Northeast Rehab Hospital Network $1.5M Data Breach Settlement, Claim Up To $5,000 By February 17, 2026
Northeast Rehab Hospital Network agreed to pay $1.5 million to settle claims over a May 2024 data breach that exposed sensitive patient information including Social Security numbers, medical records, and financial data of approximately 22,000 individuals. Affected patients can claim up to $5,000 for documented losses or receive a $75 cash payment without documentation through the official settlement website at NortheastRehabHospitalDataSettlement.com. The claim deadline is February 17, 2026, with the final approval hearing scheduled for March 2, 2026.
Between May 13 and May 22, 2024, unauthorized hackers infiltrated NRHN’s computer systems and accessed files containing protected health information. Patients didn’t learn about the breach until January 2025—more than seven months after the incident occurred.
What Happened In The Northeast Rehab Data Breach
The May 2024 Cyberattack
On May 22, 2024, Northeast Rehab Hospital Network detected suspicious activity within its computer systems. An investigation revealed that an unauthorized party had gained access to NRHN’s network between May 13 and May 22, 2024, and potentially extracted files containing sensitive patient information.
The compromised data included names, medical histories and treatment information, patient account numbers, physician information, prescription information, medical billing and claims information, health insurance details, Social Security numbers, credit card information, and financial account information.
Northeast Rehab Hospital Network operates rehabilitation hospitals in Nashua, Portsmouth, and Manchester, New Hampshire, along with more than 20 outpatient centers throughout the New England region. The company specializes in speech, occupational, and physical therapy services for patients recovering from disabling injuries and illnesses.
The Delayed Notification
NRHN began notifying affected patients in January 2025—approximately eight months after discovering the breach. This delay became a central issue in the resulting lawsuit filed by patients Diane Minicucci, Ellen Lavoie, Adam Bagni, and Frank Ciaravolo.
The lawsuit alleged Northeast Rehab failed to implement adequate cybersecurity measures to protect patient data, failed to promptly notify affected individuals, and violated healthcare privacy laws including HIPAA. Similar to how the WebTPA data breach settlement addressed an eight-month notification delay, the Northeast Rehab case highlights growing concerns about healthcare providers’ slow disclosure of security incidents.
Settlement Announcement
Rather than proceed to trial, NRHN agreed to settle the class action lawsuit in late 2025. The company denies any wrongdoing but agreed to pay $1.5 million to avoid the costs, risks, and uncertainties of continued litigation.
The settlement includes $500,000 in cash payments to affected class members, plus an additional $500,000 that Northeast Rehab must spend enhancing its computer systems and internal security protocols. Class counsel will receive up to $500,000 in attorneys’ fees, and the four class representatives will each receive $2,500 service awards.
Who’s Eligible And How Much You Can Claim
Settlement Class Definition
You’re automatically part of the settlement class if you’re a United States resident whose private information was or may have been compromised in the May 2024 data breach discovered by Northeast Rehab Hospital Network. If you received a breach notification letter from NRHN or were a patient whose information was accessed, you qualify for compensation.
Excluded from the settlement are the judge, court staff, NRHN employees and directors, and anyone who validly opts out.
Two Cash Payment Options
All eligible class members must choose ONE of two payment options when filing their claim:
Option A: Documented Losses – Claim up to $5,000 for actual out-of-pocket expenses or losses incurred between May 22, 2024 and February 17, 2026. Covered expenses include losses from identity theft or fraud, fees for credit reports or credit monitoring, costs to freeze or unfreeze credit, replacement ID costs, and postage for contacting banks by mail.
You must provide proof such as bank statements, receipts, invoices, or credit reports showing fraudulent accounts. Notes or personal documentation can support other proof but cannot stand alone as evidence.
Option B: Alternate Cash Payment – Receive a flat $75 cash payment without providing any documentation or proof of losses. This option requires no explanation or receipts.
There’s an aggregate cap of $500,000 on all cash payments. If total claims exceed this amount, all payments will be reduced proportionally so the total equals $500,000. Your actual payment may be less than the maximum amounts depending on how many people file valid claims.
How To File Your Claim
Step-By-Step Filing Process
The fastest way to submit your claim is online at NortheastRehabHospitalDataSettlement.com. Alternatively, you can download a printable claim form from the settlement website and mail it to:
NRHN Data Incident Settlement
c/o Settlement Administrator
P.O. Box 25226
Santa Ana, CA 92799
You can also request a paper claim form by calling toll-free (833) 417-4993 or emailing [email protected].
Critical Deadlines
Online claims must be submitted by February 17, 2026. Mailed claims must be postmarked no later than February 17, 2026. Missing this deadline means you forfeit your right to compensation from the settlement.
