DotHouse Health Data Breach Class Action Settlement, $725,000 Fund, Up to $2,000 or an Estimated $40, Plus 2 Years of Credit Monitoring

Patients whose information may have been exposed in a November 2022 cybersecurity incident involving DotHouse Health may be eligible for benefits under a proposed class action settlement. Eligible class members can choose one cash option: reimbursement of up to $2,000 for documented out-of-pocket losses, or a pro rata cash payment currently estimated at $40 with no receipts needed. They can also claim two years of CyEx Medical Shield Complete credit and medical identity monitoring with $1 million in financial fraud insurance.

Claim deadline: January 29, 2027. Objection deadline: December 29, 2026. Final approval hearing: January 19, 2027.

Official settlement website: DotHouseDataSettlement.com | File your claim online: dothousedatasettlement.com/form/claim

A note on the settlement amount: Some listings call this a “$750,000 settlement.” The official settlement FAQ states that DotHouse will establish a $725,000 Settlement Fund, and this article uses that figure. The fund also pays attorneys’ fees, litigation costs, service awards and administration costs before the remaining money goes to class member benefits.

The court granted preliminary approval on September 18, 2026. Final approval is still pending, and no payment date has been announced.

DotHouse Health Data Breach Settlement: Quick Facts

Detail	Information
Settlement name	DotHouse Data Incident Settlement
Lawsuit	Peter Samiotes, et al. v. DotHouse Health, Inc.
Docket number	2584CV01999
Court	Superior Court for Suffolk County, Massachusetts
Defendant	DotHouse Health, Inc. (DHI)
Data incident	November 2022 cybersecurity incident (activity between about October 31 and November 27, 2022)
Settlement Fund (official)	$725,000
Documented losses	Up to $2,000 (proof required)
Pro rata cash payment	Currently estimated at $40 (no proof required; not guaranteed)
Credit monitoring	2 years of CyEx Medical Shield Complete, with $1 million financial fraud insurance
Settlement class size	Approximately 145,000 individuals
Who can claim	Members of the “Notice Class” who meet the class definition below
Claim form required?	Yes
Official settlement website	DotHouseDataSettlement.com
Online claim form	dothousedatasettlement.com/form/claim
Claim deadline	January 29, 2027 (online, or paper claim postmarked)
Objection deadline	December 29, 2026
Final approval hearing	January 19, 2027
Settlement administrator	Simpluris
Administrator phone / email	(833) 296-0911 (toll-free, 24/7) / [email protected]

What Happened in the DotHouse Health Data Breach?

The lawsuit alleges that during a November 2022 cybersecurity incident affecting certain DotHouse Health systems, an unauthorized third party accessed files containing private information of some DotHouse patients. DotHouse Health is a healthcare provider serving the Dorchester community in Boston, Massachusetts.

The files may have contained:

• Names and addresses
• Dates of birth
• Medical record numbers
• Social Security numbers
• Treatment information
• Health insurance information

Not every person had every category exposed, and the settlement does not establish that each class member’s information was misused. DotHouse denies any wrongdoing, and the court has not decided who is right. Both sides agreed to settle to avoid the cost and risk of continued litigation.

Who Qualifies for the DotHouse Health Settlement?

The court defined the Settlement Class as:

“(i) former or current Massachusetts residents who were part of the Notice Class or (ii) individuals who were not and are not Massachusetts residents but are part of the Notice Class and choose to participate in the Settlement.”

The Notice Class is defined as the approximately 145,000 individuals who were sent notice of the Data Incident by DotHouse in or around July 2025 and whose notice was not returned as undeliverable.

In plain terms:

• Current or former Massachusetts residents in the Notice Class are included.
• People who never lived in Massachusetts can also participate if they are in the Notice Class and choose to participate.
• Being a patient, or hearing about the incident, does not by itself make you a class member. The July 2025 notice is central to eligibility.

Excluded: directors and officers of DotHouse; the judge(s) assigned to the case, their immediate family members and court staff.

What If I Did Not Get a Notice?

