The CR Data Incident Settlement is a $2.2 million class action settlement resolving claims against Consulting Radiologists, Ltd. over a February 2024 ransomware attack that exposed personal and medical information belonging to roughly 584,000 people. It received final court approval on February 25, 2026, and the claim deadline of March 2, 2026 has passed. Eligible class members who filed on time could claim up to $5,000 for documented losses, a cash payment of up to $125, and two years of identity monitoring.1CR Data Incident Settlement. Frequently Asked Questions
What the Breach Involved
Consulting Radiologists detected suspicious network activity on February 12, 2024. A forensic investigation confirmed on April 17, 2024 that an unauthorized actor had accessed servers holding patient data.2HIPAA Journal. Consulting Radiologists Data Breach Two ransomware groups, LockBit and Qilin, each claimed responsibility. Qilin claimed to have taken more than 70 gigabytes of data across roughly 94,667 files.3Defensorum. Consulting Radiologists Patients Affected by Cyberattack
CRL reported the breach to the U.S. Department of Health and Human Services on June 14, 2024, listing 583,824 affected individuals.4Statesman Journal (Data). Consulting Radiologists LTD Data Breach The exposed information included names, addresses, dates of birth, health insurance details, and medical information. About 19,346 patients had a broader set of data compromised, including Social Security numbers, driver’s license numbers, and imaging reports.5Minnesota Lawyer. Consulting Radiologists Data Breach Settlement CRL said at the time it had not found evidence of actual misuse of the stolen data.2HIPAA Journal. Consulting Radiologists Data Breach The consolidated litigation, In re Consulting Radiologists Data Incident Litigation, settled without any admission of liability by CRL.
What Class Members Could Claim
The $2.2 million fund covered all class member payments along with attorneys’ fees, administration, and service awards. It was a claims-made settlement, meaning only class members who submitted a valid claim received a benefit. Three benefits were available, and eligible people could choose one or combine them:1CR Data Incident Settlement. Frequently Asked Questions
- Reimbursement of up to $5,000 for documented out-of-pocket losses traceable to the breach, such as identity theft costs, unreimbursed bank fees, credit monitoring purchased before the settlement, and related travel. Supporting documentation was required for expenses incurred between February 1, 2024 and the date of the claim.
- A cash payment of up to $125 for Group 1 members, whose Social Security numbers were accessible in the breach, or up to $50 for Group 2 members, whose Social Security numbers were not involved. Both amounts were subject to pro rata reduction if valid claims exceeded the fund balance.
- Two years of CyEx Identity Defense Complete, which includes credit monitoring, dark web monitoring, high-risk transaction monitoring, and up to $1 million in identity theft insurance.6CyEx. Post-Breach Remediation
Attorneys’ fees and costs were capped at $660,000, and each of the 19 named class representatives received a $1,000 service award, for a total of $19,000. Administration and the cost of purchasing the credit monitoring service also came out of the fund before class member payments.7ClaimDepot. CR Data Settlement
Deadlines and Where Things Stand
The settlement class covered any U.S. resident whose private information was accessible during the April 2024 data incident. Class members received a notice with a unique ID and PIN and could file online at CRDataSettlement.com or by mail.8ClassAction.org. Consulting Radiologists Settlement Ends Litigation Over Data Breach The controlling dates were:
- January 30, 2026: deadline to opt out or object.
- February 25, 2026: final approval hearing, at which Judge Thomas Conley approved the settlement as “fair, reasonable, and adequate.” No class members objected, and 26 opted out.9Angeion Group (Settlement Administrator). Order Granting Motion for Final Approval of Class Action Settlement
- March 2, 2026: claim submission deadline.
All deadlines have passed. The final approval order directs the settlement administrator to distribute payments to class members who filed valid claims.9Angeion Group (Settlement Administrator). Order Granting Motion for Final Approval of Class Action Settlement Class members who opted out kept the right to pursue individual claims against CRL. Those who neither opted out nor filed a claim released their claims and will not receive a payment.