Hospital Español Auxilio Mutuo $500,000 Data Breach Settlement, Claim $25 or Up to $2,500 by December 21, 2026 (Morales Rosario v. Hospital Español Auxilio Mutuo de Puerto Rico, Inc., No. 3:25-cv-01244-RAM)

Update log (October 20, 2026): Article published. The claim, opt-out and objection deadlines are all December 21, 2026. The Final Approval Hearing is January 20, 2027. The court has not yet given final approval.

If you were a patient at Auxilio Mutuo Hospital in San Juan, or you received a letter saying your information may have been exposed in a cyberattack on the hospital, there is now a $500,000 class action settlement with a claim form and a deadline. You are paid only if you file a valid claim by December 21, 2026. You choose one cash option: reimbursement of documented out-of-pocket losses up to $2,500, or a flat $25 payment. Class members can also enroll in two years of credit and medical monitoring.

Hospital Español Auxilio Mutuo denies the allegations and any wrongdoing, and the court has not decided who is right.

Hospital Español Auxilio Mutuo Data Breach Settlement: Quick Facts

Detail	Verified information
Case name	Jose A. Morales Rosario, et al. v. Hospital Español Auxilio Mutuo de Puerto Rico, Inc.
Case number	3:25-cv-01244-RAM
Court	U.S. District Court for the District of Puerto Rico
Defendant	Hospital Español Auxilio Mutuo de Puerto Rico, Inc., doing business as Auxilio Mutuo Hospital
Settlement amount	Up to $500,000 in monetary benefits to class members
Cash options (pick one)	Documented out-of-pocket losses up to $2,500, or an Alternative Cash Payment of $25
Other benefit	Two years of credit and medical monitoring
Who is covered	People residing in the United States whose personal information may have been accessed or acquired by an unauthorized party in the cyber incident
Claim deadline	December 21, 2026 (online by 11:59 p.m., or paper form postmarked by that date)
Opt-out and objection deadline	December 21, 2026 (postmarked)
Final Approval Hearing	January 20, 2027 (the official site lists two different times; see below)
Settlement administrator	Kroll Settlement Administration LLC, (833) 453-0919
Official website	hospitalespanolauxiliosettlement.com (Spanish version: hospitalespanolauxiliosettlement-es.com)
Status	Court-authorized notice is out; final approval pending

What Happened in the Auxilio Mutuo Hospital Data Breach

According to the hospital’s own notice, dated April 21, 2025, the U.S. Department of Homeland Security told Hospital Español Auxilio Mutuo on September 23, 2023 that its systems were the likely target of a criminal cyber group. An initial investigation found evidence consistent with unauthorized access on November 21, 2023. A second investigation reported on May 15, 2024 unauthorized activity typically associated with data theft on systems that held patient data.

The hospital says the evidence was inconclusive about what was actually taken. A review completed September 24, 2024 narrowed the potentially affected patients to those who visited the hospital between August 2022 and September 2023. It said it could not confirm exactly which data was affected for each person.

Neither the hospital’s notice nor the settlement website explains the technical method of attack. Do not describe it as a confirmed ransomware attack or a phishing incident, because neither source says so.

What Personal and Health Information May Have Been Exposed

The hospital’s notice listed contact details (name, address, date of birth, phone and email), plus one or more of the following:

Category	Examples
Health insurance information	Insurance details
Health information	Medical record numbers, diagnoses, medicines, test results
Billing and payment information	Billing and payment details
Other personal information	Social Security numbers, driver’s license or state ID numbers, passport numbers

Not everyone had every category involved. The hospital said it could not confirm exactly what was affected for each person. The hospital offered one year of free credit monitoring through Equifax. The settlement gives class members two years.

What the Morales Rosario Lawsuit Claims Against Hospital Español Auxilio Mutuo

The federal docket shows the case was filed on May 1, 2025 by Jose A. Morales-Rosario. An amended complaint adding Zelma Esteves Arreche and Daphne I. Carrion-Lozano as plaintiffs followed on September 10, 2025. The settlement website says the plaintiffs allege negligence and breach of implied contract, among other claims, and that the hospital failed to adequately protect sensitive information.

Under the settlement, the hospital is not admitting wrongdoing. Both sides agreed to resolve the case without a trial, and the court has not decided whether the allegations are true.

Who Qualifies for the Hospital Español Auxilio Mutuo Data Breach Settlement?

