Lucent Health Solutions Agrees to Data Breach Litigation Settlement of Up to $1.95 Million
Lucent Health Solutions based in Nashville, TN has agreed to a settlement of up to $1,950,000 to resolve a class action lawsuit related to an October 2023 phishing attack that exposed an email account containing protected health information (PHI) of approximately 37,000 individuals.
The settlement resolves litigation filed against the health plan administration service provider after a phishing attack that enabled a threat actor to steal email account credentials .
Data Breach Details
Lucent Health Solutions stated that the threat actor accessed the email account for approximately 90 minutes. The HIPAA-covered company reported that no evidence of data theft was identified.
The email account contained PHI associated with approximately 37,000 individuals. The information included names, Social Security numbers, dates of birth, and health data, dental information, and vision group and/or plan numbers.
Affected individuals were notified of the data breach in January 2025. The notifications were issued 15 months after the breach occurred.
Litigation Allegations
A putative class action lawsuit, Royal Corralejo v. Lucent Health Solutions, LLC Litigation, was filed by plaintiff Royal Corralejo in the Circuit Court for Davidson County, Tennessee. The case was subsequently removed to the United States District Court for the Middle District of Tennessee.
The lawsuit alleged that Lucent Health Solutions failed to implement reasonable and appropriate cybersecurity measures and that those deficiencies resulted in the data breach. Lucent Health Solutions denied the allegations and maintained that no wrongdoing occurred.
Settlement Negotiations
The parties agreed to discuss settlement after considering the costs and risks associated with a trial and related appeals.
During mediation held on August 29, 2025, the parties agreed on the material terms of a settlement. The settlement agreement states that the resolution does not include any admission of liability or wrongdoing by Lucent Health Solutions.
Benefits Available to Class Members
Class members may file claims to reimburse documented and unreimbursed ordinary losses related to the data breach. Reimbursement for those losses is available up to $550 per class member.
Class members may also seek reimbursement for extraordinary losses resulting from fraud or identity theft. Those claims are available up to a maximum of $5,500.
The settlement also permits claims for lost time. Eligible class members may seek compensation for up to five hours of lost time at a rate of $25 per hour.
Individuals who do not pursue reimbursement claims may instead request a one-time cash payment of $80.
Class members may also claim a CyEx Medical Shield Complete health data monitoring service membership for three years. The monitoring benefit is available regardless of whether a class member submits a reimbursement claim or requests the cash payment.
Settlement Fund and Deadlines
Lucent Health Solutions agreed to pay up to $1,950,000 under the settlement.
The settlement amount includes attorneys’ fees and expenses, settlement administration and notification costs, and a service award for the plaintiff. If approved claims exceed the total settlement amount, claims will be reduced on a pro rata basis.
The deadline to object to the settlement or opt out is August 21, 2026. The deadline for submitting a claim is September 5, 2026. A final fairness hearing is scheduled for September 9, 2026.