Mental Health Association Data Breach Settlement, Check If You Qualify, Campbell et al. v. Mental Health Association, Inc., No. 2579CV00419

There’s a guaranteed $40 waiting for you if Mental Health Association, Inc. sent you a data breach notice — no receipts, no explanation required. On top of that, everyone affected can enroll in three years of free credit monitoring with $1 million in identity theft coverage. MHA is paying to settle a lawsuit over a November 2024 cyberattack that exposed Social Security numbers and mental health records. You have until November 19, 2026, to file.

Mental Health Association Data Breach Settlement — Key Facts

Field	Detail
Settlement Amount	$300,000 cap on cash benefits to the class; up to $250,000 in attorneys’ fees and $5,000 in service awards paid separately by MHA
Claim Deadline	November 19, 2026
Who Qualifies	All persons whose Private Information was accessible because of the Data Incident that occurred on or around November 28, 2024
Estimated Payout	$40 flat (no proof needed), OR up to $5,000 for documented out-of-pocket losses, OR up to $75 for lost time — all subject to pro-rata reduction if total claims exceed the $300,000 cap
Proof Required (Yes/No)	No for the $40 flat payment; Yes for documented losses and lost-time claims
Settlement Status	Preliminarily approved (July 24, 2026); final approval hearing pending
Court & Case Number	Superior Court of Hampden County, Massachusetts — No. 2579CV00419
Law Alleged	UNVERIFIED — the official notice and FAQ describe the data incident but don’t name the specific causes of action pled
Administrator	Simpluris
Official Claim Site	mhadatasettlement.com/form/claim
Last Updated	September 7, 2026

Who Is Mental Health Association and Why Is It Being Sued Over a Data Breach?

Mental Health Association, Inc. is a Springfield, Massachusetts nonprofit that has provided residential and support services to people with mental illness, developmental disabilities, substance use disorders, and homelessness since 1960. Because its work depends on collecting sensitive intake and treatment records — diagnoses, medications, Social Security numbers — for a vulnerable client population, a breach of its systems exposed exactly the kind of information most people would never want made public. That’s what separates this from a typical retail hack: the files at risk here included medical diagnosis and medication information tied to real people receiving mental health care.

What Did Mental Health Association Do to Client Data in the November 2024 Breach?

MHA discovered that its computer systems had been accessed without authorization in a cyberattack that occurred on or around November 28, 2024. Files that were accessible during the incident may have contained each class member’s name, address, Social Security number, medical diagnosis or condition, medication, medical record number, other medical information, date of birth, and driver’s license number. Class representatives Chefon Campbell and Chyanne Grant sued in the Superior Court of Hampden County, Massachusetts, in the case now known as Campbell et al. v. Mental Health Association, Inc., Case No. 2579CV00419.

MHA denies doing anything wrong, and the court hasn’t ruled on who’s right. Instead, the parties agreed to settle to avoid the cost, delay, and uncertainty of a trial. The court granted preliminary approval of that deal on July 24, 2026, and settlement notices started going out to the class on August 21, 2026.

That’s a class defined by exposure, not by a purchase or a signup date — meaning if MHA or the administrator mailed or emailed you a notice about this incident, you don’t need to dig up anything else to be included.

Who Qualifies for the Mental Health Association Data Breach Settlement?

Here’s exactly how to know if you qualify for the Mental Health Association settlement claim.

• Anyone whose Private Information was accessible in the data incident that occurred on or around November 28, 2024
• People who received a written or emailed notice from MHA or the settlement administrator about this incident
• Current or former clients whose records were stored on the affected systems
• Anyone else — family members or otherwise — whose information happened to be included in MHA’s files, if it was accessible in the incident

Also excluded: the judge assigned to the case and their family and staff, MHA’s own officers and directors, and whoever actually carried out the cyberattack.

If you already got a notice in the mail or by email, you don’t need to prove you belong in this class — MHA’s own records already say you do.

Mental Health Association Clients Outside Massachusetts — Are You Still Covered?

Yes. The Settlement Class is defined by whose data was accessible in the incident — the official Class definition names no state or residency requirement at all. If you received notice, where you live doesn’t change your eligibility.

Not sure if you qualify for the Mental Health Association data breach settlement? A free consultation with a data privacy attorney can help before the November 19, 2026 deadline.

How Much Can Mental Health Association Data Breach Settlement Class Members Get?

There’s no single number here — MHA is offering several benefits, and what you get depends on which one you pick.

