Upstream Data Settlement: $4.3M Payout, Eligibility, Deadlines

The Upstream Rehabilitation data breach settlement is a $4.3 million class action resolution over a 2023 cyberattack that exposed patient names, medical details, and in some cases Social Security numbers. The claim filing deadline was January 30, 2025, so the window to submit a new claim has closed.¹ Payments remain contingent on final court approval and any appeals.²

Who Was Covered

The settlement class included anyone in the United States whose personal information was exposed during the January and February 2023 breach at Upstream Rehabilitation.² These were patients whose data sat in the compromised employee email accounts. Upstream identified affected individuals during a data review that ended July 28, 2023, and mailed notification letters on September 15, 2023.³ If you received one of those letters, you were in the class.

The case was consolidated as Jeremy Hufstetler, et al. v. Upstream Rehabilitation Inc., et al. (Case No. 01-CV-2024-902563.00) in the Circuit Court of Jefferson County, Alabama.¹

Eligible people could choose from three benefits, with a combined cap of $5,000 per person.¹

A pro rata cash payment funded by an equal share of the net settlement fund. No documentation was required, and class counsel estimated payments would exceed $50, though the final figure depends on how many valid claims were filed.¹
Reimbursement of up to $5,000 for documented out-of-pocket losses tied to the breach, including fraud charges, credit repair fees, and credit-freeze costs. Receipts or similar proof were required.¹
Three years of financial account and credit monitoring at no cost, an upgrade from the one year originally offered by Upstream in its notification letters.²

The total fund was $4,304,898.50, and payments would come from what remained after attorneys’ fees, litigation expenses, and service awards to the named plaintiffs.⁴

Unauthorized parties accessed employee email accounts at Upstream RollCo LLC during two windows in early 2023: January 24 through January 31, and February 3 through February 9.⁷ The exposed information included names, dates of birth, diagnoses, medical record and patient account numbers, treatment data, health insurance subscriber numbers, and in some cases Social Security numbers.⁸

Notification letters went out about eight months after the breach was first detected, a delay the plaintiffs argued gave bad actors months to misuse the stolen information before patients could protect themselves.⁸ Upstream initially offered recipients 12 or 24 months of credit monitoring through IDX, with a December 15, 2023 enrollment deadline.³ The settlement replaced that with the three-year monitoring benefit for claimants.