Community First Medical Center Lawsuit: $1M Breach Settlement

Patients of Chicago’s Community First Medical Center whose information was exposed in the July 2023 data breach can claim a share of a proposed $1 million class action settlement in Pacheco v. Community First Healthcare of Illinois. The Cook County Circuit Court granted preliminary approval on December 3, 2025, and claims must be submitted by April 2, 2026.¹ Final approval was still pending as of early 2026, and no payments will go out until the court signs off and any appeals are resolved.²

What You Can Get

Class members choose one of two cash options. The first is reimbursement of up to $5,000 for documented, unreimbursed out-of-pocket losses tied to the breach, such as fraud losses, bank fees, credit monitoring you bought after the incident, and credit report costs. Eligible expenses must have been incurred between July 12, 2023, and the close of the claims period.²

The second is an alternative cash payment: a pro rata share of the remaining fund, estimated at roughly $40 per person, with no proof of loss required.¹

Whichever option you pick, you can also enroll in one year of three-bureau credit and medical monitoring with identity theft protection. The package includes $1 million in identity theft insurance with no deductible, dark web monitoring, medical record and health insurance plan monitoring, and access to fraud resolution agents.²

The $1 million fund is non-reversionary, meaning nothing goes back to the hospital. Before class payments, the court will deduct notice and administration costs, taxes, requested service awards of $1,000 for each of the 15 class representatives, and attorneys’ fees that class counsel asked not to exceed $333,333.33 plus expenses.²

Who Qualifies

The class covers everyone whose personally identifiable information or protected health information was potentially compromised in the July 12, 2023, breach at Community First Medical Center, including anyone who received a breach notification letter from the hospital.³ The class is nationwide, with no geographic restriction.⁴ The breach affected 216,047 patients in all.⁵

How to File a Claim

Claims can be filed online at www.CFMCsettlement.com or mailed to Kroll Settlement Administration, PO Box 5324, New York, NY 10150-5324. The deadline is April 2, 2026.³

If you are claiming out-of-pocket losses, include documentation such as receipts, bank statements, or similar records showing the expense and its connection to the breach. If you are taking the alternative cash payment, no supporting documents are needed beyond the claim form.² Questions can go to the administrator at (833) 754-8355.

Key Dates and Approval Status

The objection and exclusion deadline was March 3, 2026, and has passed. The final fairness hearing, originally set for March 25, 2026, was continued to April 9, 2026, at 10:00 a.m. in the Circuit Court of Cook County before Judge Alison C. Conlon.³ No specific objections have been publicly reported. Payments will not be distributed until final approval is entered and any appeals are resolved.²

What the Breach Involved

On July 12, 2023, an unauthorized third party accessed computer systems at Community First Medical Center. A forensic investigation concluded on July 28, 2023, that files containing protected health information had been accessed.⁶

Exposed information varied by person but could include full names, telephone numbers, email addresses, Social Security numbers, medical record numbers, and Medicare numbers. The hospital began mailing notification letters on September 26, 2023, and said it was not aware of any actual misuse of patient information. It offered credit monitoring to individuals whose Social Security numbers were involved.⁵ The specific attack method and the identity of the attacker have not been publicly disclosed.

The Allegations and the Hospital’s Response

Fifteen separate class actions filed after the breach were consolidated before Judge Conlon in the Chancery Division of the Cook County Circuit Court, beginning around November 16, 2023.⁷ Plaintiffs alleged the hospital failed to adequately protect patient data and brought claims for negligence, negligence per se, breach of fiduciary duty, breach of contract, breach of implied contract, unjust enrichment, and violations of the Illinois Consumer Fraud and Deceptive Business Practices Act.⁸

Community First Medical Center has denied all allegations of wrongdoing and liability. As part of the settlement, the hospital agreed to implement enhanced data security measures, including mandatory annual cybersecurity training for staff, a written password policy, and annual reviews of its data security policies.7

1
ClassAction.org. $1M Community First Medical Center Settlement Ends Data Breach Lawsuit
2
ClassAction.org. Pacheco v. Community First Healthcare Class Notice
3
CFMC Settlement. Pacheco v. CFMC Settlement Website
4
Top Class Actions. $1M Community First Medical Center Data Breach Class Action Settlement
5
HIPAA Journal. Community First Medical Center Data Breach
6
Community First Medical Center. Data Security Incident
7
ClassAction.org. Pacheco v. Community First Healthcare Settlement Agreement
8
ClassAction.org. Pacheco v. Community First Healthcare Class Notice