Concord Orthopaedics Data Breach Settlement, Your Medical Records Were Exposed in the Concord Orthopaedics Hack Here’s What You Can Claim

A cyberattack hit Concord Orthopaedics in November 2024 and exposed the private medical and financial records of 72,815 patients. A class action lawsuit followed, and Concord Orthopaedics has now agreed to settle. If you received a notification that your information was compromised, you can claim a flat $50 cash payment, up to $100 for time you spent dealing with the breach, or up to $3,000 if you have documented losses from identity theft or fraud. The claim deadline is July 8, 2026.

Field	Detail
Case Name	Montambeault, et al. v. Concord Orthopaedics Professional Association
Case Number	217-2025-CV-00292
Claim Deadline	July 8, 2026
Who Qualifies	Patients notified of the November 2024 data breach
Payout Range	$50 flat / up to $100 lost time / up to $3,000 documented losses
Proof Required	Only for documented losses; no proof for $50 or lost time
Settlement Status	Preliminarily Approved
Administrator	Simpluris
Official Website	concorddatasettlement.com

Where things stand:

• Settlement notices went out to affected patients on March 26, 2026. The opt-out and objection deadlines are both May 26, 2026.
• The final approval hearing is scheduled for June 23, 2026 at 10:00 a.m.
• Payments go out after the court grants final approval and resolves any appeals — no confirmed payment date yet.

A November 2024 Cyberattack Exposed Social Security Numbers, Medical Records, and More

In November 2024, hackers carried out a targeted cyberattack on Concord Orthopaedics’ computer systems. Certain files containing private information were accessed, including names, dates of birth, Social Security numbers, appointment details, health insurance information, and driver’s license or state identification numbers.

The lawsuit — Montambeault, et al. v. Concord Orthopaedics Professional Association — alleges that Concord Orthopaedics failed to adequately protect that sensitive personal information. The case is pending in the Superior Court of Hillsborough County, New Hampshire.

This type of data — Social Security numbers combined with medical records and insurance details — creates a specific risk. Thieves can use it to open credit accounts, file fraudulent medical claims, or impersonate patients with healthcare providers. That combination is why the settlement offers both identity monitoring and cash reimbursement for actual fraud-related losses.

Concord Orthopaedics denies any wrongdoing, and the court has not decided who is right. The parties agreed to settle to avoid the costs, risks, and uncertainty of continued litigation.

You Got a Notice in the Mail — That Means You’re Almost Certainly In

If you received a notice of the settlement, Concord Orthopaedics’ records indicate you are a settlement class member and entitled to benefits under the settlement.

You may qualify if:

• You received a data breach notification letter from Concord Orthopaedics about the November 2024 incident
• Your personal information — including names, Social Security numbers, health insurance data, or similar records — was identified in the breach
• You are a U.S. resident
• The class includes both adults and minors whose information was accessed, as well as any other individuals whose data was identified in the breach.

You do not need to prove you experienced identity theft to file. Every class member qualifies for at least the $50 flat payment or the free medical identity monitoring — no documentation required for either.

If you are unsure whether you are included, contact the settlement administrator by email at [email protected] or by phone at 844-804-3481.

Related article: Jan. 6 Participants Are Suing the Police Who Stopped Them Here’s What the Lawsuit Actually Claims

Three Ways to Claim — Pick the One That Fits Your Situation

Class members can claim several types of benefits depending on their circumstances and the documentation they can provide.

Option 1 — $50 Flat Cash Payment (No Documentation Required) If you do not have documented losses and do not want to calculate hours spent dealing with the breach, claim the flat $50 alternate cash payment. No receipts, no proof, no calculation needed.

Option 2 — Up to $100 for Lost Time (No Documentation, Attestation Only) If you spent time responding to the breach — changing passwords, investigating suspicious activity, contacting banks, or researching the incident — you can claim up to four hours at $25 per hour, for a maximum of $100. You do not need documentation, but you must attest to the time spent.

Option 3 — Up to $3,000 for Documented Out-of-Pocket Losses If you experienced actual financial harm from identity theft or fraud tied to this breach, you can claim up to $3,000 in reimbursement. Eligible expenses include losses from identity theft or fraud, fees for credit reports or credit monitoring, costs to freeze or unfreeze credit, costs to replace IDs, and postage for contacting banks or institutions.

Class members may claim either lost time or the flat $50 payment, but not both. Those who claim documented losses may also add either the lost time or the $50 payment on top.