The settlement class is everyone residing in the United States whose personal information may have been accessed or acquired by an unauthorized party because of the cybersecurity incident. You do not have to live in Puerto Rico. Being a patient is not enough by itself. The question is whether your information may have been involved in this incident.

To file online, you need the Class Member ID printed on your notice. If you did not receive a notice or cannot find your ID, call Kroll at (833) 453-0919 or use the contact page on the settlement website. Spanish speakers can call the same number.

You do not need to prove identity theft to claim the $25 payment. You still have to be a class member and file a valid, timely claim.

How Much Can Auxilio Mutuo Patients Get From the $500,000 Settlement?

Each class member who files a valid claim picks one cash option. You cannot receive both.

Option 1: Up to $2,500 for documented losses

You may claim documented, unreimbursed losses that were more likely than not caused by the incident. Under the settlement terms, the loss must:

• Have occurred between September 2023 and December 21, 2026.
• Be more likely than not caused by the data incident.
• Not have been reimbursed by another source.
• Be supported by adequate third-party documentation, such as receipts or bank statements. Self-prepared documents alone are not enough.
• Have been reasonably mitigated, including by using available credit monitoring.

The $2,500 is a maximum, not an automatic payment. If your documented loss is $180, you can claim $180, not $2,500.

Related article: Kayem Foods Meat Recall 2026, USDA List of Recalled Hot Dogs, Bacon, Sausage, Ham and Poultry

Option 2: $25 Alternative Cash Payment

This is for class members who do not want to document a specific loss. No receipts are required.

Could payments be reduced?

Yes. The settlement terms allow cash payments to be reduced proportionally if total claims would exceed the $500,000 cap on monetary benefits. The $25 and $2,500 figures are therefore the settlement’s stated amounts, not guarantees.

Who pays the lawyers and the administrator?

The hospital has agreed to pay the service awards, the notice and administration costs, and the attorneys’ fees and costs separately, so those come on top of the $500,000 rather than out of it. The court decides the final amounts.

Two Years of Credit and Medical Monitoring Under the Auxilio Mutuo Settlement

Class members who do not opt out can enroll in two years of one-bureau credit and medical monitoring, including at least $1 million in fraud protection, through the provider named in the settlement (CyEx). You do not need to file a cash claim to be eligible. Enrollment uses the unique code in your notice and begins after final approval. If you do not know your code, contact Kroll.

Monitoring can flag suspicious activity but cannot guarantee identity theft will not happen. Read the program terms for coverage limits and exclusions.

For another healthcare breach settlement with a different payout structure, see ModMed Data Breach Settlement, $2.99M Fund, Claim by November 2, 2026.

How to File a Hospital Español Auxilio Mutuo Settlement Claim

1. Open the claim form. Go to hospitalespanolauxiliosettlement.com and click Submit Claim.
2. Log in with the Class Member ID from your notice.
3. Enter your contact information and go to the settlement benefits section.
4. Pick one cash option: $25, or documented losses up to $2,500 with your supporting records.
5. Select your payment method, then read and sign the attestation. The online form has six steps: login, instructions, contact information, settlement benefits, payment selection, and attestation and signature.
6. Submit by 11:59 p.m. on December 21, 2026 and save your confirmation and copies of anything you upload.

Prefer paper? Download the Claim Form from the Documents page and mail it, postmarked by December 21, 2026, to:

Hospital Español Auxilio Mutuo De Puerto Rico, Inc. Data Incident c/o Kroll Settlement Administration LLC P.O. Box 225391 New York, NY 10150-5391

Should You Opt Out of or Object to the Hospital Español Auxilio Mutuo Settlement?

You have four choices. The deadline for the first three is December 21, 2026.

File a claim. This is the only way to get a cash payment. You still get the monitoring offer, and you release your claims against the hospital over this incident.

Opt out. You get no benefits but keep the right to sue the hospital yourself over the claims this settlement resolves. Mail a signed request, postmarked by December 21, 2026, that identifies the case, states that you want to be excluded, and includes your full name and current address, to: Hospital Español Auxilio Mutuo De Puerto Rico, Inc. Data Incident, c/o Kroll Settlement Administration LLC, ATTN: Requests for Exclusion, P.O. Box 225391, New York, NY 10150-5391.

