Retina Group Data Settlement: Claims and Payment Timing

The Retina Group of Washington data breach settlement is a $3.6 million class action resolution that received final court approval on July 21, 2025. It resolves claims arising from a March 2023 ransomware attack that exposed the personal and medical information of roughly 455,935 patients of the Maryland, Virginia, and D.C. ophthalmology practice. The claim-filing deadline was June 23, 2025, and has passed; no new claims are being accepted.¹²

What Happened in the Breach

Hackers hit the Retina Group of Washington (RGW) on or about March 26, 2023, encrypting files and stealing patient data. Patients were not notified until December 22, 2023, roughly nine months later, when RGW also reported the incident to the U.S. Department of Health and Human Services Office for Civil Rights.³

The stolen information covered nearly every category a medical practice holds: names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, driver’s license numbers, medical record numbers, health information, payment information, and health insurance details.⁴

Who Was Eligible

The settlement class covered U.S. residents who received a notice letter stating their information was potentially accessed in the March 2023 breach.⁵ If you never received a notice, you were not part of this class.

What Class Members Could Claim

The $3.6 million fund is non-reversionary, so unclaimed money does not go back to RGW. It pays class member awards, credit monitoring, administration, and attorneys’ fees of up to $1.2 million.⁴²

Claimants chose from four options:⁵

Up to $300 for documented ordinary out-of-pocket losses tied to the breach, such as bank fees, postage, or identity theft insurance, plus lost time of up to four hours at $25 per hour.
Up to $5,000 for documented extraordinary losses from actual identity theft or fraud linked to the breach.
An estimated $100 pro rata cash payment, with the final figure depending on total valid claims. Choosing this option meant giving up ordinary and extraordinary loss claims.
Twenty-four months of three-bureau credit and identity theft monitoring with $1 million in identity theft insurance, available to those who filed a losses claim rather than the pro rata cash option.

Lost-time claims required a written description and an attestation. Ordinary and extraordinary losses required supporting documentation like bank statements or receipts, and every claim form was signed under penalty of perjury.⁶

Approval and Payment Timing

The court preliminarily approved the settlement on February 18, 2025, and held an in-person fairness hearing on July 15, 2025. Two patients objected, arguing there was insufficient evidence RGW was negligent in protecting patient records. The court overruled those objections and issued final approval on July 21, 2025.¹⁵

Verita Global is the settlement administrator handling notice and claims processing. Payments to class members with valid claims are set to be distributed after final approval and the resolution of any appeals.⁷² If you filed a valid claim, expect the administrator to reach you using the contact information on your claim form. If you were a class member but did not file by June 23, 2025, you are no longer eligible for a payment under this settlement, and because final approval releases the claims, you cannot bring your own lawsuit over the same breach.

1
Bloomberg Law. Retina Group $3.6 Million Data Breach Settlement Gets Final Nod
2
ClaimDepot. Retina Group of Washington Data Breach Settlement
3
HIPAA Journal. Retina Group of Washington Data Breach
4
HIPAA Journal. Retina Group of Washington Data Breach Settlement
5
ClassAction.org. $3.6M Retina Group Settlement Ends Data Breach Lawsuit Over March 2023 Cyberattack
6
MediaContentPublish. RGW Data Incident Settlement Claim Form
7
Verita Global. Retina Group of Washington Data Breach Settlement