$1M Community First Medical Center Settlement Ends Data Breach Lawsuit

New to ClassAction.org? Read our Newswire Disclaimer

Community First Medical Center will pay $1 million to settle a class action lawsuit over a July 2023 data breach that may have exposed its patients’ personal and medical data to unauthorized third parties.

Don’t miss out on class action settlement news like this. Sign up for ClassAction.org’s free weekly newsletter.

The Community First Medical Center (CFMC) class action settlement received preliminary approval from the court on December 3, 2025 and covers anyone whose personal information was potentially compromised in the CFMC data breach, including those who were notified of the incident by Community First Medical Center.

According to court documents, the CFMC settlement covers approximately 216,047 people nationwide.

The court-approved website for the Community First Medical Center settlement can be found at CFMCSettlement.com.

Community First Medical Center settlement class members who file a timely, valid claim form can receive identity theft protection services and credit and medical monitoring, the settlement website says. Class members can submit a claim form to receive either up to $5,000 in reimbursement for out-of-pocket losses related to the CFMC data breach or a pro-rata, or equal share, cash payment, which the court estimates will be approximately $40, from the remainder of the settlement fund.

Per the settlement site, the identity theft protection, credit monitoring and medical monitoring services will be valid for one year and include:

• Identity theft insurance of $1,000,000 with no deductible;
• Access to fraud resolution agents to help resolve identity theft;
• Medical record monitoring;
• Real-time monitoring of the class member’s credit file at all three major credit bureaus;
• Medical beneficiary identifier monitoring;
• Dark web monitoring;
• Health insurance plan number monitoring; and
• Health savings account monitoring.

Claims for reimbursement for out-of-pocket data breach-related losses must include reasonable documentation of each monetary loss. Additionally, reimbursable losses must have been incurred due to the data breach and have occurred between July 12, 2023 and April 2, 2026. The settlement website explains that such losses may include, but are not limited to:

• Credit monitoring or fraud resolution services purchased after the data breach;
• Unreimbursed fraud;
• Costs of credit reports;
• Long-distance telephone charges;
• Bank or other financial institution charges incurred as a result of the data breach;
• Cell phone minutes, if charged by the minute;
• Internet usage charges, if charged by the minute or incurred solely as a result of the data breach; and
• Other losses reasonably incurred as a result of the data incident.

No proof is required to submit a claim for a pro rata cash payout from the class action settlement, the website says. The cash payment cannot be claimed alongside the out-of-pocket loss reimbursement option, meaning class members may choose only one benefit to claim. However, the credit monitoring, medical monitoring and identity theft protection services may be claimed alongside either other monetary settlement benefit.

To submit a claim form online, CFMC settlement class members can visit this page of the settlement website and log in with the unique class member ID found in their copy of the settlement notice.

Alternatively, a PDF claim form is available to print, fill out and mail back to the address listed on the first page of the document.

Spanish-language versions of both the PDF claim form and the settlement notice are also available.

All settlement claim forms must be submitted online or postmarked by April 2, 2026.

A hearing is scheduled for March 25, 2026 to determine whether the CFMC settlement will receive final court approval. Settlement benefits will begin to be distributed only after final approval has been granted and any appeals have been resolved.

The CFMC class action lawsuit claimed that the healthcare provider failed to sufficiently protect its patients from a data breach on or around July 12, 2023 that allowed unauthorized third parties to access sensitive medical and personal information.

Did you know that some class action settlements require no proof to submit a claim? Check out the latest class action settlements.