$3.85M Cardiovascular Consultants data breach settlement Your Medical Records Were Exposed, Here’s How to Claim Your Share of the Settlement

If Cardiovascular Consultants Ltd. sent you a data breach notice in late 2023, you have until July 1, 2026 to file a claim for up to $5,000 — plus two years of free medical monitoring. The Arizona-based cardiology practice agreed to pay $3.85 million to settle a lawsuit over a September 2023 cyberattack that exposed patients’ Social Security numbers, medical records, and other sensitive health information. You do not need a lawyer to claim your share.

Field	Detail
Settlement Amount	$3,850,000
Claim Deadline	July 1, 2026
Who Qualifies	U.S. residents who received a CVC data breach notice (Sept. 2023 breach)
Payout Per Person	Up to $5,000 for documented losses; estimated $75 pro rata cash payment
Proof Required	Yes, for out-of-pocket loss claims; No for cash payment or medical monitoring
Settlement Status	Open for Claims
Administrator	Kroll Settlement Administration LLC
Official Website	cvcdatasettlement.com

Where things stand right now:

• The settlement is open for claims through July 1, 2026 — the deadline to opt out is June 1, 2026.
• The final approval hearing is scheduled for August 18, 2026.
• Payments go out after the court grants final approval and resolves any appeals.

What Happened and Why Patients Are Suing

Cardiovascular Consultants Ltd. discovered a data breach in September 2023 that compromised sensitive personal and health information belonging to thousands of patients. The company notified affected individuals, and class members then filed a lawsuit under case number CV2023-020048 — Stroup, et al. v. Cardiovascular Consultants Ltd.

The lawsuit alleged the cardiology practice failed to put reasonable cybersecurity protections in place before the attack. Plaintiffs argued that stronger safeguards — the kind standard for healthcare organizations handling protected health information — could have prevented hackers from ever getting in.

The types of personal information exposed in the breach included names, Social Security numbers, addresses, dates of birth, contact information, driver’s license or state ID numbers, health insurance details such as policy and guarantor information, and medical information such as diagnosis and treatment records. Cardiovascular Consultants denied any wrongdoing but agreed to settle to avoid further litigation costs.

Did You Get a Notice? Here’s Whether You Qualify

Class members are part of the settlement if they resided in the United States at the time of the breach, the breach potentially compromised their personal information, and they received a notice of the data incident from Cardiovascular Consultants Ltd.

You likely qualify if:

• You received a data breach notification letter from Cardiovascular Consultants Ltd. related to the September 2023 incident
• You were a current or former patient of Cardiovascular Consultants Ltd.
• Your letter included a Class Member ID (you will need this to file online)
• You lived in the United States at the time of the breach

If you received a notice but misplaced it, contact Kroll Settlement Administration at 833-447-9408 to retrieve your Class Member ID before filing.

Related article: Krispy Kreme Data Breach Settlement Exposed Your Personal Data in 2024, Here’s How to Claim Up to $3,500 Until June 22

What You Can Actually Receive

The settlement offers three separate types of compensation — and you can claim more than one, as long as your total does not exceed $5,000.

Up to $5,000 for documented out-of-pocket losses. This covers documented, unreimbursed expenses that are fairly traceable to the data breach, including costs related to identity theft, fraud, credit monitoring, freezing or unfreezing credit reports, and other related expenses. You must submit third-party documentation — not self-prepared records — such as receipts, credit card statements, phone bills, or credit monitoring invoices.

An estimated $75 pro rata cash payment. This cash payment is estimated at $75 but is subject to increase or decrease depending on the total number of valid claims submitted and the amount of money remaining in the settlement fund after all other expenses are paid. No documentation required — just select the option on your claim form.

Two years of medical monitoring services. All claimants who request this benefit receive two years of medical monitoring. If there are insufficient settlement funds to cover this benefit, the settlement administrator may reduce the duration to one year. No proof required to claim this.

If any funds remain after the administrator pays all valid claims, the remainder goes to a nonprofit organization the court approves.

How to File Your Claim Before July 1, 2026

You can file online or by mail. Online is faster and allows you to select electronic payment.

1. Visit cvcdatasettlement.com or go directly to the claim form at forms.ksacms.com
2. Enter your Class Member ID from the breach notification letter you received
3. Choose your claim type — out-of-pocket losses, pro rata cash payment, medical monitoring, or a combination
4. Upload documentation if you are claiming out-of-pocket losses (receipts, bank statements, credit card statements)
5. Select your payment method — electronic payment (online filers only) or mailed check
6. Submit your claim and save your confirmation

To file by mail, download the PDF claim form at cvcdatasettlement.com, complete it, and postmark it by July 1, 2026 to: Settlement Administrator – 83376, c/o Kroll Settlement Administration LLC, Attn: Claims, P.O. Box 225391, New York, NY 10150-5391.

Estimated time to complete: 10 minutes.

Key Dates

Milestone	Date
Data Breach Occurred	September 2023
Breach Discovered & Reported	September 2023
Lawsuit Filed	2023
Opt-Out Deadline	June 1, 2026
Claim Filing Deadline	July 1, 2026
Final Approval Hearing	August 18, 2026
Expected Payment Date	TBD (after final court approval)

Frequently Asked Questions

Do I need a lawyer to file a claim? 

No. The claim form is straightforward and available at cvcdatasettlement.com. Class counsel — Perez Law Group PLLC and Cafferty Clobes Meriwether & Sprengel LLP — already represents the class as a whole. You do not need to hire your own attorney to participate.

Is this settlement legitimate?

 Yes. Stroup, et al. v. Cardiovascular Consultants Ltd. is a real class action lawsuit, Case No. CV2023-020048. Kroll Settlement Administration LLC is the court-appointed administrator. Only use cvcdatasettlement.com to file your claim — do not submit personal information to any other website claiming to manage this settlement.

When will I receive my payment?

 Payments go out after the court grants final approval and resolves any appeals. The final fairness hearing is August 18, 2026, so payments are unlikely before late 2026 or early 2027.

What if I missed the claim deadline? 

The deadline to file is July 1, 2026. If you miss it, you will not receive a payment from this settlement. The opt-out deadline is June 1, 2026 — missing that means you remain in the class and give up your right to sue Cardiovascular Consultants separately over this breach.

Will the settlement payment affect my taxes? 

It may. Settlement payments — particularly cash payments — can be considered taxable income depending on your circumstances. The medical monitoring benefit is typically not taxable. Consult a tax professional about your specific situation.

I didn’t suffer any financial losses. Can I still get paid?

 Yes. The pro rata cash payment (estimated $75) and the two-year medical monitoring benefit do not require any proof of loss. Simply select those options on your claim form — no documentation needed.

What exactly was in my records that got exposed?

 The breach may have exposed names, Social Security numbers, addresses, dates of birth, contact information, driver’s license or state ID numbers, health insurance details including policy and guarantor information, and medical information such as diagnosis and treatment details. Your breach notification letter may specify which of your records were affected.

What if I can’t find my Class Member ID? 

Your Class Member ID appears on the breach notification letter Cardiovascular Consultants sent you. If you cannot find it, call Kroll Settlement Administration at 833-447-9408 or email the administrator through the contact options on cvcdatasettlement.com.

Sources & References

• Official settlement website: cvcdatasettlement.com
• Class notice: cvcdatasettlement.com/files/Long-Notice.pdf

Last Updated: March 28, 2026

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Legal claims and outcomes depend on specific facts and applicable law. For advice regarding a particular situation, consult a qualified attorney.