Cardiology Associates of Mobile $1.25M Data Breach Settlement, Who Qualifies, Up to $4,000, Cash Payment and Claim Deadline

Cardiology Associates of Mobile, Inc. (CAM) has agreed to a $1,250,000 class action settlement over an October 2024 data security incident that potentially exposed the personal and health information of about 172,678 people. The settlement resolves In re Cardiology Associates Data Breach Litigation, Master File No. 02-cv-2025-900139, in the Circuit Court for Mobile County, Alabama.

Deadlines are close. The opt-out and objection deadline is November 30, 2026, and the claim deadline is December 29, 2026. The settlement still needs final court approval at a hearing on January 29, 2027.

What you can claim: up to $4,000 for documented losses, a separate pro rata cash payment with no receipts, and 24 months of credit monitoring with $1 million in identity theft insurance. You can request the monetary benefits and the monitoring together. CAM denies wrongdoing, and the settlement is not an admission of liability.

Official website: CardiologyDataIncident.com | Online claim form: File your claim | Administrator: Kroll Settlement Administration, 833-453-3702

Cardiology Associates Settlement: Quick Facts

Detail	Information
Company	Cardiology Associates of Mobile, Inc.
Settlement fund	$1,250,000 (paid by CAM and Teklinks, Inc. and its affiliates)
Case	In re Cardiology Associates Data Breach Litigation
Case number	02-cv-2025-900139
Court	Circuit Court for Mobile County, Alabama
Data incident	On or about October 22, 2024
People affected	Approximately 172,678
Documented losses	Up to $4,000
Pro rata cash payment	Amount not fixed; no receipts
Credit monitoring	24 months, with $1 million identity theft insurance
Opt-out and objection deadline	November 30, 2026
Claim deadline	December 29, 2026 (online by 11:59 p.m. CT; mail postmarked by that date)
Final approval hearing	January 29, 2027, 10:00 a.m. CT
Settlement administrator	Kroll Settlement Administration LLC
Status	Preliminary approval granted; final approval pending

What Happened in the Cardiology Associates Data Breach?

CAM is a cardiovascular care provider serving patients in Alabama and along the Mississippi Gulf Coast. According to the settlement notice, unauthorized parties accessed its computer systems on or about October 22, 2024. The reported data involved current and former patients and medical providers, and could include:

• Names and addresses
• Dates of birth
• Social Security numbers
• Medical records and treatment information
• Health insurance information
• Driver’s license and passport numbers

Not every person had every data type exposed. CAM began notifying providers in December 2024 and patients in January 2025, and offered some identity protection services. Its original patient notice said investigators had not found evidence of specific misuse at that time. That does not rule out later misuse.

Why was CAM sued?

The plaintiffs alleged that CAM did not adequately protect sensitive information. Claims include negligence, negligence per se, breach of implied contract and related theories. CAM and the other released parties, including Teklinks, Inc. and its affiliates, deny all wrongdoing. The court has not found any party liable. As part of the deal, CAM has also agreed to enhanced data security measures.

Who Qualifies for the Settlement?

The settlement class is all individuals residing in the United States whose personally identifiable information or protected health information was identified as potentially impacted in the October 2024 data incident, including those who received notice of it. That includes current and former patients and medical providers. People who validly opt out, judges and their families, and others listed in the official notice are excluded.

You may qualify if you received a breach notice from CAM or your information was identified as affected. You do not need to prove identity theft to request the pro rata cash payment or credit monitoring.

Never got a notice? Being a patient does not automatically make you a class member, but the class is not defined only by who received a letter. Call the administrator at 833-453-3702 and ask whether your information is in the settlement records.

Settlement Benefits: How Much Can You Get?

Benefit	Amount	Proof needed?
Out-of-pocket loss reimbursement	Up to $4,000	Yes
Pro rata cash payment	Varies	No receipts
Credit monitoring	24 months	No

1. Up to $4,000 for documented losses

You can claim documented losses reasonably related to the incident, such as fraud monitoring, identity theft protection costs, professional fees, credit freezes or thaws and unreimbursed fraud losses. Losses generally must have been incurred between December 2024 and the December 29, 2026 claims deadline, and be more likely than not tied to the breach. Keep receipts, invoices, bank or card statements and similar records. $4,000 is a cap, not a promise.

2. Pro rata cash payment

Class members can request a proportional cash payment without receipts. There is no fixed dollar amount. Valid claimants share the money left after other costs and benefits are paid, so the final amount depends on how many people file.

3. 24 months of credit monitoring

Credit monitoring covers Equifax, Experian and TransUnion, includes fraud-resolution help, and comes with up to $1 million in identity theft insurance. The insurance is not a cash payout, and coverage follows the policy’s terms. Enrollment instructions come after final approval.

