The Forefront Dermatology settlement is closed. The $3.75 million class action resolved claims from a 2021 ransomware attack that exposed personal and medical information for roughly 2.4 million patients and employees, and the deadline to file a claim was February 8, 2023. The court held its final approval hearing on March 1, 2023. You can no longer submit a claim, opt out, or object, but if your information was part of the breach there are still steps worth taking to protect yourself.
What the Settlement Covered
Between May 28 and June 4, 2021, an unauthorized party accessed Forefront Dermatology’s network. The Wisconsin-based practice discovered the intrusion on June 4 and took its systems offline. A forensic investigation confirmed that attackers had accessed files containing sensitive information for up to 2,413,553 patients and employees across the company’s nationwide locations.
The exposed data included names, dates of birth, home addresses, patient account numbers, dates of service, provider names, medical treatment details, and medical record numbers. That combination is particularly damaging in a healthcare breach because medical information can be used for insurance fraud and is far harder to change than a credit card number.
Three plaintiffs filed a class action in the U.S. District Court for the Eastern District of Wisconsin, alleging that Forefront Dermatology failed to implement reasonable security measures. The company denied wrongdoing and did not admit liability, agreeing to a $3.75 million settlement fund to resolve the claims.
The class included all U.S. residents whose personal information was potentially compromised in the May–June 2021 breach, both patients and employees. Most class members received a notification letter from Forefront Dermatology with a unique Settlement Claim ID. People who believed they were affected but never received a letter could still file with documentation showing their information was involved.
What Claimants Could Get
The settlement offered three categories of benefits. All claim deadlines have passed.
- Reimbursement for documented out-of-pocket losses up to $10,000, covering things like unauthorized charges, bank fees, and credit repair costs tied to the breach. Claims required receipts, bank statements, or similar documentation.
- Lost time up to $125, calculated at five hours at $25 per hour, for activities like monitoring credit, contacting financial institutions, and placing fraud alerts.
- Two years of credit monitoring with up to $1 million in identity theft insurance. For anyone who enrolled at the claim deadline in early 2023, that coverage has now expired.
Class members who did not claim reimbursement or credit monitoring were eligible instead for a residual cash payment from whatever remained in the $3.75 million fund after other claims and costs were paid. With more than 2.4 million potential claimants, the individual residual payment was likely modest.
The opt-out deadline was January 24, 2023. Because that date has passed, anyone who was in the class and did not exclude themselves is bound by the settlement’s release of claims against Forefront Dermatology tied to the breach.
If You Filed a Claim and Haven’t Been Paid
If you submitted a timely claim and have not received payment or a status update, contact the settlement administrator through the case website. You can also reach out to the court clerk’s office for the Eastern District of Wisconsin for docket information.
How to Protect Yourself Now
The underlying risk from this breach has not gone away. Data stolen in 2021 can surface in fraud schemes years later, and medical information in particular has a long shelf life.
Place a credit freeze with all three major credit bureaus. A freeze blocks new accounts from being opened in your name, is free to place and lift, and does not affect your credit score. You have to contact Equifax, Experian, and TransUnion separately because each bureau maintains its own freeze.1Federal Trade Commission. Get a Credit Freeze to Stop Identity Thieves
Review your medical records and your insurance explanation-of-benefits statements for services you did not receive. Medical identity theft, where someone uses your information to obtain treatment or file insurance claims, can leave incorrect entries in your record that affect future diagnoses and treatment if they go unnoticed.
If your settlement credit monitoring has expired, you can sign up for a free monitoring service or set reminders to pull your credit reports on your own. Federal law entitles you to a free report from each bureau every year through AnnualCreditReport.com. Regular check-ins are the simplest way to catch suspicious activity while there is still time to fix it.