Past settlements

Gryphon Healthcare Data Breach Settlement

A targeted cyberattack involving a business associate occurred in early July 2024 affecting Gryphon Healthcare's medical billing services. Files containing private information including names, dates of birth, addresses, Social Security numbers, health insurance information, medical treatment information, and other personal health data were accessed. Gryphon denies wrongdoing.

Dapper Labs Video Privacy Protection Act Settlement

Dapper Labs allegedly disclosed online subscribers' personally identifiable information (PII) to various third parties without consent in violation of the Video Privacy Protection Act (VPPA). Dapper Labs denies violating any law but agreed to the settlement to avoid the uncertainties and expenses of continuing the case.

Paid Up to $5

Disability Rights Wisconsin Data Settlement

Disability Rights Wisconsin suffered a cybersecurity incident on or around October 10, 2023, in which the private and personal information of customers and clients may have been exposed. The company is settling claims arising from this data breach.

Paid $0–$2,085

Murfreesboro Medical Clinic Data Breach Settlement

In April 2023, Murfreesboro Medical Clinic suffered a ransomware attack and data breach that gave third-party criminals access to private and health information of patients and employees. The clinic denies wrongdoing and states it was a victim of criminal acts, but has agreed to settle to avoid litigation costs.

Paid Reimbursement for documented out-of-pocket expenses resulting from the data breach and time spent addressing it; additional credit monitoring and identity theft protection

Coos County Family Health Services Data Breach Settlement

Coos County Family Health Services, Inc. experienced a cyberattack on or around July 9, 2025, in which private information of individuals was compromised. The defendant denies all allegations and liability but agreed to this settlement to avoid the costs and risks of continuing the lawsuit.

NRS Pay TCPA Settlement

Defendant allegedly placed prerecorded telemarketing calls to cell phones without prior express written consent in violation of the Telephone Consumer Protection Act, using "ringless voicemail" services through a third-party vendor. Defendant denies wrongdoing and the court has not decided the case.

Paid Up to $135

Wells Fargo Securities Action Settlement

Wells Fargo allegedly made false and misleading statements about its diversity hiring initiative, the Diverse Search Requirement. The company failed to disclose that it was conducting widespread "fake" or sham interviews of diverse candidates under this policy. When The New York Times revealed this conduct on June 9, 2022, Wells Fargo shareholders suffered losses. Wells Fargo denies all allegations and admits no wrongdoing.

Jackson v. Gen Digital Inc. - Robocall Settlement

Gen Digital Inc. made artificial or prerecorded voice calls to consumers' cellular telephones regarding LifeLock or Norton accounts when the recipients did not have such accounts, in violation of telemarketing laws.

Paid $200–$625

Celgene Corporation Securities Litigation Settlement

Celgene Corporation and officers Terrie Curran and Philippe Martin allegedly violated federal securities laws by making false and misleading statements during the Class Period regarding certain pharmaceutical products and drug candidates including GED-0301, Otezla, and Ozanimod.

Universal Lenders Data Breach Settlement

Universal Lenders, LLC experienced a targeted cyberattack on its computer systems in November 2024, during which certain files containing private information were accessed. These files may have contained personal information such as names, Social Security numbers, financial account numbers, and driver's license numbers. The defendant denies wrongdoing and no court has decided the merits of the case.

Panda Restaurant Group Data Breach Settlement

In or around March 2024, an unauthorized third party may have gained access to Panda Restaurant Group's files containing sensitive personal information, including full names, dates of birth, and Social Security numbers. The defendant denies any wrongdoing and denies liability, but has agreed to settle the lawsuit on a class-wide basis.

Paid $100–$5,000

Mamboleo v Pacific Life Insurance Company - PDX Policy Settlement

Pacific Life Insurance Company sold Pacific Discovery Xelerator indexed universal life insurance policies (PDX Policies) in California between 2017 and 2019. The plaintiff claims the marketing materials and illustrations used to sell these policies were misleading. Pacific Life denies any violation of law or harm to policyowners.