Contact the administrator for free help in checking whether you are a class member:

• Phone: (833) 296-0911 (toll-free, 24/7)
• Email: [email protected]
• Mail: DotHouse Data Incident Settlement, c/o Settlement Administrator, P.O. Box 25191, Santa Ana, CA 92799

Settlement Benefits: How Much Can You Get?

Benefit	Amount	Proof required?
Cash Payment for Documented Losses	Up to $2,000	Yes
Pro Rata Cash Payment	Currently estimated at $40	No
Credit monitoring (CyEx Medical Shield Complete)	2 years	No

You choose one cash option, and you can claim credit monitoring in addition to either one.

Option 1: Up to $2,000 for Documented Losses

This option reimburses actual, documented out-of-pocket losses caused by the Data Incident that occurred between October 31, 2022, and January 29, 2027. Covered expenses include:

• Losses from identity theft or fraud
• Fees for credit reports
• Fees for credit monitoring
• Fees to freeze or unfreeze credit
• The cost to replace IDs
• Postage to contact banks by mail

Proof: Send documents such as bank statements or receipts showing how much you spent or lost. You may also send notes or papers you made yourself to explain or support other proof, but those alone are not enough for a valid claim. Your proof should show the expenses were because of the Data Incident. You cannot claim expenses that a third party has already reimbursed.

$2,000 is a maximum, not a guaranteed amount.

Option 2: Pro Rata Cash Payment (Currently Estimated at $40)

Instead of the documented-loss payment, you may claim a one-time pro rata cash payment currently estimated at $40. You do not have to provide any proof or explanation.

The $40 is an estimate. The settlement states that a significant amount of money is expected to remain in the Settlement Fund after expenses and other benefits are paid, and all of the remaining money will be divided equally among everyone who claims a pro rata payment. The final amount depends on how many valid claims are filed and could be higher or lower than $40.

Credit Monitoring: CyEx Medical Shield Complete

All class members can claim two years of CyEx Medical Shield Complete, which includes monitoring for:

• Medical fraud or medical identity theft
• Unauthorized financial transactions
• Personal information associated with high-risk transactions
• One-bureau credit monitoring

It also includes access to a fraud resolution agent and $1 million of financial fraud insurance. The insurance is a protection benefit, not a cash payment, and is subject to its policy terms.

Related article: Woodloch Pines Data Breach Class Action Settlement, $60 Cash or Up to $3,500, Plus 2 Years of Credit Monitoring

How the $725,000 Fund Is Used

The Settlement Fund first pays court-approved attorneys’ fees and costs, service awards to the named plaintiffs and the cost of administering the settlement. The net remaining money pays class member benefits.

Item	Amount
Attorneys’ fees (requested)	Up to $250,000, plus reimbursement of litigation costs
Service awards	$2,500 for each of the six class representatives (up to $15,000 total)
Administration costs	Paid from the fund
Class member benefits	Net remaining fund

These amounts are subject to court approval and are paid from the Settlement Fund, not billed to class members. You are not charged for Class Counsel’s services.

How to File a DotHouse Health Settlement Claim

Option 1: File Online (Fastest)

1. Find your settlement notice and your LoginID and PIN.
2. Go to dothousedatasettlement.com/form/claim.
3. Choose your cash option: documented losses (up to $2,000) or the pro rata payment.
4. Choose whether to claim two years of credit monitoring.
5. If claiming losses, upload your supporting documents.
6. Submit by January 29, 2027 and save your confirmation.

Lost your LoginID or PIN? Email [email protected] or call (833) 296-0911 with your full name and mailing address.

Option 2: File by Mail

Download the printable Claim Form from the settlement website, or request one by phone, email or mail. Complete and sign it, attach supporting documentation if you are claiming losses, and mail it to:

DotHouse Data Incident Settlement c/o Settlement Administrator P.O. Box 25191 Santa Ana, CA 92799

Mailed claims must be postmarked no later than January 29, 2027.

Important DotHouse Settlement Deadlines

Event	Date
Preliminary approval order	September 18, 2026
Notice date	October 30, 2026
Objection deadline	December 29, 2026
Final approval hearing	January 19, 2027
Claims deadline	January 29, 2027

Is There an Opt-Out Deadline?

