$2.4M Excelsior Orthopaedics Data Breach Settlement, Are You Eligible for Up to $5,000 Before Claim deadline is June 11, 2026?

A ransomware attack on Excelsior Orthopaedics exposed the personal and medical information of approximately 357,000 current and former patients and employees in June 2024. The company and its affiliate, Buffalo Surgery Center, agreed to pay $2,400,000 to settle multiple class action lawsuits filed over the breach. If you received a notice letter from Excelsior Orthopaedics or Buffalo Surgery Center, you may be eligible for up to $5,000 in cash plus two free years of three-bureau credit monitoring. The claim deadline is June 11, 2026.

Quick Facts

Field	Detail
Settlement Amount	$2,400,000
Claim Deadline	June 11, 2026
Who Qualifies	U.S. residents whose personal information was potentially compromised in the data breach discovered on or about June 24, 2024, including all who received a notice letter
Payout Per Person	Up to $5,000 (documented losses) or pro-rata cash payment (no proof required)
Proof Required	Yes — for documented loss claims; No — for pro-rata cash and credit monitoring
Settlement Status	Preliminarily approved February 10, 2026 — open for claims
Administrator	Epiq Global
Official Website	ExcelsiorDataSettlement.com

What Happens Next

• The court holds a Final Approval Hearing on July 8, 2026 to decide whether to formally approve the settlement.
• The opt-out and objection deadline is May 17, 2026 — earlier than the claim deadline.
• Payments go out approximately 90 days after claim processing is complete or the court grants final approval, whichever comes later.

What Happened at Excelsior Orthopaedics?

Excelsior Orthopaedics is an orthopedic care provider based in Amherst, New York, operating several clinics under related names including Northtowns Orthopaedics and Buffalo Surgery Center. On June 23, 2024, the company detected suspicious activity on its computer network. A forensic investigation confirmed that an unauthorized third party — later described as a ransomware attacker — had accessed and copied data from its systems.

The scope of the breach took months to fully uncover. Excelsior sent an initial wave of notification letters in August 2024 after early forensic results pointed to employee data exposure. After completing its full data mining review in December 2024, the company sent a second wave of notification letters on December 31, 2024, revealing that patient information had also been compromised. Excelsior Orthopaedics reported the breach to the U.S. Department of Health and Human Services Office for Civil Rights as affecting 394,752 individuals. Buffalo Surgery Center separately reported 64,000 affected patients.

Related article: Empire Hotel Class Action Lawsuit 2026, What Guests Need to Know About Hidden Fee Allegations

Multiple class action lawsuits followed, which courts consolidated into a single case — Szucs et al. v. Excelsior Orthopaedics, LLP et al. — filed in the Supreme Court of the State of New York, County of Erie. The plaintiffs alleged that Excelsior failed to implement reasonable cybersecurity measures to protect highly sensitive patient and employee information. The defendants deny all wrongdoing but agreed to settle to avoid the cost and uncertainty of ongoing litigation. As part of the settlement, Excelsior also agreed to strengthen its data security practices going forward.

What Personal and Medical Information Was Exposed?

The breach potentially compromised a wide range of sensitive data, including:

• Full name
• Date of birth
• Social Security number
• Driver’s license and state ID number
• Passport number
• Home address and contact information
• Medical record numbers
• Diagnosis and treatment information
• Prescription information
• Health insurance information
• Financial account information
• Biometric information

When medical information combines with financial and government ID data, the risk of identity theft, insurance fraud, and financial fraud becomes significantly elevated. This is why the settlement offers both cash reimbursement for documented harm and proactive credit monitoring for all class members.

Do You Qualify to File a Claim?

You may qualify if:

• You are a living U.S. resident.
• Your personal information was potentially compromised in the data breach that Excelsior Orthopaedics discovered on or about June 24, 2024.
• You are a current or former patient, employee, or affiliate of Excelsior Orthopaedics, Northtowns Orthopaedics, or Buffalo Surgery Center.
• You received a notice letter from Excelsior Orthopaedics or Buffalo Surgery Center about the incident.

The settlement estimate covers approximately 389,000 individuals whose information was potentially accessed. Even if your loss was not immediately obvious, you still qualify for the no-proof pro-rata cash payment and free credit monitoring.

How Much Money Can You Receive?

The settlement offers three separate benefits. You can combine the credit monitoring with either cash option.

Documented Loss Payment — Up to $5,000

You can claim reimbursement for actual, out-of-pocket expenses you incurred as a result of the breach. Qualifying costs include bank fees, phone and data charges tied to dealing with the breach, postage, gasoline for local travel related to the incident, fees for credit reports, and the cost of any credit monitoring or identity theft protection services you purchased. You must submit supporting documentation such as receipts, bank statements showing fraudulent charges, police reports, or other proof of identity theft or fraud. Self-prepared documents alone are insufficient but can supplement other records.

