Harvard Pilgrim Data Incident Settlement: Eligibility and Payouts

The Harvard Pilgrim data incident settlement is a $16 million class action resolution that pays people whose personal and medical information was exposed in the 2023 ransomware attack on Harvard Pilgrim Health Care and its parent Point32Health. Eligible class members can pick one of three tracks: a flat cash payment of roughly $150, reimbursement of documented losses up to $2,500 (or up to $35,000 for identity theft traceable to the breach), or three years of free credit monitoring. Claims must be filed online or postmarked by August 25, 2025.¹

Who Qualifies as a Class Member

Anyone living in the United States whose personal information was affected by the breach is a class member, including everyone who received a notification letter from Harvard Pilgrim.² The affected population reached roughly 2,967,396 people after Harvard Pilgrim’s final update on August 15, 2024, and includes current and former subscribers, their dependents, and contracted healthcare providers.³

The data exposed included names, addresses, phone numbers, dates of birth, Social Security numbers, health insurance account details, provider taxpayer identification numbers, and clinical information such as medical histories, diagnoses, and treatment records.⁴

What You Can Claim

The $16 million fund is non-reversionary, meaning it all goes to class benefits, administration, service awards, and attorney fees rather than back to the defendants.⁵ Class members can claim one or more of the benefits below, up to a combined $35,000 maximum per person.²

Flat Cash Payment

An alternative cash payment of $150 is available to class members who do not file for out-of-pocket losses or attested time. It is the simplest option because no documentation is required.²

Out-of-Pocket Losses and Time

You can claim up to $2,500 for documented, unreimbursed expenses caused by the breach, such as credit report fees, notary charges, postage, and other mitigation costs. Receipts or third-party documentation are required; self-prepared documents alone do not qualify. You can also claim up to seven hours of time spent addressing the breach at $30 per hour, and that time counts toward the same $2,500 cap.²

Extraordinary Losses from Identity Theft

If you suffered actual identity theft or fraud traceable to the breach, you can claim up to $35,000 for unreimbursed losses, plus up to 20 additional hours of time at $30 per hour. Documentation is required.²

Three Years of Credit Monitoring

Every class member can claim three years of credit monitoring through Equifax, Experian, and TransUnion. It includes dark web scanning, real-time alerts, and up to $1 million in identity theft insurance. You can take this benefit whether or not you file any cash claim.²

Why Your Final Payment May Differ

Cash amounts are paid on a pro rata basis from the fixed fund. If many people file valid claims, individual payouts shrink below the listed figures; if few file, payouts may be larger. That applies to the $150 flat payment as well as to reimbursement amounts.⁶

How to File Your Claim

File online at HarvardPilgrimDataIncidentSettlement.com or mail a paper claim form to the settlement administrator. Whichever route you take, the claim must be submitted or postmarked by August 25, 2025.¹ The opt-out and objection deadline was June 27, 2025, so if you did nothing by that date you remain in the class and are bound by the release.²

For help, the settlement administrator, Simpluris, can be reached at 1-833-296-0892 (available around the clock) or by email at info@HarvardPilgrimDataIncidentSettlement.com. There is no cost to file or to ask for help. Do not contact the court or the clerk of court about the settlement.²

What the Settlement Resolves

The lawsuit, In Re Harvard Pilgrim Data Security Incident Litigation (Case No. 1:23-cv-11211, U.S. District Court for the District of Massachusetts), stems from a ransomware intrusion Point32Health detected on April 17, 2023. Forensic investigators found that attackers had access to Harvard Pilgrim’s network from March 28 through April 17, 2023, and copied a large volume of data before encrypting files.⁴

The consolidated complaint alleged that Harvard Pilgrim and Point32Health failed to implement basic security measures to protect protected health information, bringing claims for negligence, breach of implied contract, breach of fiduciary duty, invasion of privacy, unjust enrichment, and violations of state consumer protection laws.⁷ Harvard Pilgrim and Point32Health denied all allegations of wrongdoing. The parties reached the $16 million agreement after a full-day mediation.⁸

Class counsel are John A. Yanchunis of Morgan & Morgan and James J. Pizzirusso of Hausfeld LLP. Their fee request is capped at $3,331,000 plus $50,000 in costs, and each named plaintiff may receive a $2,000 service award, all paid from the $16 million fund.²

Approval Status and When Payments Arrive

The court granted preliminary approval on April 4, 2025, and held the final fairness hearing on July 28, 2025. Final approval was granted on August 4, 2025, and the settlement administrator began distributing payments to approved claimants on approximately December 3, 2025.¹ If you have not filed yet and the August 25, 2025 deadline has passed, you can no longer submit a claim under this settlement.

1
Harvard Pilgrim Data Incident Settlement. Important Dates
2
Harvard Pilgrim Data Incident Settlement. Frequently Asked Questions
3
HIPAA Journal. Harvard Pilgrim Health Care Increases Ransomware Attack Total
4
Mass.gov. Harvard Pilgrim Health Care Provides Statement Regarding Privacy Incident
5
ClassAction.org. Settlement Agreement
6
Harvard Pilgrim Data Incident Settlement. Settlement Home Page
7
ClassAction.org. Memo in Support of Motion for Preliminary Approval
8
HIPAA Journal. Harvard Pilgrim Health Care Data Breach Settlement