The administrator’s published Important Dates page and FAQ list an objection deadline and a claims deadline, but they do not list a separate opt-out (exclusion) deadline or procedure. If you are considering pursuing your own lawsuit, do not assume the objection date works as an opt-out date. Read the full Long-Form Notice and Settlement Agreement, and contact the administrator or an independent attorney before deciding.

How to Object (Deadline: December 29, 2026)

Objecting means telling the court why you think it should not approve the settlement. Your objection must include:

1. The case name and docket number: Peter Samiotes, et al. v. DotHouse Health, Inc., Docket No. 2584CV01999, Superior Court for Suffolk County, Massachusetts
2. Your full name, mailing address, telephone number and email address
3. All grounds for the objection, with any legal support known to you or your counsel
4. The number of times you have objected to a class action settlement in the past five years, the case captions and copies of any related orders
5. The identity of all counsel representing you, including any counsel who may be entitled to compensation related to the objection
6. For your counsel and their firm, the same five-year objection history and orders
7. Whether you or your counsel will appear at the Final Approval Hearing
8. Your own signature (your lawyer’s signature alone is not enough)

File the complete objection with the Clerk of Court, Suffolk County Superior Business Litigation Section, Suffolk County Courthouse, 3 Pemberton Square, 13th Floor, Boston, MA 02108, by December 29, 2026. Also send copies to the Settlement Administrator, Class Counsel (David Lietz, Milberg PLLC, 5335 Wisconsin Ave. NW, Suite 440, Washington, DC 20015) and defense counsel (Christopher Iaquinto, Holland & Knight LLP, 10 St. James Ave., 11th Floor, Boston, MA 02116).

Final Approval Hearing and Payment Timing

The court will hold the Final Approval Hearing on Tuesday, January 19, 2027, at the Superior Court for Suffolk County, Massachusetts, 3 Pemberton Square, 12th Floor, Boston, MA 02108. The judge will decide whether to approve the settlement, how much to award Class Counsel and whether to grant service awards, and will consider any objections. You do not have to attend. The date and time may change without further notice.

When will payments arrive? No date has been announced. Benefits will be distributed only if the court grants final approval and after any appeals are resolved. Do not contact the court or the Clerk about the settlement. Contact the administrator instead.

What Happens If You Do Nothing?

You will receive no benefits from the settlement, and if final approval is granted you will give up the legal claims described in the release (Section XIII of the Settlement Agreement). That means you cannot be part of another lawsuit against DotHouse over the issues the settlement covers.

Laws and Legal Rules Relevant to the DotHouse Health Data Breach

The settlement does not publish an itemized list of the original legal claims, and the court has made no finding that DotHouse violated any specific law. The following is general background on the legal framework for healthcare data breaches.

Massachusetts Data Breach Law: M.G.L. c. 93H

Chapter 93H governs the notification of data breaches involving Massachusetts residents’ “personal information.” Section 1 defines this as a resident’s name combined with a Social Security number, driver’s license or state ID number, financial account number, or credit/debit card number. Medical information alone is not necessarily within that statutory definition. Section 3 generally requires a business that owns or licenses such information to notify affected residents, the Attorney General and the Director of Consumer Affairs and Business Regulation as soon as practicable and without unreasonable delay after learning of a breach. Section 3A requires that when a breach involves Social Security numbers, the affected residents be offered credit monitoring services at no cost for a statutory period (18 months generally, or longer if the breached entity is a consumer reporting agency). The settlement provides two years of monitoring to claimants, and it does not establish that DotHouse violated Chapter 93H.

Massachusetts Data Security Regulation: 201 CMR 17.00

This regulation sets minimum standards for anyone who owns or licenses personal information about Massachusetts residents. It requires a comprehensive written information security program (201 CMR 17.03) with administrative, technical and physical safeguards. Section 17.04 adds computer system requirements, including secure user authentication, access controls, encryption of certain data and system monitoring. A cyberattack alone does not prove a violation. The question would be whether the safeguards in place met the regulation’s standards.