Paid Settlement provides an increase to Accumulated Value in the fixed account of PDX Policies that remain in-force, or three years of free term life insurance for terminated policies if the insured is still alive.

Goldco Direct LLC TCPA Settlement

Goldco Direct LLC allegedly sent marketing text messages to telephone numbers after being asked to stop, in violation of the Telephone Consumer Protection Act (TCPA). The defendant denies the allegations and any wrongdoing.

Catholic Health System Data Breach Settlement

Catholic Health System allegedly disclosed patients' personally identifiable information to Meta (Facebook) and other third parties without permission, in violation of state and federal privacy laws. The defendant denies any wrongdoing.

Paid Up to $20

Ruffulo v. Farmers Insurance Settlement

Farmers Insurance Exchange and related entities allegedly failed to comply with wage and hour laws and age discrimination laws. Named Plaintiffs James Ruffulo and Valerie Yankus brought claims on behalf of insurance agents. The defendant has agreed to settle these claims while admitting no wrongdoing.

Pinehurst Radiology Associates Data Breach Settlement

Pinehurst Radiology Associates, PLLC experienced a targeted cyberattack on its computer systems in January 2025 that compromised private information. The files accessed contained personal information including names, addresses, dates of birth, Social Security numbers, medical diagnoses, treatment information, medical record numbers, health insurance information, and Medicare/Medicaid numbers. Pinehurst denies wrongdoing, and the court has not decided the case.

RXO Last Mile Delivery Driver Settlement

RXO Last Mile, Inc. allegedly misclassified delivery drivers as independent contractors rather than employees, failed to provide employment benefits such as vacation pay and earned sick time, and made improper deductions from driver pay based on customer complaints. RXO denies all allegations and admits no wrongdoing.

Elite Medical Transportation Wage Deduction Settlement

Elite Medical Transportation LLC allegedly violated Illinois wage and hour laws by making unauthorized deductions from employees' pay in response to traffic citations. The defendant denies the allegations and contends it complied with all applicable laws.

Davis v. Aspire Lifestyles (Americas) Inc.

Marquita Davis sued Aspire alleging that the company did not correctly pay hourly employees (Concierges and similar positions) for all hours worked, resulting in denied overtime wages in violation of the Fair Labor Standards Act. Aspire denies these allegations and maintains it has always complied with all relevant laws.

Lockton Companies Data Breach Settlement

Southeast Series of Lockton Companies experienced a cybersecurity incident on November 20, 2024, that compromised the private information of customers and others notified of the breach. The defendants have agreed to settle the class action lawsuit arising from this data incident.

Asheville Eye Associates Data Incident Settlement

Asheville Eye Associates experienced a data incident that compromised the personally identifiable information (PII) and protected health information (PHI) of individuals. The defendant denies any wrongdoing.

Paid $10–$1,250

DataMaxx Data Breach Settlement

DataMaxx Applied Technologies experienced a cybersecurity incident in December 2023 that compromised personal information in their computer systems. Files containing names, Social Security numbers, driver's license numbers, and medical information may have been accessed. DataMaxx denies any wrongdoing, and the parties agreed to settle to avoid the costs and uncertainties of continuing litigation.

Payscale Sales Development Representative Unpaid Overtime Settlement

Two former Sales Development Representatives sued Payscale, claiming the company failed to properly track and pay SDRs for all hours worked, including overtime. The court has approved the parties' settlement of the dispute, though the court did not decide who was right.

Tempel Steel Data Breach Settlement

Tempel Steel Company was the victim of a targeted cyberattack in February 2025 in which certain files containing personal information were potentially accessed, including names, addresses, Social Security numbers, tax identification numbers, dates of birth, health insurance information, health information, driver's license numbers, state-issued identification card numbers, and financial account information. Tempel Steel denies wrongdoing, and this settlement was reached to avoid the costs and risks of continuing the litigation.

Johnson & Wales University Security Incident Settlement

Johnson & Wales University experienced an unauthorized security incident in July 2024 when a third-party criminal actor gained unauthorized access to the university's network. Settlement class members' information may have been impacted by this breach.