The deadline to opt out of the settlement or file objections is also February 17, 2026. The court will hold a final approval hearing on March 2, 2026 at 9:00 AM Eastern Time in Courtroom 6 of the Superior Court of Rockingham County, New Hampshire.
Payment Timeline
Settlement payments will only be distributed after the court grants final approval and any appeals are resolved. Based on typical settlement timelines, approved claims will likely be paid in summer or fall 2026—several months after the March 2 hearing.
Payments will be sent through PayPal, Venmo, or mailed checks according to your preference selected on the claim form.
Required Information
When filing your claim, you’ll need to provide your full name, current address, phone number, and email address. If claiming documented losses under Option A, attach all supporting documentation including receipts, invoices, bank statements, and correspondence proving your expenses resulted from the data breach.
What Rights You’re Giving Up
By staying in the settlement class and accepting payment, you release Northeast Rehab Hospital Network from all legal claims related to the May 2024 data breach. This means you cannot file a separate lawsuit or join another class action about this specific incident.
If you want to preserve your right to sue NRHN separately, you must submit a written Request for Exclusion postmarked by February 17, 2026. However, opting out means you receive no settlement benefits.
Enhanced Security Requirements
Beyond the cash payments, the settlement requires Northeast Rehab to invest at least $500,000 in enhancing its cybersecurity infrastructure and internal security protocols. While specific improvements weren’t publicly disclosed, similar healthcare data breach settlements typically mandate measures like improved encryption, access controls, employee training, and network monitoring systems.
The settlement follows a concerning pattern in healthcare data breaches where providers fail to adequately protect patient information. The AT&T class action lawsuit sending $7,500 settlement checks after two massive data breaches exposed 73 million customers demonstrates that companies across industries face significant financial consequences when consumer data isn’t properly secured.
FAQ
How do I know if I’m part of the settlement class?
If you received a data breach notification letter from Northeast Rehab Hospital Network about the May 2024 incident, you’re automatically part of the settlement class. NRHN maintains records of affected patients, so you don’t need to prove your eligibility beyond completing the claim form with your information.
Can I claim both the $5,000 documented losses and the $75 alternate payment?
No. You must choose ONE payment option when filing your claim. If you select documented losses but your payment would be less than $75 after the pro-rata reduction, you won’t automatically receive the alternate payment instead—you’re locked into whichever option you choose.
What if I don’t have receipts for my expenses?
You need documentation to claim Option A documented losses. Acceptable proof includes bank statements, credit card statements, receipts, invoices, correspondence with creditors, or credit reports showing fraudulent accounts. If you cannot document your losses, choose Option B for the $75 alternate cash payment that requires no proof.
Will I receive the full $5,000 or $75?
Probably not. There’s a $500,000 cap on all cash payments combined. If total claims exceed this amount, everyone’s payment will be reduced proportionally. Based on 22,000 affected individuals, if even a fraction file claims, payments will likely be significantly reduced from the maximum amounts.
Is this settlement different from previous Northeast Rehab data breaches?
Yes. Northeast Rehab experienced a separate data breach in September-October 2021 that affected over 190,000 individuals. That earlier incident is completely separate from this May 2024 breach and the current settlement. If you were affected by the 2021 breach, that case had its own separate resolution.
How long will I need to monitor my credit after this breach?
Experts recommend monitoring your credit for at least 3-5 years after any data breach involving Social Security numbers. Identity thieves often wait months or even years before using stolen information to avoid detection. Consider placing a credit freeze with all three major credit bureaus—Equifax, Experian, and TransUnion.
What happens at the final approval hearing on March 2, 2026?
The court will decide whether to approve the settlement as fair, reasonable, and adequate for the class. The judge will also consider any objections filed by class members and determine whether to approve the requested attorneys’ fees and service awards. You don’t need to attend unless you filed an objection and want to speak.
Last Updated: January 21, 2026
Disclaimer: This article provides information only and does not constitute legal advice.
CTA: File your Northeast Rehab data breach claim before February 17, 2026 at NortheastRehabHospitalDataSettlement.com—don’t leave money on the table.
Stay informed, stay protected. — AllAboutLawyer.com
About the Author
Sarah Klein, JD, is a licensed attorney and legal content strategist with over 12 years of experience across civil, criminal, family, and regulatory law. At All About Lawyer, she covers a wide range of legal topics — from high-profile lawsuits and courtroom stories to state traffic laws and everyday legal questions — all with a focus on accuracy, clarity, and public understanding.
Her writing blends real legal insight with plain-English explanations, helping readers stay informed and legally aware.
Read more about Sarah