Scrubs & Beyond and Kindthread Data Breach Settlement, Got a Notice? Here’s How to Claim Up to $2,500

301 Scrubs Investors LLC — the company behind Scrubs & Beyond and Kindthread — agreed to settle a class action lawsuit following a June 2024 targeted cyberattack that exposed the sensitive personal and employee information of thousands of healthcare workers and customers. If you received a notice about this breach, you may qualify for up to $2,500 in cash plus two years of free credit monitoring. You must file a claim to receive any benefit. The claim deadline is May 18, 2026.

Quick Facts

Current Status and What Happens Next

• Proposed settlement — the court has not yet granted final approval. The settlement is currently open for claims while the court review continues.
• Opt-out deadline: May 4, 2026 — if you want to preserve your right to sue 301 Scrubs independently, you must submit your exclusion request before this date.
• Final approval hearing: June 2, 2026 at 9:30 a.m. — if the court approves the settlement, the administrator will issue payments approximately 90 days after final approval and the resolution of any appeals

What Is the Scrubs & Beyond Data Breach Lawsuit About?

Scrubs & Beyond is one of the largest healthcare apparel retailers in the United States — operating 122 stores across 30 states and a major e-commerce platform — selling scrubs, uniforms, lab coats, and footwear primarily to healthcare professionals. The company operates under the parent entity 301 Scrubs Investors LLC, which also does business as Kindthread — a portfolio of healthcare and food service apparel brands including Landau, White Cross, and Chefwear.

On June 7, 2024, Kindthread detected unauthorized activity within its computer network. A targeted cyberattack had accessed certain files within the system between June 6 and June 9, 2024. Kindthread launched an investigation with third-party forensic specialists, but the review of impacted data was not completed until April 16, 2025 — nearly ten months after the breach. The company began sending breach notification letters on May 1, 2025.

Plaintiff Kevin Mitchael filed the class action lawsuit Kevin Mitchael v. 301 Scrubs Investors LLC d/b/a Scrubs & Beyond LLC d/b/a Kindthread, Case No. CACE-26-000716, in the Judicial Circuit Court for Broward County, Florida, alleging 301 Scrubs failed to implement adequate cybersecurity protections to safeguard the sensitive personal and employment information it held. 301 Scrubs denies any wrongdoing and the court has not made any finding that the company did anything wrong.

What Personal Information Was Exposed?

The June 2024 cyberattack potentially compromised a range of sensitive personal and employment information. The exact categories vary by individual, but the breach may have included:

• Full names and dates of birth
• Social Security numbers
• Employee identification numbers
• Driver’s license numbers
• Financial account information
• Passport numbers
• Medical and health insurance information
• Account usernames and passwords

Your breach notice specifies which categories of your information were potentially exposed. The combination of Social Security numbers, financial account data, and health insurance information creates a heightened risk of both financial fraud and medical identity theft. Enrolling in the two-year credit monitoring benefit — regardless of which cash option you choose — is strongly recommended.

Who Is Eligible to File a Claim?

• You may qualify if you received a notice from Scrubs & Beyond, Kindthread, or 301 Scrubs Investors LLC stating that the June 2024 cyberattack may have compromised your personal information.
• You may qualify whether you were a customer who purchased from Scrubs & Beyond or Kindthread, or an employee whose employment information was stored in the company’s systems.
• You may qualify if you reside in the United States.
• You do not qualify if you did not receive a notice from 301 Scrubs about this specific June 2024 breach incident.

Your settlement notice includes a unique ID and PIN that you need to file your claim online. Check your mail and email — including spam folders — for correspondence from Scrubs & Beyond, Kindthread, or the 301 Scrubs Data Incident Settlement Administrator. If you believe you should have received a notice but did not, contact Simpluris at 877-272-4962 or [email protected].

How Much Can You Receive?

The settlement offers three benefit options. You can also add credit monitoring to any cash option.

Documented losses cover unreimbursed out-of-pocket expenses you incurred directly as a result of the breach — including losses from identity theft or fraud, fees for freezing or unfreezing your credit, credit monitoring costs, costs to replace a government-issued ID, and postage to contact financial institutions. All claimed losses must have occurred between June 6, 2024, and May 18, 2026. You must submit supporting documentation such as receipts, bank statements, or credit card statements.

The $50 alternative cash payment requires no documentation whatsoever. If you have not experienced documented out-of-pocket losses but want compensation for the privacy risk and inconvenience, simply select this option on your claim form. This is the fastest option for busy healthcare professionals who do not have time to gather receipts.

CyEx Identity Defense Complete provides two years of comprehensive credit monitoring including real-time alerts, $1,000,000 in identity theft insurance, and access to fraud resolution specialists. You can claim this alongside either cash option.

How to File a Claim

Step 1 — Locate your unique ID and PIN from the settlement notice Scrubs & Beyond or Simpluris sent you by mail or email. You need both to file your online claim.