Paid $50–$1,000

Capital Health Data Breach Settlement

Capital Health Systems, Inc. experienced an IT systems outage from November 11-26, 2023 in which an unauthorized third party may have gained access to files containing private information belonging to patients, former patients, guarantors, and employees. The private information potentially compromised included names, addresses, dates of birth, Social Security numbers, email addresses, telephone numbers, and clinical information.

Lugo v. Inova Health Care Services Settlement

Inova Health Care Services allegedly collected and disclosed patients' Personally Identifiable Information (PII) and Protected Health Information (PHI) through third-party tracking technologies (tracking pixels) on its public-facing websites, in violation of the federal Electronic Communications Privacy Act (ECPA). The defendant disputes that the information collected is protected under HIPAA and maintains it has not disclosed any patients' private information, but has agreed to the settlement to avoid the costs and uncertainties of continuing litigation.

Paid Each Settlement Class Member who submits an Approved Claim will receive an equal cash payment from the Settlement Fund.

California Northstate University Data Breach Settlement

California Northstate University experienced a data incident that potentially exposed personal information of students and others. The defendant denies any wrongdoing but has agreed to settle the resulting class action lawsuit.

Paid $100–$5,000

Quick and Lance v. EMSA Data Breach Settlement

In February 2024, Emergency Medical Services Authority experienced a data breach in which an unauthorized party gained access to the network and acquired files containing consumers' personally identifiable information, including names, Social Security numbers, and protected health information. The defendant is implementing additional security measures as part of the settlement.

Paid $60–$3,000

ALN Medical Management LLC Data Incident Settlement

ALN Medical Management LLC experienced a data incident in March 2024 that exposed private information of affected individuals. The company and certain client clinics settled the resulting class action lawsuit without admitting wrongdoing.

Paid $50–$5,000

Lannett Securities Settlement

Defendants allegedly violated federal securities laws by making material misrepresentations and/or omissions about the generic drug market, whether Lannett was aware that drug prices were not being set in a competitive market, and the potential impact of investigations into purported industry price-fixing agreements. Defendants deny all allegations of wrongdoing.

Community First Medical Center Data Incident Settlement

Community First Medical Center, Inc. experienced a data breach on or about July 12, 2023, in which personally identifiable information and personal health information were potentially compromised on the company's network systems. The lawsuit asserted claims against the defendant related to this data incident.

Pregon v. State Farm Fire and Casualty Company Settlement

State Farm allegedly improperly depreciated labor and other non-material costs when calculating actual cash value (ACV) payments to Missouri policyholders for structural damage claims. State Farm denies all allegations and contends policyholders received everything entitled to under their policies.

Southerntier Custom Fabricators Paid Sick Leave Settlement

Between September 30, 2020 and April 30, 2022, Southerntier Custom Fabricators, Inc. failed to provide its unionized workforce with Paid Sick Leave as required by New York Labor Law § 196-b. The New York State Office of the Attorney General completed an investigation and found these violations.

WorkEasy/EasyWorkforce Fingerprint Time Clock BIPA Settlement

EasyWorkforce is accused of violating Illinois's Biometric Information Privacy Act (BIPA) by capturing, collecting, and disclosing biometric data from fingerprint time clocks without proper consent and failing to adequately secure that data. EasyWorkforce denies any wrongdoing. The settlement is a compromise to end the lawsuit without determining fault.

Flat Rock ESOP Settlement

The Flat Rock Metal and Bar Processing Employee Stock Ownership Plan (ESOP) allegedly overpaid for SAC Ventures, Inc. stock in a November 24, 2020 transaction in violation of the Employee Retirement Income Security Act of 1974 (ERISA). The defendants deny all claims and make no admission of wrongdoing.

Chrysler 200 MultiAir Actuator and Fuel Injector Settlement

FCA US LLC allegedly failed to provide appropriate warranty coverage for MultiAir Actuator and Fuel Injector components as emissions-related parts under California Emissions Warranty requirements for 2015-2017 Chrysler 200 vehicles. FCA US is settling the lawsuit without admitting wrongdoing.

