PRL Data Breach Settlement: $1.5M Payout, Claims, and Deadlines

The PRL data breach settlement is a $1.5 million class action resolution that Practice Resources, LLC agreed to over the April 12, 2022 ransomware attack that affected 942,138 people whose information was handled by the Syracuse-based medical billing company.¹ Judge Lawrence E. Kahn granted final approval on June 11, 2025, finding the deal “fair, reasonable, and adequate” under Federal Rule of Civil Procedure 23(e).² The deadline to file a claim was April 25, 2025, and has passed.³

Who the Settlement Covered

The settlement class included everyone whose private information was compromised in the April 2022 PRL breach, generally the people who received a notification letter from PRL around August 2022.⁴ PRL handled billing for at least 28 Central New York healthcare providers, including Crouse Health Hospital, Community Memorial Hospital, St. Joseph’s Medical, Family Care Medical Group, Syracuse Pediatrics, and Laboratory Alliance of Central New York.⁵

The information potentially accessed included names, home addresses, dates of treatment, health plan numbers, and medical record numbers. PRL stated that Social Security numbers, credit card numbers, and detailed medical information were not exposed, and that there was no evidence data was actually stolen. The company denied wrongdoing throughout the litigation.⁶

What Class Members Could Claim

Class members who filed a valid claim by April 25, 2025 could choose from three benefit categories:

Reimbursement of up to $5,000 for documented out-of-pocket losses incurred on or after April 12, 2022, that were more likely than not traceable to the breach, supported by documentation such as bank statements or receipts.⁴
Up to three years of credit monitoring and identity theft insurance through CyEx, LLC, with activation codes emailed after the settlement becomes effective. Coverage could be delayed up to 12 months for people who already had similar services.⁷
A pro-rata cash payment from any money left in the fund after documented-loss claims and credit monitoring costs were covered.⁴

All payouts and the length of credit monitoring were subject to pro-rata reduction so that total distributions would not exceed the $1.5 million fund.⁴⁸⁶

Key Deadlines and Payment Timing

The court granted preliminary approval on September 23, 2024. The opt-out and objection deadline was March 25, 2025, and the claim deadline was April 25, 2025.⁴³ Claims could be filed online at PRLDataBreachSettlement.com or by mail to the PRT9 Settlement Administrator in Los Angeles.⁷

After the June 11, 2025 final approval, distribution of settlement benefits was made contingent on the resolution of any appeals. As of the most recent available reporting, no appeals had been publicly disclosed, but payments and credit monitoring activation may still take additional time to reach class members.⁴

The Underlying Case

The lawsuits filed against PRL were consolidated as In re Practice Resources, LLC Data Security Breach Litigation, Case No. 6:22-cv-00890-LEK-DJS, in the U.S. District Court for the Northern District of New York. The plaintiffs alleged that PRL was negligent in failing to protect their personal information and criticized the company’s original 12-month credit monitoring offer as inadequate, arguing that identity theft tied to a data breach can surface years later.⁹ The incident was also under investigation by the New York State Attorney General’s office.⁵

1
CS Hub. Almost One Million People Affected by Medical Billing Ransomware Attack
2
Almeida Law Group. Final Approval of Class Action Settlement Granted in In Re Practice Resources, LLC Data Security Breach Litigation
3
PRT9 Settlement Administrator. PRT9 Settlement Notice
4
ClassAction.org. $1.5M Practice Resources Settlement Resolves Data Breach Lawsuit Over April 2022 Hack
5
Syracuse.com. Hackers May Have Breached Medical Billing Records of Nearly 1 Million CNY Patients
6
HIPAA Journal. Practice Resources Class Action Data Breach Settlement
7
PRT9 Settlement Administrator. PRT9 Settlement Claim Form
8
Bloomberg Law. Practice Resources Agrees to $1.5 Million Data Breach Settlement
9
ClassAction.org. In Re Practice Resources, LLC Data Security Breach Litigation — Consolidated Complaint