Every class member can claim a flat $40 cash payment with no proof required. If your actual losses ran higher, you can instead document out-of-pocket costs — things like credit monitoring fees, replacement ID costs, or fraud losses — for up to $5,000, as long as they happened between November 28, 2024, and November 19, 2026, and you back them up with receipts or statements. You can also claim up to three hours of lost time at $25 an hour, for a maximum of $75, if you spent time dealing with the breach.

Here’s the catch most coverage of this case skips. All three cash options draw from the same $300,000 pool. If the total value of valid claims exceeds that cap, every alternate cash payment gets reduced pro rata so the total doesn’t go over $300,000. Separately — and this doesn’t touch the cap — every class member can enroll in three years of free credit monitoring through CyEx Identity Defense Complete, with $1 million in identity theft insurance built in, whether or not they file a cash claim.

What Pro-Rata Means for Your Mental Health Association Payment

More people filing valid claims means smaller checks for everyone, since the $300,000 cap doesn’t grow. Fewer claims mean the $40 flat payment and documented-loss reimbursements are more likely to get paid in full.

What MHA Is Actually Paying, Beyond the $300,000 Cap

Class Counsel is asking the court for up to $250,000 in attorneys’ fees, plus $2,500 service awards for each of the two class representatives — $5,000 total. Those amounts come from MHA directly, not out of the $300,000 pool set aside for the class. Add it up, and MHA’s disclosed cash commitment runs to at least $555,000, on top of covering three years of credit monitoring for everyone affected.

Payments won’t go out until after the December 15, 2026 final approval hearing, and only after any appeals are resolved. Payments over $600 may appear on a 1099. Check with a tax professional.

That $40 is yours whether you were harmed or not. Skip the claim form, and you get nothing — not even the flat payment.

How to File Your Mental Health Association Data Breach Settlement Claim — Step by Step

1. Go to mhadatasettlement.com/form/claim, the official online claim portal run by Simpluris
2. Enter your name and contact information as it appears on your settlement notice
3. Choose your cash option — the no-proof $40 payment, documented losses up to $5,000, or lost time up to $75
4. Upload supporting documentation if you’re claiming documented losses or lost time — receipts, bank statements, or a brief description of how you spent the time
5. Separately enroll in the three years of free credit monitoring through CyEx Identity Defense Complete — this doesn’t require a cash claim
6. Submit and save your confirmation

Takes about 5 to 10 minutes. You have until November 19, 2026.

Should Mental Health Association Class Members Object Before November 19, 2026?

Does This Settlement Let You Opt Out?

The official notice and FAQ published for this settlement describe only three options — file a claim, object, or do nothing — and don’t spell out a separate procedure to exclude yourself from the class. If keeping your right to sue MHA independently matters to you, a class action lawsuit attorney can check the full Settlement Agreement for an exclusion right before the November 19, 2026 deadline.

How to Object to the Mental Health Association Settlement

Objecting means you stay in the class and can still get a payment — you’re just telling the court you think part of the deal is unfair. Written objections must include your name, address, phone number, and email; the case name and number; proof you’re a class member; a clear statement of your reasons; and your signature. They must be filed with the Clerk of the Hampden County Superior Court (50 State St., Springfield, MA 01103) and copied to the Settlement Administrator (MHA Data Incident Settlement, c/o Settlement Administrator, P.O. Box 25191, Santa Ana, CA 92799-9958) by November 19, 2026.

Talk to a class action lawsuit attorney before November 19, 2026 if you’re considering objecting or want to know your options for going it alone.

Mental Health Association Data Breach Settlement — Key Dates, 2026

Milestone	Date
Settlement Proposed / Preliminary Approval	July 24, 2026
Claims Period Opens (Notification Mailing)	August 21, 2026
Claim Filing Deadline	November 19, 2026
Opt-Out Deadline	UNVERIFIED — official notice describes no exclusion procedure
Objection Deadline	November 19, 2026
Final Approval Hearing	December 15, 2026
Expected Payment Date	UNVERIFIED — payments begin after final approval and resolution of any appeals; no fixed date set

Mental Health Association Data Breach — Frequently Asked Questions, No. 2579CV00419

Do I need a lawyer to file a Mental Health Association data breach settlement claim? 

No. Class Counsel — Casondra Turner of Milberg, PLLC and Leanna Loginov of Shamis & Gentile, P.A. — already represent the class at no cost to you. You can hire your own attorney at your own expense, but it isn’t required to get paid.