Object. If you stay in the class and disagree with the deal, you can tell the court why. An objection must be postmarked by December 21, 2026 and meet the requirements in the Long Form Notice. An objection does not stop you from filing a claim. You cannot both opt out and object.

Do nothing. You get no cash payment, you give up the right to sue the hospital over the resolved claims, and you can still get the monitoring offer.

Hospital Español Auxilio Mutuo Data Breach Settlement: Key Dates

Date	Event
September 23, 2023	DHS tells the hospital its systems were the likely target of a criminal cyber group
November 21, 2023	First investigation finds evidence consistent with unauthorized access
May 15, 2024	Second investigation reports activity typically associated with data theft
September 24, 2024	Hospital limits potentially affected patients to those who visited between August 2022 and September 2023
April 21, 2025	Hospital publishes its Notice of Data Breach
May 1, 2025	Morales Rosario lawsuit filed in federal court in Puerto Rico
September 10, 2025	Amended complaint filed
December 21, 2026	Deadline to file a claim, opt out or object
January 20, 2027	Final Approval Hearing

The Final Approval Hearing Time Is Listed Two Different Ways

The settlement website’s home page and documents page list the January 20, 2027 hearing at 9:30 a.m. Atlantic Standard Time, while the FAQ lists 1:30 p.m. Atlantic Standard Time. Confirm the time with Kroll or the court before you plan around it. The listed location is the Clemente Ruiz Nazario U.S. Courthouse, 150 Carlos Chardón Street, Hato Rey, Puerto Rico. The discrepancy does not affect the December 21, 2026 deadlines.

Which Laws Apply to the Auxilio Mutuo Data Breach? HIPAA, Puerto Rico Act 111-2005 and Negligence

The settlement does not establish that any law was violated. These are the legal frameworks behind the dispute.

HIPAA Breach Notification Rule and the Auxilio Mutuo Notice Timeline

HIPAA sets privacy and security rules for covered healthcare providers like hospitals. Its Breach Notification Rule, 45 C.F.R. §§ 164.400–414, requires notice to affected individuals after a breach of unsecured protected health information, without unreasonable delay and no later than 60 days after discovery. HHS explains the rule on its website.

The gap between the 2023 events and the hospital’s April 21, 2025 notice makes the discovery date a natural question. But the date of the incident is not the same as the legal “discovery” date, and the settlement does not find that the hospital missed any deadline. Also, HIPAA does not generally let individuals sue for damages for a HIPAA violation alone. Claims usually rest on state or territorial law.

Puerto Rico Act No. 111-2005 (Ley de Información al Ciudadano sobre la Seguridad de Bancos de Información)

Puerto Rico’s Act No. 111-2005 addresses security breaches involving personal information of Puerto Rico residents. It requires notice to affected residents, and related reporting to the Department of Consumer Affairs, in qualifying circumstances, as expeditiously as possible with allowance for law-enforcement needs and restoring system security. Whether it applies depends on the statute’s conditions and the facts of the incident, and the settlement does not find that the hospital violated it.

Negligence, Negligence Per Se and Implied Contract Claims Against Hospital Español Auxilio Mutuo

Negligence requires a duty of care, breach, causation and recognized damages. The plaintiffs allege the hospital failed to protect sensitive patient information, and the amended complaint asserts related theories including negligence per se, unjust enrichment, invasion of privacy and breach of fiduciary duty. Negligence per se can allow a statutory or regulatory violation to help prove breach. An implied-contract claim asks whether patients who gave their information had an implied expectation that it would be safeguarded. A cyberattack by itself does not prove any of these claims.

What a Federal Class Settlement Means Legally

The settlement is a negotiated resolution in the U.S. District Court for the District of Puerto Rico. The court must still decide at the Final Approval Hearing whether it is fair, reasonable and adequate. It is not a finding that the hospital was negligent, breached a contract, or violated HIPAA or Puerto Rico law.

See also our coverage of Susan B. Allen Memorial Hospital Data Breach Settlement, Check If You Qualify — In Re, Susan B. Allen Data Security Litigation, No. BU-2025-CV-000185.

How Does the Auxilio Mutuo Settlement Compare With Other Healthcare Data Breach Settlements?

Healthcare breach settlements vary. Some pay only a small flat amount, while others allow larger documented-loss claims. The Auxilio Mutuo settlement follows a common model: a small no-documentation payment, a larger reimbursement option for proven losses, and monitoring services. The headline $500,000 is a cap on monetary benefits, not what each person receives, and cash payments can be reduced proportionally if claims exceed it.

