$16M Harvard Pilgrim Settlement Resolves Data Breach Class Action Lawsuit [UPDATE]

New to ClassAction.org? Read our Newswire Disclaimer

Harvard Pilgrim Health Care, Inc. and parent company Point32Health, Inc. have agreed to pay a $16 million settlement that, if approved by the court, will resolve a proposed class action lawsuit over a 2023 ransomware attack.

Don’t miss the next class action settlement deadline. Sign up for ClassAction.org’s free weekly newsletter.

The proposed class action settlement will cover 2,967,396 United States residents whose personal information was impacted by the Harvard Pilgrim data security incident—including all individuals who were notified of the data breach.

According to the initial Harvard Pilgrim lawsuit, unauthorized actors accessed Harvard Pilgrim’s computer systems between March 28 and April 17, 2023. The defendant’s online notice states that the intrusion compromised the private data of current and former health plan members and consumers whose providers contracted with Harvard Pilgrim.

The case claimed that Harvard Pilgrim knew its electronic record-keeping systems were a prime target for hackers yet failed to use basic cybersecurity measures to protect the sensitive information within its custody.

The plaintiffs filed a motion detailing the terms of the agreement with Harvard Pilgrim on February 26, 2025. It is now up to the court to determine whether to grant preliminary approval to the data breach settlement agreement

If the $16 million settlement is preliminarily approved, class members who submit a timely, valid claim form by mail or online through the settlement website will be eligible to receive benefits.

ClassAction.org will update this page when the official Harvard Pilgrim settlement website is launched.

Per the settlement agreement, class members who file a valid claim form may be entitled to receive up to $2,500 for documented, out-of-pocket expenses incurred as a result of the Harvard Pilgrim data breach.

Covered individuals may also submit a claim form to get back $30 for each hour they spent responding to the breach, with a cap of seven hours.

Class members who suffered identity theft, fraud or other such “extraordinary” losses as a result of the Harvard Pilgrim data breach may submit a claim for reimbursement of up to $35,000.

“Extraordinary Losses may include, without limitation, any unreimbursed costs, losses, or expenditures incurred as a result of identity theft, fraud, falsified tax returns, real estate title fraud, financial fraud, government benefits fraud, or other misuse of the Settlement Class Member’s Personal Information,” the settlement agreement says.

In lieu of filing a claim for out-of-pocket losses or lost time, class members can elect to receive a cash payment. Cash payments are estimated to be around $150 per person but may increase or decrease depending on how many valid claims are submitted, court documents share.

Finally, class members may elect to enroll in three years of identity theft protection and credit monitoring services.

Looking for current class action lawsuits to join? Check out ClassAction.org’s class action lawsuit list.