Sunflower Data Settlement: Payouts, Monitoring & Deadlines

If you got a notice that your information was exposed in the December 2024 Sunflower Medical Group data breach, the settlement offers you a choice of cash payment plus two years of medical identity monitoring, and you have until March 26, 2026 to file a claim. The Sunflower Medical Group data breach settlement in S.W., et al. v. Sunflower Medical Group, P.A. (Case No. 2516-CV22364) is capped at $1.2 million total and received preliminary approval from the Jackson County, Missouri, Circuit Court on October 27, 2025.1ClassAction.org. $1.2M Sunflower Medical Group Settlement Ends December 2024 Data Breach Lawsuit

Who Qualifies

You are a class member if you are a U.S. resident who received a notice that your personally identifiable information or protected health information was potentially exposed during the Sunflower Medical Group cybersecurity incident. Sunflower employees, officers, and directors are excluded unless they themselves received a breach notice. Government entities, the presiding judge and the judge’s family and staff, and anyone who validly opts out are also excluded.2Sunflower Settlement. Frequently Asked Questions

A filing with the Maine Attorney General put the total number of affected individuals at 220,968.3ClassAction.org. Sunflower Medical Group Data Breach Lawsuit

What You Can Claim

You pick one of two cash options, and either way you can also enroll in monitoring.

Cash: Documented Losses up to $5,000

Reimbursement covers documented, out-of-pocket losses tied to the breach, up to $5,000 per person. Eligible expenses include losses from identity theft or fraud, fees for credit reports or credit monitoring, the cost of replacing identification documents, and similar expenditures incurred between December 15, 2024 and March 26, 2026. You have to attach supporting documents such as bank statements, receipts, or invoices. Personal notes alone are not enough.2Sunflower Settlement. Frequently Asked Questions

Cash: A Flat $10

The alternative is a flat $10 payment with no proof or explanation required. You cannot take both; it is one option or the other. All cash payments come out of a shared $300,000 pool, and if valid claims exceed that pool, individual payments are reduced proportionally.4HIPAA Journal. Sunflower Medical Group Data Breach Lawsuit Documented-loss claims are paid first, and the flat payments may be adjusted up or down to keep the overall deal within its $1.2 million cap.5ClassAction.org. Sunflower Settlement Agreement

Two Years of Medical Identity Monitoring

Any class member who files a claim can also enroll in two years of CyEx Medical Shield Complete, regardless of the cash option chosen. The service monitors for healthcare insurance ID exposure, medical record number exposure, and unauthorized Health Savings Account spending, and it includes $1 million in medical identity theft insurance along with access to a fraud resolution agent.6ClassAction.org. Sunflower Settlement Notice

How to File

Claims must be submitted online or postmarked by March 26, 2026. You have three ways to file:

  • Online at SunflowerSettlement.com, using the Notice ID and PIN printed inside the postcard mailed to class members.
  • By mail: download and print the claim form from the settlement website, complete and sign it, attach any documentation, and mail it to Sunflower Data Breach Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958.
  • By email: scan or photograph the completed form and send it to info@SunflowerSettlement.com.

Simpluris is administering the settlement. Questions can go to the toll-free line at 1-833-417-4945, available around the clock, or to info@SunflowerSettlement.com.6ClassAction.org. Sunflower Settlement Notice

Key Dates

Benefits will only be paid if the court grants final approval and any appeals are resolved.8Sunflower Settlement. Frequently Asked Questions

What Happened in the Breach

An unauthorized third party accessed Sunflower Medical Group’s network on or around December 15, 2024. Sunflower did not detect the intrusion until January 7, 2025, when suspicious activity prompted it to bring in an outside cybersecurity firm. The investigation confirmed that files had been copied from Sunflower’s systems during the window of access.9Sunflower Medical Group. Data Security Incident

By February 24, 2025, Sunflower had determined that the stolen files contained patient information. Depending on the individual, the exposed data could include names, addresses, dates of birth, Social Security numbers, driver’s license numbers, medical information, and health insurance details.9Sunflower Medical Group. Data Security Incident Sunflower reported the breach to the U.S. Department of Health and Human Services Office for Civil Rights and to the Maine Attorney General, and offered complimentary credit monitoring to affected patients.10HIPAA Journal. Cyberattack on Sunflower Medical Group Affects 221,000 Patients

Sunflower Medical Group, which also operates as Heartland Primary Care, runs four clinics with onsite urgent care in Kansas City (Kansas), Lenexa, and Roeland Park.11Sunflower Medical Group. Sunflower Medical Group Organization