For comparison, see Chimienti & Associates Data Breach Settlement, Check If You Qualify — David Fonseca v. Chimienti & Associates, No. VCU315048 and Wayne Memorial Hospital Data Breach Settlement, Check If You Qualify Bates, et al. v. Wayne Memorial Hospital Auxiliary, Inc., No. SUCV2025000239. More open and closed payouts are in our Settlements section.

Frequently Asked Questions About the Hospital Español Auxilio Mutuo Data Breach Settlement

Is the Hospital Español Auxilio Mutuo data breach settlement approved?

Not finally. A federal court has authorized notice, but the court must still grant final approval after the January 20, 2027 hearing. No payments are made until then.

How much is the Hospital Español Auxilio Mutuo settlement payment?

Up to $2,500 for documented out-of-pocket losses, or a $25 Alternative Cash Payment. You pick one. Payments can be reduced proportionally if total claims exceed the $500,000 cap.

What is the Hospital Español Auxilio Mutuo claim deadline?

December 21, 2026. File online by 11:59 p.m. that day or mail a paper claim postmarked by then.

Do I need a claim form to get paid by Hospital Español Auxilio Mutuo?

Yes. A valid, timely claim form is the only way to receive a cash payment.

Do I need receipts for the $25 Auxilio Mutuo payment?

No. The $25 option does not require proof of a loss. You still must file a valid claim by December 21, 2026.

Can I claim both the $25 and the $2,500 Auxilio Mutuo payments?

No. They are alternatives. Monitoring is separate and can be combined with either.

Do I get anything if I do not file a claim in the Auxilio Mutuo settlement?

No cash payment. You can still enroll in credit and medical monitoring if you do not opt out, and you give up the right to sue the hospital over the resolved claims.

Who qualifies for the Hospital Español Auxilio Mutuo data breach settlement?

People residing in the United States whose personal information may have been accessed or acquired by an unauthorized party in the cyber incident. You do not have to live in Puerto Rico.

Can I sue Hospital Español Auxilio Mutuo on my own instead?

Only if you opt out by December 21, 2026. Opting out means no settlement benefits. Talk to a qualified attorney about timing and your options first.

Does the settlement prove Hospital Español Auxilio Mutuo violated HIPAA?

No. The hospital denies wrongdoing, and the settlement is not a finding that HIPAA or any other law was violated.

Is the Hospital Español Auxilio Mutuo settlement legitimate?

The settlement website says it is court-authorized and is the only authorized website for this case. Claims are handled by Kroll Settlement Administration LLC, and it costs nothing to file.

When will Hospital Español Auxilio Mutuo settlement payments be sent?

No payment date has been published. Payments follow final approval and any appeals.

Sources

• Official settlement website, Kroll Settlement Administration LLC: https://www.hospitalespanolauxiliosettlement.com/
• Documents page: https://www.hospitalespanolauxiliosettlement.com/documents
• FAQ page: https://www.hospitalespanolauxiliosettlement.com/faq
• Online claim form: https://forms.ksacms.com/efiling/fr/tform/hospitalespanolauxiliosettlement_claimform/new?form-version=1&fr-wizard-page=section-1
• Hospital Español Auxilio Mutuo de Puerto Rico, Inc., “Notice of Data Breach,” April 21, 2025: https://www.newswire.com/news/notice-of-data-breach-22560594
• Docket, Morales-Rosario v. Hospital Espanol Auxilio Mutuo de PR, Inc., 3:2025cv01244, U.S. District Court for the District of Puerto Rico, via Justia: https://dockets.justia.com/docket/puerto-rico/prdce/3:2025cv01244/187462
• HHS, HIPAA Breach Notification Rule: https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
• Puerto Rico Act No. 111-2005: https://bvirtualogp.pr.gov/ogp/Bvirtual/leyesreferencia/PDF/Informatica/111-2005.pdf

This article is general legal information, not legal advice or medical advice. The settlement agreement and court orders control if they differ from this summary. For advice about your situation, consult a qualified attorney. If you think your health information was misused, contact your insurer and a healthcare provider.

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against the official settlement website (hospitalespanolauxiliosettlement.com), the hospital’s own April 21, 2025 data breach notice and the federal court docket as published by Justia, as of October 20, 2026. Last Updated: October 20, 2026.