$2.35M Cornerstone Specialty Hospitals Settlement Ends Class Action Lawsuit Over December 2023 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Cornerstone Healthcare Group Management Services has agreed to a $2,350,000 settlement to resolve a class action lawsuit that alleged the multi-state healthcare group, operating as Cornerstone Specialty Hospitals, did not properly safeguard the confidential patient information in its care from a December 2023 cyberattack.

Get class action lawsuit and class action settlement news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter.

The Cornerstone Specialty Hospitals class action settlement received preliminary approval from the court on January 8, 2026 and covers all individuals whose private information was compromised as a result of the December 2023 data breach and who were sent notice from the healthcare group.

According to court documents, approximately 483,000 class members are covered by the Cornerstone settlement, including a subclass of approximately 74,959 individuals whose Social Security numbers (SSNs) were potentially compromised in the breach.

The court-approved website for the Cornerstone Specialty Hospitals data breach settlement can be found at CSHealthcareSettlement.com.

According to the website, Cornerstone settlement class members who file a valid, timely claim form have multiple options for reimbursement.

Class members who submit with their claim form documented proof of out-of-pocket losses stemming from the breach are eligible to receive up to $2,500 in reimbursement for ordinary losses, such as expenses related to credit monitoring, unreimbursed bank fees and other miscellaneous charges such as travel and postage.

Class members with documented losses associated with a SSN compromised during the breach may file a claim form to receive up to $10,000 in reimbursement for extraordinary losses, which covers losses related to identity theft, fraud, falsified tax returns or other misuse of private information.

The settlement agreement outlines that claims for documented ordinary and extraordinary losses must include third-party documentation that proves actual monetary losses traceable to the breach that have not already been reimbursed by another source.

In lieu of either documented-loss payment, Cornerstone class members may instead file a claim to receive a one-time, pro-rated cash payment from the net settlement fund after the payment of attorneys’ fees, settlement administration costs, lead plaintiff service awards and the cost of all other settlement benefits.

Per the settlement site, the value of each class member’s pro rata (equal share) cash payment will be determined based on whether they are a member of the SSN subclass. Specifically, it states that payments made to SSN settlement subclass members will be three times the amount to be paid to class members whose SSNs were not compromised in the breach.

Finally, in addition to any monetary benefits, individuals in the SSN subclass may also file a claim form to receive an enrollment code for two free years of three-bureau credit monitoring, which includes identity fraud protection, the agreement adds.

To file a Cornerstone settlement claim form online, class members can head to this page and select if they do or do not have the settlement claim ID found on their received copy of the settlement notice to proceed. Alternatively, class members may download a PDF of the claim form from the settlement site to print, fill out and return to the settlement administrator at the address listed at the bottom of the document.  

All Cornerstone data breach settlement claim forms must be submitted online or by mail by May 8, 2026.

The court will determine whether to grant final approval to the Cornerstone Specialty Hospitals settlement following a hearing on May 14, 2026. Compensation will begin to be distributed to class members only after final approval has been granted and any appeals have been resolved.

The Cornerstone Healthcare Group class action lawsuit alleged that the acute-care hospital group, which operates in Arizona, Arkansas, Louisiana, Oklahoma, Texas and West Virginia, failed to implement reasonable cybersecurity measures to protect the sensitive patient information stored on its systems, leading to a data breach on or around December 19, 2023. Per court documents, private information that may have been compromised during the breach included names, dates of birth, addresses, driver’s license and government-issued ID numbers, financial information, medical information, insurance information and, for some consumers, Social Security numbers.

Check out ClassAction.org’s free legal resources to learn how to file a class action lawsuit.