Paid Reimbursement for past qualifying MultiAir Actuator or Fuel Injector repairs, plus automatic warranty extension on these components

Capital One 360 Savings Account Interest Rate Settlement

Capital One allegedly failed to raise interest rates on its 360 Savings account to match the higher rates paid on the 360 Performance Savings account. The company allegedly deceptively marketed the 360 Savings account and concealed that it was no longer Capital One's high-yield online savings account and hid the existence of the higher-rate 360 Performance Savings account from 360 Savings accountholders.

Paid The Settlement Administrator has not yet determined the amount of individual Class Cash Payments. Payments of $5 or more will be mailed by check unless electronic payment is elected; payments under $5 require electronic payment election.

Anthropic Copyright Settlement

Anthropic PBC is accused of using copyrighted books without permission in connection with its operations. The company agreed to a settlement to resolve copyright-related claims brought by book copyright owners.

Lucero v Nationwide Settlement

Nationwide allegedly failed to properly advise New Mexico insureds that underinsured motorist (UIM) claims are required by law to be reduced by amounts received from the at-fault driver's insurer. Plaintiff alleges breaches of contract, negligence, unjust enrichment, breach of good faith and fair dealing, and violations of New Mexico's Unfair Trade Practices Act. Defendants deny all allegations and maintain they complied with policy terms and applicable law.

Paid Up to $25,000

MOVEit Nuance Data Security Breach Settlement

Nuance Communications, Inc. experienced a data security breach between May 27-31, 2023, affecting personally identifiable information of customers. The breach resulted from an alleged vulnerability in MOVEit Transfer, third-party file transfer software that Nuance used in its ordinary business operations. Nuance is settling claims related to this 2023 MOVEit Security Incident, though litigation against Progress Software Corporation (the MOVEit software licensor) continues.

Paid $0–$10,100

NextGen Healthcare Data Breach Settlement

NextGen Healthcare announced a data breach on April 28, 2023 that exposed settlement class members' private information. The company is settling the class action lawsuit without admitting wrongdoing, and has agreed to pay $19,375,000 to compensate affected individuals and provide identity defense services.

Paid $50–$7,500

Sunflower Medical Group Data Breach Settlement

Sunflower Medical Group experienced a targeted cyberattack on its computer systems in December 2024 that compromised private information. Files containing personal information such as names, Social Security numbers, dates of birth, addresses, driver's license numbers, medical information, and health insurance information were accessed. Sunflower denies wrongdoing and the court has not decided the case.

RINA Accountants & Advisors Data Breach Settlement

A cyberattack by an unauthorized third party compromised personally identifiable information (including Social Security Numbers) stored by RINA Accountants & Advisors on or about February 28, 2022. RINA maintains it had meritorious defenses but agreed to settle the lawsuit.

Paid Up to $10,000

Wingstop Wage Dispute Settlement (Store 501)

Plaintiffs alleged that Wingstop violated New York Labor Law by not paying employees all wages owed. The parties settled without the court deciding in favor of either side, avoiding trial costs and risks.

Paid Each eligible employee receives a payment based on the number of weeks worked from December 1, 2020 to February 2, 2024. Service payments of $2,500 each to named plaintiffs Rynel Leonard and Chaunda Lee.

Des Moines Orthopaedic Data Incident Settlement

In February 2023, Des Moines Orthopaedic Surgeons experienced a data incident affecting its computer systems that potentially impacted the personal information of prospective and actual patients. The company denies wrongdoing and states it had meritorious defenses, but agreed to settle the lawsuit to resolve the disputed claims.

American Addiction Centers Data Breach Settlement

American Addiction Centers experienced a data breach on or about September 26, 2024, that resulted in unauthorized access to or acquisition of settlement class members' private information including names, addresses, phone numbers, dates of birth, medical record numbers, Social Security numbers, treatment information, and health insurance information. The defendant notified potentially impacted patients between November and December 2024. The defendant denies all claims and maintains it did nothing wrong.

Rheem Drain Valve Settlement

Rheem Manufacturing Company and Melet Plastics Inc. allegedly manufactured and sold round poly drain valves with defects between 2019 and 2023. The defendants deny any wrongdoing and admit no liability; the court has made no determination of wrongdoing.