Option 4 — Free Medical Identity Monitoring (Available to All Class Members) All class members can also enroll in one year of CyEx Medical Shield Complete, which includes $1 million in medical identity theft insurance and monitoring for healthcare insurance ID exposure, medical record number exposure, and unauthorized health savings account spending. This is available regardless of which cash option you choose.

How to File Your Claim Before July 8, 2026

Step 1 — Go to concorddatasettlement.com and click “Submit a Claim.”

Step 2 — Log in using your Class Member ID from the settlement notice you received by mail. If you cannot locate it, contact Simpluris at 844-804-3481 or [email protected].

Step 3 — Select your benefits — Medical Shield Monitoring, documented losses reimbursement, lost time, or the $50 flat cash payment.

Step 4 — Attach documentation if claiming losses. Bank statements, receipts, or other supporting documents are required for documented loss claims. Self-prepared notes alone are not sufficient, but can support other documentation.

Step 5 — Choose your payment method. Options include PayPal, Venmo, Zelle, a virtual prepaid card, or a physical check mailed to your address.

Step 6 — Submit and save your confirmation. You can file online, by email to [email protected], or by mailing the printed form to: Concord Orthopaedics Data Breach Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958.

Estimated time to complete: 5–10 minutes (longer if gathering documentation for losses).

The Key Dates Between Now and Getting Paid

Milestone	Date
Notification Mailing	March 26, 2026
Opt-Out Deadline	May 26, 2026
Objection Deadline	May 26, 2026
Final Approval Hearing	June 23, 2026 at 10:00 a.m.
Claim Filing Deadline	July 8, 2026
Expected Payment Date	TBD (after final approval and appeals)

Frequently Asked Questions

Do I need a lawyer to file a claim?

 No. The entire process happens through the official settlement website at concorddatasettlement.com. You log in with your Class Member ID from your notice, choose your benefit type, and submit. No attorney is needed or required.

Is this settlement legitimate? 

Yes. Montambeault, et al. v. Concord Orthopaedics Professional Association, Case No. 217-2025-CV-00292, is a court-supervised class action pending in the Superior Court of Hillsborough County, New Hampshire. The settlement administrator is Simpluris, a nationally recognized claims administration firm. The only official settlement website is concorddatasettlement.com.

When will I receive my payment? 

No confirmed payment date exists yet. The court holds a final approval hearing on June 23, 2026. Payments go out after approval and after any appeals are resolved. Monitor concorddatasettlement.com for updates.

What if I missed the claim deadline?

 The July 8, 2026 deadline is firm. After that date, you cannot file a claim for cash or lost time reimbursement. If you want to preserve the right to sue Concord Orthopaedics independently, you must opt out by May 26, 2026 — which is earlier.

Will this settlement payment affect my taxes?

 Potentially yes. Payments characterized as compensation for out-of-pocket losses may or may not be taxable depending on your specific situation. Payments for “lost time” and flat cash payments may be treated as ordinary income. Consult a tax professional with questions about your individual return.

What’s the difference between the $50 payment and the lost time claim? 

The $50 alternate cash payment is a flat payout with zero documentation or calculation required — the easiest option. The lost time claim pays $25 per hour for up to four hours (max $100), but requires you to attest to the actual hours you spent dealing with the breach. You cannot claim both, so if you spent more than two hours responding to the breach, the lost time claim pays more.

What does the medical identity monitoring actually cover?

 CyEx Medical Shield Complete provides one year of monitoring for healthcare insurance ID exposure, medical record number exposure, and unauthorized health savings account spending, plus $1 million in medical identity theft insurance. It focuses specifically on healthcare identity fraud — the category of risk most relevant when a medical provider’s records are breached.

What if I want to sue Concord Orthopaedics on my own instead? 

You can opt out of the settlement by May 26, 2026. Opting out allows you to sue, continue to sue, or be part of another lawsuit against Concord Orthopaedics related to the claims in this case. If you do nothing and miss the opt-out deadline, you give up those rights automatically.

Sources & References

• Official settlement website: concorddatasettlement.com
• Settlement Agreement: Simpluris document portal
• Official Class Notice: Simpluris document portal
• Superior Court of Hillsborough County, New Hampshire — Case No. 217-2025-CV-00292

Last Updated: March 31, 2026

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Legal claims and outcomes depend on specific facts and applicable law. For advice regarding a particular situation, consult a qualified attorney.