Is the Mental Health Association data breach settlement legitimate? 

Yes. It’s overseen by the Superior Court of Hampden County, Massachusetts, in Campbell et al. v. Mental Health Association, Inc., Case No. 2579CV00419, and administered by Simpluris. The court granted preliminary approval on July 24, 2026, with a final approval hearing set for December 15, 2026.

When will Mental Health Association settlement payments be sent? 

Not before the December 15, 2026 final approval hearing, and only after any appeals are resolved. No fixed payment date has been set yet.

What if I missed the Mental Health Association claim deadline?

 If your claim isn’t submitted or postmarked by November 19, 2026, you won’t receive a cash payment — the official notice states you’ll get no Settlement benefit if you do nothing.

Will my Mental Health Association settlement payment go on a 1099? 

Possibly, for payments over $600. Neither MHA, Class Counsel, nor the Settlement Administrator will advise you on your specific tax situation — check with your own tax professional.

What information was exposed in the Mental Health Association data incident?

 Files accessible during the incident may have included your name, address, Social Security number, medical diagnosis or condition, medication, medical record number, other medical information, date of birth, and driver’s license number.

Do I have to file a cash claim to get free credit monitoring from Mental Health Association? 

No. All Settlement Class Members can enroll in three years of credit monitoring through CyEx Identity Defense Complete, with $1 million in identity theft insurance, whether or not they file for a cash payment.

How much is Mental Health Association actually paying to settle this case? 

Cash benefits to the class are capped at $300,000. Separately, Class Counsel is requesting up to $250,000 in attorneys’ fees and $5,000 in service awards for the two class representatives, both paid by MHA — bringing MHA’s disclosed cash commitment to at least $555,000, not counting the cost of the credit monitoring.

Sources Used in This Mental Health Association Data Breach Article

• Official Settlement Website (Home) — Simpluris, 2026: https://mhadatasettlement.com/
• Official FAQ Page — Simpluris, 2026: https://mhadatasettlement.com/faq/
• Official Important Dates Page — Simpluris, 2026: https://mhadatasettlement.com/dates/
• Official Claim Form Portal — Simpluris, 2026: https://mhadatasettlement.com/form/claim

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against the official settlement website, FAQ page, and important dates page maintained by Simpluris, as of September 7, 2026. Last Updated: September 7, 2026.

This article is for informational purposes only and does not constitute legal advice. Laws vary by state and individual circumstances differ. For advice about your specific situation, consult a qualified attorney.

Editorial notes (not for publish)

• Source access issue: The Long Form Notice and Settlement Agreement PDF links you provided were pre-signed S3 URLs (X-Amz-Expires=900, dated 9/2/2026) that had already expired and, in one case, exceeded this tool’s URL length limit. I pulled the same content instead from the settlement website’s Home, FAQ, and Dates pages, which are official and administrator-published — but if you have a fresh, non-expiring link to the full Settlement Agreement, it’s worth a second pass to confirm nothing in the fee/benefit mechanics changed between drafts.
• Specific Law Broken: left UNVERIFIED. The FAQ describes the data incident and the settlement terms but never names the causes of action pled (negligence, breach of contract, etc.). I found similar-fact cases against other Massachusetts mental-health providers (Gandara Mental Health Center, different defendant) that cite negligence and related claims, but I didn’t carry that over — it would have been guessing at this defendant’s specific complaint from a different one.
• No opt-out found. Neither the settlement site’s homepage summary nor its FAQ describes a right to exclude yourself from the class — only claim, object, or do nothing. That’s unusual enough that I flagged it honestly in the article rather than inventing a standard opt-out deadline. Worth a look at the full Settlement Agreement if you can get a working link.
• Original element: the $555,000 total-disclosed-commitment math (the $300,000 cash cap plus the $250,000 fee request plus $5,000 in service awards, separate from the free credit monitoring) — pulled from FAQ Q7 and Q13 together, which most single-source summaries of this case won’t combine.
• Internal linking: Search turned up no existing AllAboutLawyer.com article on data breach settlements or mental-health-provider cases — anchor link and second internal link both SKIP. Given the site’s search visibility is still recovering, it’s worth checking your own CMS/category page directly for a data-breach hub article rather than relying on search results here.
• Before scheduling: run the 5-minute human edit pass, confirm this fits the current publishing ramp step and daily time slot, add Article + FAQPage + BreadcrumbList schema, and submit the URL to Bing Webmaster Tools and Google Search Console after it goes live.