffs. The hospital pays those amounts, so they do not come out of your $25.
Wayne Memorial Hospital Breach and Settlement Timeline
- 1
May 30 – June 3, 2024 — The Intrusion
An unauthorized party is inside the hospital’s network. On June 3 the hospital detects ransomware and takes systems offline.
- 2
August 2, 2024 — First Public Notice
The hospital announces the incident. The first figure reported to federal regulators is up to 2,500 people.
- 3
August 27, 2025 — Letters Go Out
Individual notices start mailing, about fifteen months after the attack. Reports put the total at 163,440 people. Lawsuits follow and are consolidated in Wayne County Superior Court.
- 4
August 19, 2026 — Preliminary Approval
After May 2026 mediation, the court preliminarily approves the settlement in Bates (Case No. SUCV2025000239). CPT Group announces it on September 8, 2026.
- 5
November 7 and December 7, 2026 — Deadlines
Opt-outs and objections must be postmarked by November 7, 2026. Claim forms must be submitted online or postmarked by December 7, 2026.
- 6
January 27, 2027 — Final Approval Hearing
The court decides whether to give final approval. Payments come only after approval becomes final.
Three Things to Watch For
The leaked data includes card numbers and Medicare numbers, and that makes this class an easy target:
Look-alike claim sites
The only official site is WMHDataSettlement.com, run by CPT Group in Irvine, California. Filing is free and only needs your notice ID and passcode. No real claim form asks for your full Social Security number, bank PIN or card CVV.
Calls “from the hospital” about your settlement
Medicare and health insurance numbers were in the files, so a caller may sound convincing. CPT Group does not charge a fee to release your $25. If you are unsure, hang up and call 1-888-716-0934 yourself.
Fake credit-monitoring enrollment
Your enrollment code comes printed on the official notice and only activates after final approval. Be careful with emails pushing you to “activate now” through a link and enter card details. Monitoring under this settlement costs nothing.
Wayne Memorial Hospital Settlement — Questions People Actually Ask
Is the Wayne Memorial Hospital settlement real?
Yes. It is Bates v. Wayne Memorial Hospital Auxiliary, Inc., Case No. SUCV2025000239, in the Superior Court of Wayne County, Georgia. The court-authorized administrator is CPT Group, Inc., and the official site is WMHDataSettlement.com.
How much will I get?
An estimated $25 with no proof, or up to $5,000 if you document losses from fraud or identity theft. You cannot get both. The $25 may be reduced pro rata if Option B claims exceed the $300,000 cap. Everyone can also get two years of credit monitoring.
What is the deadline?
Claim forms are due December 7, 2026, either online or by mail postmarked by that date. Requests to opt out or object must be postmarked by November 7, 2026.
When will payments arrive?
There is no payment date yet. The final approval hearing is January 27, 2027. CPT Group pays only after the court approves the settlement and it becomes final, including any appeals.
Do I need proof?
Not for the $25 option. For the documented-loss option you do: records showing an unreimbursed loss from fraud or identity theft that was more likely than not caused by the breach. A personal statement alone is not enough.
What if I do nothing?
Under the official notice, you stay in the class, get a credit-monitoring code and give up the right to sue over the breach, but you get no cash. A CPT Group press release words this differently. The court-approved notice is what counts.
I lost my notice. How do I file?
Online filing needs the unique ID and passcode from your notice. Contact CPT Group at 1-888-716-0934 or WMHDataSettlement@cptgroup.com, or write to Wayne Memorial Data Incident, c/o CPT Group, Inc., PO Box 19504, Irvine, CA 92623.
Is the monitoring the hospital offered in 2025 the same thing?
No. The breach letter offered 12 months of CyberScout monitoring, with enrollment due within 90 days of receiving it. The settlement adds its own two years of single-bureau monitoring, which starts after final approval.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Every settlement still taking claims, with deadlines
Data Breach Settlement Calculator
Estimate a payout from documented losses and flat cash options
Settlement Payout Calculator
How pro rata cuts change a $25 estimate
HealthEC Data Breach Settlement
Another healthcare breach settlement with a claims process