Pro-Rata Cash Payment — No Proof Required

If you do not have documented losses or prefer not to gather paperwork, you can still receive a cash payment. This payment comes from whatever remains in the net settlement fund after attorneys’ fees (up to $800,000), service awards to lead plaintiffs (up to $2,500 each), administrative costs, and documented-loss payouts have been deducted. The more people who file, the smaller each individual pro-rata share becomes.

Two Years of Free Three-Bureau Credit Monitoring — No Claim Form Required

All class members automatically receive two years of three-bureau credit monitoring and identity theft insurance — whether or not they file a claim form. Your settlement notice included an activation code. Activation instructions will be available on the settlement website after the court grants final approval on July 8, 2026.

How to File Your Claim

Step 1 — Go to the official claim portal at ExcelsiorDataSettlement.com

Step 2 — Log in using the unique ID and PIN printed on your settlement notice

Step 3 — Choose your claim type: documented loss payment (up to $5,000) or pro-rata cash payment (no proof)

Step 4 — If claiming documented losses, upload supporting documentation — receipts, bank or credit card statements, police reports, or similar records

Step 5 — Select your preferred payment method: paper check or electronic payment

Step 6 — Submit your claim and save your confirmation number

You can also download a paper claim form from the settlement website and mail it to:

Excelsior Incident Settlement Administrator, P.O. Box 6484, Portland, OR 97228-6484

Paper forms must be postmarked by June 11, 2026.

For questions, call Epiq Global at 1-877-327-7791 or email [email protected].

Estimated time to complete: 5–15 minutes (longer if gathering documentation for expense claims)

Important Deadlines

Milestone	Date
Breach Discovered	June 23–24, 2024
First Notification Letters Sent	August 2024
Second Notification Letters Sent	December 31, 2024
Preliminary Approval Granted	February 10, 2026
Claims Period Opens	Open now
Opt-Out Deadline	May 17, 2026
Objection Deadline	May 17, 2026
Claim Filing Deadline	June 11, 2026
Final Approval Hearing	July 8, 2026
Expected Payment Date	Approximately 90 days after final approval and resolution of any appeals

Frequently Asked Questions

Do I need a lawyer to file a claim? 

No. You can file directly at ExcelsiorDataSettlement.com in minutes without hiring an attorney. Class counsel already represents all class members in court at no cost to you. If you want independent legal advice about your specific situation, you may hire your own attorney at your own expense.

Is this settlement legitimate?

 Yes. The Supreme Court of the State of New York, County of Erie, granted preliminary approval to this settlement on February 10, 2026. Epiq Global, one of the most widely used court-approved settlement administrators in the country, runs the official claim site.

When will I receive my payment? 

The court holds a Final Approval Hearing on July 8, 2026. If the court approves the deal and no appeals follow, Epiq will process claims and issue payments approximately 90 days after claim processing is complete or final approval is granted, whichever comes later. Appeals can delay payments significantly.

What if I missed the claim deadline? 

The deadline is June 11, 2026. Claims submitted after that date will be rejected. Missing the deadline also means you remain bound by the settlement and give up your right to sue Excelsior Orthopaedics or Buffalo Surgery Center independently over this breach.

Will this settlement payment affect my taxes?

 Payments that reimburse you for actual documented financial losses are generally not taxable. Pro-rata cash payments with no documented loss may be treated differently. The tax treatment depends on your individual situation — consult a tax professional if you are unsure.

I didn’t receive a notice letter. Can I still file? 

The settlement covers all U.S. residents whose personal information was potentially compromised, including those who received notice. If you were a patient or employee of Excelsior Orthopaedics, Northtowns Orthopaedics, or Buffalo Surgery Center before June 2024, contact Epiq at 1-877-327-7791 or [email protected] to confirm whether your information appears in the class member records.

Do I need to activate the credit monitoring separately?

 Yes, but no claim form is required. Your settlement notice included an activation code. Full activation instructions will be posted on ExcelsiorDataSettlement.com after the court grants final approval on July 8, 2026. You can enroll after that date even if the claim deadline has already passed.

What is the difference between the documented loss claim and the pro-rata cash claim? 

The documented loss claim pays up to $5,000 but requires receipts or other proof of expenses caused by the breach. The pro-rata claim requires no proof at all but pays a smaller, equal share of whatever remains in the fund after all other costs are deducted. You can only choose one cash option — not both.

Sources & References

1. Official settlement website — ExcelsiorDataSettlement.com
2. Settlement agreement — court document

Last Updated: April 10, 2026

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Legal claims and outcomes depend on specific facts and applicable law. For advice regarding a particular situation, consult a qualified attorney.