Paid $0–$1,500

Michael Kors Outlet Settlement

Michael Kors is settling a class action lawsuit alleging issues related to purchases at Michael Kors Outlet stores. The company will provide merchandise certificates to eligible purchasers, though the page does not specify the exact allegations or legal claims involved.

Paid Up to $30

Dufresne Spencer Group Data Incident Settlement

Dufresne Spencer Group experienced unauthorized access to its systems between May 15, 2023 and June 5, 2023, exposing sensitive personal information of employees and customers including names, contact information, banking details, Social Security numbers, driver's licenses, payment card information, and medical data. Dufresne denies any wrongdoing.

Paid $45–$3,080

DoorDash Restitution Settlement for California Drivers

DoorDash was ordered to provide restitution to California drivers who either opted out of previous settlement classes or completed deliveries during specific time periods. The drivers allege DoorDash violated state labor laws.

Geisinger Health Data Security Incident Settlement

An unauthorized individual gained access to personally identifiable information and personal health information of Geisinger Health patients in a data incident that occurred on or about November 29, 2023. The lawsuit asserts claims against Geisinger Health and Nuance Communications, Inc. related to this data breach.

Numotion Data Incident Settlement

United Seating and Mobility, LLC d/b/a Numotion suffered two data breaches: in March 2024, an unauthorized person accessed systems containing private information of current and former customers and employees; and in September 2024, an unauthorized person accessed user accounts with potential exposure of personal health information. The defendant denies any liability or wrongdoing.

Paid Up to $15,000

Veradigm Data Breach Settlement

Veradigm, Inc. experienced a data incident in which private information belonging to patients of Veradigm's healthcare clients was accessed and acquired. The defendant denies any wrongdoing.

Paid $50–$5,000

Papa John's Employee Settlement

Papa John's allegedly entered into agreements with franchisees where they agreed not to hire or solicit employees from Papa John's or other franchisees. This allegedly violated the Sherman Antitrust Act and depressed wages and diminished employment opportunities for restaurant-level employees. Defendants deny all wrongdoing and admit no liability.

Paid From $5

Staten Island University Hospital Data Breach Settlement

Staten Island University Hospital was targeted by a cyberattack on The Medibase Group Inc.'s computer systems in January 2024. The attack resulted in unauthorized access to files containing personal information including names, dates of birth, Social Security numbers, hospital admit/discharge dates, outstanding balances, and health insurance information. SIUH's own computer systems were not impacted, and SIUH denies wrongdoing.

JustPlay Biometric Information Settlement

JustPlay allegedly improperly collected, stored, and used biometric information from people who used the JustPlay mobile app, violating Illinois' Biometric Information Privacy Act (BIPA). JustPlay denies wrongdoing and the court has not decided the case; the parties have agreed to settle to avoid the costs and risks of continuing litigation.

Layman v. Legacy Health Data Breach Settlement

Legacy Health allegedly disclosed patients' personally identifiable information to Meta (Facebook) and Google without permission. The lawsuit alleged breach of confidence, breach of implied contract, unjust enrichment, and negligence. Legacy Health denies any wrongdoing, and the court has not decided who is right.

Paid Up to $15

Multnomah County Tax Foreclosure Settlement

Multnomah County allegedly violated plaintiffs' rights by failing to provide proceeds from sales of tax-foreclosed properties that exceeded unpaid taxes and fees, in violation of the U.S. Supreme Court's Tyler v. Hennepin County decision. Multnomah County denies wrongdoing but has agreed to settle to avoid costly litigation.

Paid Surplus proceeds from the sale of tax-foreclosed properties that exceeded unpaid taxes, fees, and costs

Boart Longyear Data Breach Settlement

In June 2024, Boart Longyear Company experienced a targeted cyberattack on its computer systems in which certain files containing private information were accessed. These files may have contained personal information such as Social Security numbers, driver's license numbers, government identification card numbers, passport numbers, medical information, and/or financial account information. Boart Longyear denies wrongdoing.