Brevard Skin and Cancer Center Reaches Proposed Settlement Over 2025 Data Breach
Brevard Skin and Cancer Center has consented to a proposed class action settlement in relation to a September 2025 cyberattack involving unauthorized access to files with
patient data.
The company identified unauthorized activity within its system on October 14, 2025. Based on forensic investigation, the unauthorized system access started on September 28, 2025. The breached data included names, telephone numbers, email addresses, birth dates, diagnoses, clinical data, billing and claims details, and Social Security numbers. The settlement website says that some files may also have included home addresses and medical conditions in FMLA forms.
The data breach report submitted to the HHS Office for Civil Rights indicated that the protected health information (PHI) of 54,570 individuals were affected. A threat group known as PEAR claimed it conducted the attack and threatened to leak the data except if a ransom was paid.
Consolidated Lawsuit Filed Brevard Skin & Cancer Center
The first class action lawsuit was filed on October 20, 2025. Other individuals impacted by the data breach filed more lawsuits. The lawsuits were combined because they had similar claims and classes. On February 5, 2026, the consolidated Case No. 05-2025-CA-054649-XXCA-BC, In Re: Brevard Skin & Cancer Center Data Breach Litigation, was filed in the Circuit Court for Brevard County, Florida.
The plaintiffs claimed that Brevard Skin and Cancer Center did not employ proper cybersecurity measures and that the data breach could have been avoided if those actions had been enforced. The claims included unjust enrichment, breach of implied contract, negligence, breach of fiduciary duty, invasion of privacy, and breach of the Florida Deceptive and Unfair Trade Practices Act.
Brevard Skin and Cancer Center rejected the claims and did not admit wrongdoing and liability. The settlement website says that the Court has not made the decision which side is right.
Proposed Settlement Benefits
The proposed settlement states that class members can claim Medical Data Monitoring for one year through CyEx Medical Shield Complete. Class members may likewise choose one of two cash payment options. Those who have actual documented out-of-pocket expenses associated with the data breach may claim repayment of up to $2,500. The settlement website says that qualified documented expenses may include those linked to credit reports or credit monitoring, identity theft or fraud, credit freezes or unfreezes, replacement of ID documents, and postage for contacting banking institutions. Class members who do not claim documented expenses may alternatively claim a $45 cash payment.
The settlement states that Brevard Skin and Cancer Center will cover lawyers’ fees and expenses, settlement management costs, and class representatives’ service awards.
The Court has not yet given final approval of the settlement. The last day to opt out or object to the settlement is November 2, 2026. A claim may be filed until November 16, 2026. Claims sent by mail should have a postmark on that date.
The Final Approval Hearing will be on November 30, 2026, at 9:00 a.m. via Zoom. If the Court awards final approval, settlement payments will be given after the resolution or any appeals.
Class members who stay with the settlement will give up the rights defined in the settlement’s release provisions regarding the legal claims included in the agreement. People who opt out won’t get settlement benefits or payments, however, will keep any rights they may have to stick to the legalities covered by the settlement.