HIPAA Privacy, Security and Breach Notification Rules

HIPAA applies to “covered entities,” including many healthcare providers, and their “business associates.” The Security Rule requires safeguards for electronic protected health information. The Breach Notification Rule (45 CFR §§ 164.400–414) generally requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information. Breaches affecting 500 or more individuals also require notice to the U.S. Department of Health and Human Services and, in many cases, the media, while smaller breaches are reported to HHS on a different schedule. HIPAA does not generally give individuals a private right to sue for damages. Enforcement is primarily by HHS and state attorneys general. This settlement should not be described as a proven HIPAA violation.

Massachusetts Consumer Protection Law: M.G.L. c. 93A

Chapter 93A prohibits unfair or deceptive acts or practices in trade or commerce. Consumers who suffer a loss from such practices may bring claims, and Section 9 generally requires a written demand letter before suing, subject to its terms. A data security incident does not automatically establish a Chapter 93A violation, and this settlement is not a finding of one.

Massachusetts Patient Confidentiality and Privacy Laws

Massachusetts has additional protections for patient information and privacy, including M.G.L. c. 111, § 70E (patient rights, including confidentiality of medical records at covered facilities) and M.G.L. c. 214, § 1B (the statutory right against unreasonable, substantial or serious interference with privacy). Whether these apply to a particular incident depends on the facts and claims actually asserted.

Massachusetts Class Action and Settlement Rules

Class actions in Massachusetts Superior Court are governed by Rule 23 of the Massachusetts Rules of Civil Procedure. Under Rule 23(e), a class action settlement requires court approval after notice to class members, which is why a Final Approval Hearing is required before benefits are paid.

Federal Laws: FTC Act and Fair Credit Reporting Act

• FTC Act (15 U.S.C. § 45): Prohibits unfair or deceptive practices, which the FTC has applied to certain data security failures. The settlement materials describe no FTC action against DotHouse.
• Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.): Gives consumers rights to free annual credit reports and to free credit freezes and fraud alerts, which matters if you are deciding whether to pay for protection.

Breach Notification Laws vs. Private Lawsuits

A breach notification law generally says what an organization must do after a qualifying incident. A civil lawsuit is different: a plaintiff must establish a recognized legal claim, such as negligence or breach of contract, and prove its elements. This settlement resolves the dispute without any judicial finding that DotHouse violated a particular statute.

Steps to Protect Yourself After a Healthcare Data Breach

• Review bank, card and credit statements for unfamiliar activity.
• Read every explanation of benefits (EOB) from your health insurer and watch for services you did not receive. These can signal medical identity theft.
• Check your free credit reports at AnnualCreditReport.com.
• Consider a free credit freeze with Equifax, Experian and TransUnion.
• If your Social Security number was involved, consider an IRS Identity Protection PIN.
• Under HIPAA, you can ask a provider for an accounting of disclosures of your health information.
• Report identity theft to the FTC at IdentityTheft.gov.
• Keep receipts and records of breach-related expenses for a documented-loss claim.
• Be cautious of unexpected calls, texts or emails mentioning the breach. Settlement claims are filed only through the official website or administrator.

Who Represents the Class?

The court appointed the following Class Counsel:

• David K. Lietz, Milberg PLLC
• Raina Borrelli, Strauss Borrelli PLLC

The six named class representatives are Peter Samiotes, Derek Holman, Ralph Davis, Frances Keough, Evbakhavbokun Von Idumwonyi and Tiara Thompson. Counsel for the defendant is Christopher Iaquinto of Holland & Knight LLP. You do not need your own lawyer to file a claim, but you may hire one at your own expense.

Related Data Breach Settlements

• New York School of Interior Design Data Breach Settlement: $50 Cash or Up to $5,500 in Documented Losses
• Riverside Resort & Casino $1.5M Data Breach Settlement
• Missouri Delta Medical Center Pixel Tracking Settlement: $20 Cash Payment

These are separate cases with different defendants, funds and eligibility rules. Qualifying for one does not qualify you for another.

Frequently Asked Questions

Is the DotHouse Health data breach settlement real?

Yes. It is administered by Simpluris through the official website DotHouseDataSettlement.com. The case is Peter Samiotes, et al. v. DotHouse Health, Inc., Docket No. 2584CV01999, in the Superior Court for Suffolk County, Massachusetts.