How the $1.25 million is divided

The fund does not all go to claimants. It also covers court-approved attorneys’ fees (class counsel plans to request up to about $416,625, roughly one-third), litigation expenses, administration costs, taxes and service awards of up to $2,500 for each of the nine class representatives. Benefits are paid in this order: credit monitoring, then documented losses, then the pro rata payments from whatever remains. If claims exceed available funds, payments can be reduced proportionally. That is why you cannot predict your payment by dividing $1.25 million by 172,678.

Related article: Sequoia Equities $3.1 Million Security Deposit Settlement, Who Qualifies, How Much Tenants Could Receive and the December 3 Claim Deadline

Important Deadlines

Event	Date
Opt out (exclusion)	November 30, 2026
Object	November 30, 2026
Submit online claim	December 29, 2026, 11:59 p.m. CT
Mail paper claim	Postmarked by December 29, 2026
Final approval hearing	January 29, 2027, 10:00 a.m. CT
Payments	After final approval and any appeals

How to File a Claim

Online:

1. Go to CardiologyDataIncident.com and select Submit Claim, or use the direct claim form.
2. Enter the identifying information requested.
3. Choose your benefits: documented losses, pro rata cash, credit monitoring, or a combination.
4. Upload supporting records if you claim documented losses.
5. Submit and save your confirmation.

By mail: Download the claim form from the documents page, complete it, attach any required documents and mail it, postmarked by December 29, 2026, to:

Settlement Administrator – 83473 c/o Kroll Settlement Administration LLC P.O. Box 225391 New York, NY 10150-5391

Use only the official form. Do not send financial records or sensitive information in an unsolicited letter, and never pay anyone to file for you.

Your Options: Claim, Opt Out, Object or Do Nothing

• Submit a claim: the only way to receive benefits.
• Opt out: you get nothing from the settlement but keep any right to sue on your own. Opt-out requests must be mailed, include the information and original signature the notice requires, and be postmarked by November 30, 2026.
• Object: tell the court why you disagree. File with the court by November 30, 2026, with copies to counsel and the administrator as the notice requires. You can object and still file a claim.
• Do nothing: you get no benefits and, if the settlement becomes final, you give up the released claims.

If you are thinking about opting out to sue separately, talk to a licensed attorney first. Alabama’s general two-year limitations period for negligence-type claims (Ala. Code § 6-2-38(l)) and questions about when your claim accrued and whether the class action paused the clock could affect you.

Final Approval Hearing

The hearing is set for January 29, 2027, at 10:00 a.m. CT in Courtroom 6500, Mobile County Courthouse, 205 Government Street, Mobile, Alabama 36644, or by video conference. The court will decide whether the settlement is fair, reasonable and adequate and rule on attorneys’ fees and service awards. Under Alabama Rule of Civil Procedure 23(e), a class settlement requires court approval, and class members’ right to opt out is a due-process protection (Phillips Petroleum Co. v. Shutts, 472 U.S. 797 (1985)). The date can change, so check the settlement website.

There is no confirmed payment date. Payments and monitoring enrollment follow final approval and resolution of any appeals.

Laws That Apply to a Healthcare Data Breach

HIPAA

The Health Insurance Portability and Accountability Act sets federal rules for protected health information.

• Security Rule, 45 C.F.R. Part 164, Subpart C: requires covered entities and business associates to use administrative, physical and technical safeguards for electronic protected health information.
• Breach Notification Rule, 45 C.F.R. §§ 164.400 to 164.414: requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery (§ 164.404), notice to HHS (for breaches affecting 500 or more people, within 60 days under § 164.408) and notice to the media for large breaches in a state (§ 164.406).
• HITECH Act, 42 U.S.C. § 17932, and 42 U.S.C. § 1320d-5: civil penalties enforced by HHS’s Office for Civil Rights, and state attorneys general can bring HIPAA actions.
• HIPAA generally gives patients no private right to sue for damages. Private lawsuits like this one use state-law theories such as negligence.

Alabama law

• Alabama Data Breach Notification Act, Ala. Code § 8-38-1 et seq.: requires reasonable security measures and notice to affected Alabama residents, generally within 45 days (§ 8-38-5), plus notice to the Attorney General for larger breaches (§ 8-38-6). The Act is enforced through the Attorney General and the Alabama Deceptive Trade Practices Act and is generally understood not to create a private right of action. Confirm the current text before citing it for a specific point.
• Negligence and implied contract: the common-law theories alleged here.

Mississippi law

Because the practice serves the Gulf Coast, some affected people live in Mississippi. Mississippi’s breach notification statute, Miss. Code § 75-24-29, requires notice to affected residents and is generally enforced by the Attorney General.

Federal consumer protections

• Free credit freezes: federal law (15 U.S.C. § 1681c-1) lets you place and lift a credit freeze free of charge at each bureau, and an initial fraud alert is also free.
• FTC Act § 5, 15 U.S.C. § 45, covers unfair or deceptive practices, but is enforced by the FTC.

