Group Health Cooperative of South Central Wisconsin Settles Data Breach Lawsuit for $3.5M
Non-profit health plan Group Health Cooperative of South Central Wisconsin decided to settle with its approximately 70,000 members a class action lawsuit associated with a cyberattack and data breach discovered in January 2024.
The HIPAA-covered company identified suspicious activity within its computer network, which the forensic investigation affirmed as unauthorized systems access. The file analysis confirmed the compromise of the protected health information (PHI) of over 533,000 present and past members along with their dependents during the attack. The breached data included names, phone numbers, birth dates, addresses, email addresses, member names, Medicaid/Medicare numbers, and Social Security numbers.
Because of the data breach, the group faced multiple lawsuits, which were consolidated since they had similar claims. The Pearson, et al. v. Group Health Cooperative of South Central Wisconsin lawsuit was registered in the Circuit Court of Dane County, Wisconsin, and stated claims of negligence, negligence per se, unjust enrichment, breach of implied contract, and breach of fiduciary duty. The defendant does not admit to any wrongdoing or liability and rejects all of the claims.
After taking into consideration the probable costs, time, and issues associated with continuing with the lawsuit, not to mention the risks connected to a trial and corresponding appeals, the defendant and the plaintiffs agreed to settle. The court already gave initial approval of the settlement. The defendant will create a $3,500,000 settlement fund to cover the class members’ benefits.
All class members are eligible to join a membership with CyEx health data monitoring product for three years, including one dark web scanning, credit monitoring, identity theft resolution, security freeze assistance, and an identity theft insurance coverage worth $1 million. Class members can submit claims to reimburse documented, unreimbursed expenses associated with the data breach up to $5,000.
Alternatively, class members may opt for a one-time cash payment. This will be paid pro rata using what is left of the settlement fund after paying lawyers’ fees and costs, service awards for the nine plaintiffs, settlement management and notification costs, medical monitoring expenses, and claims. Typically, the cash payments are roughly $100.
The last day to submit a claim is January 20, 2026. The schedule of the final fairness hearing is February 4, 2026. Individuals wanting to object to the settlement or exempt themselves can do so until January 5, 2026.