Is it a $750,000 or $725,000 settlement?

The official settlement FAQ states a $725,000 Settlement Fund. Some third-party listings use $750,000.

How much money can I claim?

Up to $2,000 for documented losses, or a pro rata payment currently estimated at $40 with no proof. You can also claim two years of credit monitoring.

Is the $40 guaranteed?

No. It is an estimate. The money left in the fund after expenses and other benefits will be divided equally among everyone who claims the pro rata payment.

Can I get both $2,000 and $40?

No. You must choose one cash option. Credit monitoring is available in addition to either.

Do I need proof for the $40 payment?

No, but you must still submit a valid Claim Form.

Do I need proof for up to $2,000?

Yes. You need receipts, bank statements or similar documents showing the amount and that the expense was because of the Data Incident. Your own notes alone are not enough.

Who qualifies?

Members of the approximately 145,000-person Notice Class who were sent notice in or around July 2025 (notice not returned as undeliverable). Current or former Massachusetts residents in that group are included. People who were never Massachusetts residents may participate if they are in the Notice Class and choose to.

Can I claim if I live outside Massachusetts?

Yes, if you are in the Notice Class and choose to participate.

What is the claim deadline?

January 29, 2027, for online claims and for mailed claims (postmarked).

What is the objection deadline?

December 29, 2026.

Is there an opt-out deadline?

The official Important Dates page and FAQ do not list one. Read the Long-Form Notice and Settlement Agreement or ask the administrator or an attorney before relying on any date.

Has the settlement received final approval?

Not yet. Preliminary approval was granted September 18, 2026, and the Final Approval Hearing is January 19, 2027.

When will payments arrive?

No date has been announced. Benefits are distributed after final approval and resolution of any appeals.

What happens if I do nothing?

You receive no benefits and you give up the claims covered by the settlement release.

Can a settlement payment affect my taxes?

Possibly. Tax treatment depends on your situation, so consult a qualified tax professional.

Legal Disclaimer

This article is for general informational purposes only and is not legal, tax or financial advice. The proposed settlement remains subject to final court approval. The allegations have not been proven, and DotHouse Health denies wrongdoing. Eligibility, benefits, legal rights and deadlines are governed by the official Long-Form Notice, Settlement Agreement and any later court orders. Dates and terms may change, so confirm all details on the official settlement website before acting. AllAboutLawyer.com is an independent legal information website, not a law firm, and does not represent any class member in this case. For advice about your own rights, including whether to object or pursue your own claim, consult a licensed attorney.

Sources

• Official Settlement Website: https://dothousedatasettlement.com/
• Official FAQ: https://dothousedatasettlement.com/faq/
• Important Dates: https://dothousedatasettlement.com/dates/
• Online Claim Form: https://dothousedatasettlement.com/form/claim
• Long-Form Notice: https://cw.simpluris.com/docs/public/downloads/DSC3/LONG_FORM_NOTICE
• Settlement Agreement: https://cw.simpluris.com/docs/public/downloads/DSC3/SETTLEMENT_AGREEMENT
• Printable Claim Form: https://cw.simpluris.com/docs/public/downloads/DSC3/CLAIM_FORM
• Massachusetts General Laws c. 93H, §§ 1, 3 and 3A (Data Breach Notification): https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H
• 201 CMR 17.00, Standards for the Protection of Personal Information: https://www.mass.gov/regulations/201-CMR-1700-standards-for-the-protection-of-personal-information-of-residents-of-the-commonwealth
• Massachusetts Requirements for Data Breach Notifications: https://www.mass.gov/info-details/requirements-for-data-breach-notifications
• Massachusetts Law About Medical Privacy: https://www.mass.gov/info-details/massachusetts-law-about-medical-privacy
• HIPAA Breach Notification Rule, 45 CFR §§ 164.400–414 (U.S. Department of Health and Human Services): https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
• Massachusetts General Laws c. 93A (Consumer Protection), c. 111 § 70E, c. 214 § 1B
• Massachusetts Rules of Civil Procedure, Rule 23 (Class Actions)
• Federal Trade Commission Act, 15 U.S.C. § 45
• Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq.