City of Hope Pays $8,500,000 to Resolve its Class Action Data Breach Lawsuit

By Daniel Lopez

City of Hope, a non-profit clinical research and cancer treatment center based in Duarte, California, decided to resolve a class action lawsuit associated with a 2023 data breach that impacted over 827,000 individuals. Attackers accessed the center’s network from September 2023 to October 2023 and extracted sensitive information.

City of Hope, a HIPAA-covered entity, faced multiple class action lawsuits in response to the data breach. Because of similar claims, the lawsuits were combined and filed In re City of Hope Data Security Breach Litigation at the Superior Court of the State of California for the County of Los Angeles. The lawsuit stated claims of negligence, invasion of privacy, breach of implied contract, and breach of fiduciary duty. City of Hope does not admit to any wrongdoing or liability. After mediation, all parties agreed in principle to resolve the lawsuit to avoid wasting time and costs, and to prevent risks and uncertainty linked to the ongoing lawsuit. The terms of the settlement negotiated by the parties had received preliminary approval by the court.

City of Hope will create an $8,500,000 settlement fund to pay the attorneys’ fees and expenditures, settlement management costs, service awards, and class member benefits. Class members are eligible to file claims amounting to as much as $5,000 to reimburse documented, unreimbursed losses reasonably linked to the data breach. These claims may include four hours of lost time valued at $25 per hour. Otherwise, class members could file a claim to get a cash payment with a tentative amount of $100. The cash payments are adjusted pro rata based on the outstanding funds after deducting payment for attorneys’ fees, expenditures, management costs, reimbursement claims, service awards, and credit monitoring expenses.

Whether a class member files a claim to reimburse documented losses or chooses the alternative cash payment, a code will be given to the class member to sign up for CyEx’s medical information and protection service. This membership provides medical fraud protection and single-bureau credit monitoring. Class members and California residents from September 19, 2023 to January 13, 2026 are eligible to claim an extra $250 cash payment, adjustable pro rata.

Those who want to object to or be ruled out from the settlement can do so on or before December 15, 2025. Class members can file claims until January 13, 2026. The schedule of the final approval hearing is February 20, 2026.

Image credit: sirisakboakaew, AdobeStock / logo©CityOfHope

Twitter Facebook LinkedIn Reddit Link copied to clipboard

Posted by

Daniel Lopez

Daniel Lopez is the HIPAA trainer behind HIPAA Coach and the HIPAA subject matter expert for NetSec.news. Daniel has over 10 years experience as a HIPAA coach. Daniel provides his HIPAA expertise on several publications including Healthcare IT Journal and The HIPAA Guide. Daniel has studied Health Information Management before focusing his career on HIPAA compliance and protecting patient privacy. You can follow Daniel on Twitter / X https://twitter.com/DanielLHIPAA