Susan B. Allen Hospital Data Breach Class Action Settlement

Data Breach · Claims Open

Current Status

Claims are open. Claim forms must be submitted online or by email, or postmarked if mailed, by November 12, 2026. The deadline to exclude yourself or object is earlier — October 13, 2026 — and that is the date that decides whether you are bound by the release. The court has scheduled a final approval hearing for December 7, 2026 at 9:00 a.m. Central Time, to be held by Zoom, and the settlement has not yet been approved. No payment date has been announced: the notice states that payments will be distributed only if the court grants final approval and after any appeals are resolved, and that it is not known whether appeals will be filed.

What Changed Recently?

The settlement is newly open to claims. Susan B. Allen Memorial Hospital has agreed to resolve In Re: Susan B. Allen Data Security Litigation, Case No. BU-2025-CV-000185, in the District Court of Butler County, Kansas, and the court has authorized notice to the class. Simpluris is administering the settlement.

The hospital denies that it did anything wrong, and the court has not decided who is right. Both sides agreed to settle to avoid the costs, risks, disruption and uncertainty of continued litigation. No finding of liability has been made against the hospital.

What the Case Is About

The lawsuit concerns a targeted cyberattack on the hospital's computer systems in July 2025. According to the notice, certain files containing private information were accessed during the incident, and those files may have contained names, dates of birth, health insurance information, billing information and medical treatment information.

That combination is what makes this a medical-identity exposure rather than an ordinary payment-card breach, and it is reflected in the monitoring product the settlement provides, which watches for misuse of insurance IDs and medical record numbers rather than just credit activity.

Who Qualifies?

The court defined the class simply: all persons who were sent written notification of the data incident.

That is an unusually clean definition — eligibility turns on whether the hospital sent you a notice, not on when you were a patient or what was exposed in your particular file. The notice also says the hospital's records indicate that recipients are class members entitled to benefits, and that some people may have received an earlier notice directly from the hospital before this court-authorized one.

Only two groups are excluded: the judge in the case along with the judge's family and staff, and anyone who perpetrated the data incident.

How Much Can You Get?

Every class member can claim the monitoring, and separately may claim one or both cash options — subject to a cap that is easy to miss.

• Two years of CyEx Medical Shield Complete. Available to every class member. It carries $1 million of medical identity theft insurance and monitors for healthcare insurance ID exposure, Medical Record Number exposure, and unauthorized Health Savings Account spending, with access to a fraud resolution agent if something turns up.
• Reimbursement for out-of-pocket losses — up to $100. For documented losses incurred between July 14, 2025 and November 12, 2026, covering things like identity theft or fraud losses, fees for credit reports, credit monitoring or credit freezes, the cost of replacing IDs, and postage to contact banks by mail.
• Reimbursement for attested time — up to $100. Up to four hours at $25.00 per hour for time spent responding to the incident, with a brief description of how the time was spent. No receipts.