This settlement is not a finding that CAM violated HIPAA or any state notification law.

What To Do Whether or Not You File

• Place a credit freeze at Equifax, Experian and TransUnion. It is free.
• Review Explanation of Benefits statements and medical bills for services you did not get, a sign of medical identity theft.
• Check your credit reports at AnnualCreditReport.com and your bank statements.
• Report identity theft at IdentityTheft.gov (FTC).
• Consider an IRS Identity Protection PIN if your Social Security number was involved.
• Watch for phishing that uses your medical details. The settlement administrator will not ask you for your Social Security number by email or text.
• Taxes: settlement payments may have tax consequences. Reimbursements of actual losses are treated differently from other payments, so ask a tax professional.

Compare Other Data Breach Settlements

Each settlement has its own rules and deadlines. For other examples, see DotHouse Health Data Breach Class Action Settlement, $725,000 Fund, Up to $2,000 or an Estimated $40, Plus 2 Years of Credit Monitoring, Lowe Engineers Data Breach Settlement, $50 Cash or Up to $5,500 in Documented Losses, Plus Two Years of Credit Monitoring and Grayback Forestry Data Breach Class Action Settlement, $65 Cash or Up to $5,000, Plus 3 Years of Credit Monitoring. Some of them make you choose between documented losses and a cash payment. This one lets you request both. Being in one settlement does not make you eligible for another.

Frequently Asked Questions About the Cardiology Associates Settlement

Is the Cardiology Associates of Mobile data breach settlement legitimate?

Yes. It is described on a court-authorized settlement website run by Kroll Settlement Administration. Final approval is still pending.

Who is eligible?

U.S. residents whose personal or health information was identified as potentially affected by the October 2024 incident, including people who received notice, subject to the exclusions.

How much money can I get?

Up to $4,000 for documented losses, plus a pro rata cash payment. Neither amount is guaranteed, and payments depend on how many valid claims are filed.

Can I claim without receipts?

Yes, for the pro rata cash payment and credit monitoring. Documented losses require proof.

Can I get both the $4,000 reimbursement and the pro rata payment?

Yes, subject to approval and available funds.

Is credit monitoring included?

Yes: 24 months, with $1 million in identity theft insurance.

Do I need to have been a victim of identity theft?

No. You may still qualify for the pro rata payment and credit monitoring if you meet the class definition.

What is the claim deadline?

December 29, 2026. Online claims are due by 11:59 p.m. Central Time, and mailed claims must be postmarked by that date.

What is the opt-out deadline?

November 30, 2026, which is also the objection deadline.

What if I did not receive a notice?

Contact the administrator at 833-453-3702 to ask whether you are in the settlement records.

When will payments be sent?

No date has been announced. Payments follow final approval (hearing January 29, 2027) and any appeals.

Do I need a lawyer to file a claim?

No. You can file directly with the administrator at no cost. The court has appointed class counsel to represent the class.

Does this settlement mean CAM broke the law?

No. CAM denies wrongdoing, and the court has made no finding of liability.

Who can I call for help?

Kroll Settlement Administration: 833-453-3702.

Should You File a Claim?

If you received a CAM breach notice or believe your information was affected, filing a claim is free and takes a few minutes. People with no losses can still request the pro rata payment and credit monitoring, and people with documented expenses can seek up to $4,000. Decide by November 30, 2026 if you want to opt out or object, and file by December 29, 2026. No fixed individual payment or payment date has been announced.

Official Sources and Legal References

1. Cardiology Associates Data Breach Settlement, official website
2. Official online claim form
3. Long Form Settlement Notice (PDF)
4. Settlement Agreement (PDF)
5. Official Settlement FAQ
6. Settlement documents and printable claim form
7. Massachusetts, Cardiology Associates of Mobile notification (January 2025)
8. HIPAA Breach Notification Rule, 45 C.F.R. Part 164, Subpart D
9. 45 C.F.R. Part 164, Subpart C; 42 U.S.C. §§ 17932 and 1320d-5; 15 U.S.C. §§ 45 and 1681c-1; Ala. Code §§ 6-2-38 and 8-38-1 et seq.; Miss. Code § 75-24-29; Ala. R. Civ. P. 23; Phillips Petroleum Co. v. Shutts, 472 U.S. 797 (1985)

Disclaimer: AllAboutLawyer.com provides general U.S. legal information, not legal advice, and Israr Ahmad is not an attorney. No attorney-client relationship is created by reading this article. The settlement is not an admission of liability, and your eligibility and benefits are governed by the court-approved settlement terms and the administrator’s review of your claim. Consult a licensed attorney about opting out or your own legal options. AllAboutLawyer.com is not affiliated with the settlement administrator, the court or any party.