Step 2 — Visit the official claim portal at 301scrubsdatasettlement.com and click “Submit a Claim,” or download the PDF claim form to mail your submission to: 301 Scrubs Data Incident Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958.

Step 3 — Select your benefit option: documented losses, the $50 alternative cash payment, and/or two-year credit monitoring.

Step 4 — If claiming documented losses, upload your supporting documentation — receipts, bank or credit card statements, or other third-party records showing unreimbursed expenses linked to the breach. All losses must have occurred between June 6, 2024, and May 18, 2026.

Step 5 — Choose your preferred payment method. Digital payment options are available for online submissions. Paper check is available for mailed claim forms. Submit your completed claim online or mail it so it is postmarked by May 18, 2026.

Step 6 — Save your claim confirmation number or keep a copy of your mailed form for your records.

Estimated time to complete: 5 minutes for the $50 alternative payment; 15–20 minutes if uploading documentation for loss claims.

Important Deadlines and Dates

Frequently Asked Questions

Do I need a lawyer to file a claim in this settlement? 

No. You can file your claim directly at 301scrubsdatasettlement.com without hiring an attorney. Class counsel already represents all class members at no individual cost. If you want independent legal advice about your specific losses, you may hire your own attorney at your own expense.

Is this Scrubs & Beyond settlement legitimate?

 Yes. The settlement, Kevin Mitchael v. 301 Scrubs Investors LLC d/b/a Scrubs & Beyond LLC d/b/a Kindthread, Case No. CACE-26-000716, is a court-supervised class action pending in the Judicial Circuit Court for Broward County, Florida. The official settlement website is 301scrubsdatasettlement.com, administered by Simpluris, Inc. Verify any communication by calling 877-272-4962 or emailing [email protected].

When will I receive my payment? 

The final approval hearing is scheduled for June 2, 2026. If the court approves the settlement and no appeals follow, Simpluris will issue payments approximately 90 days after that process concludes. Online claim submissions may offer digital payment options for faster delivery.

What if I miss the May 18, 2026 claim deadline?

 If you do not file a claim by May 18, 2026, you will not receive any cash payment or credit monitoring benefit from this settlement. You will still be bound by the settlement’s release of claims against 301 Scrubs unless you opted out before May 4, 2026. File as early as possible — do not wait until the last day.

Will this settlement payment affect my taxes?

 Settlement payments may count as taxable income depending on the nature of the compensation and your individual tax situation. Simpluris will issue appropriate tax documentation if required. Consult a qualified tax professional to understand how to report your specific payment.

Why did it take nearly a year to notify affected customers and employees?

 Kindthread detected the breach on June 7, 2024, but did not complete its review of all impacted data until April 16, 2025 — approximately ten months later. The company then began sending breach notifications on May 1, 2025. While extended data reviews are not uncommon in large corporate breaches, the nearly one-year gap between discovery and notification limited the time affected individuals had to protect themselves. The lawsuit specifically highlighted this delay as a harm to class members.

Does this settlement cover employees as well as customers? 

Yes. The breach exposed both customer information and employee data — including employee identification numbers — stored in 301 Scrubs’ systems. If you worked for Scrubs & Beyond or Kindthread and received a breach notification, you are a class member and may file a claim under the same settlement terms as customers.

What is Kindthread and how is it related to Scrubs & Beyond?

 Kindthread is the parent brand portfolio that owns Scrubs & Beyond along with other healthcare and food service apparel brands including Landau, White Cross, and Chefwear. The legal entity behind all of these brands is 301 Scrubs Investors LLC, headquartered in Scottsdale, Arizona. If your breach notice came from Kindthread, Scrubs & Beyond, or any of its affiliated brands, you are covered under this same settlement.

Sources and References

1. Official Settlement Website — 301scrubsdatasettlement.com
2. Official Claim Portal — 301scrubsdatasettlement.com/form/claim
3. Settlement FAQ — 301scrubsdatasettlement.com/faq
4. Texas Attorney General — 301 Scrubs Investors Data Breach Notice, May 2025

Healthcare workers whose personal and medical information was exposed in multiple breaches may also want to review the Signature Performance $8.5 million data breach settlement covering patients of Adventist Health and UNC Health Southeastern with a claim deadline of May 7, 2026. If your Social Security number or health insurance information was also compromised in another recent healthcare breach, the General Physician P.C. $2.5 million data breach settlement with a claim deadline of May 27, 2026 may be another active claim opportunity worth filing before the summer 2026 wave of deadlines closes.

Last Updated: March 17, 2026

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Legal claims and outcomes depend on specific facts and applicable law. For advice regarding a particular situation, consult a qualified attorney.

About the Author

Sarah Klein, JD, is a licensed attorney and legal content strategist with over 12 years of experience across civil, criminal, family, and regulatory law. At All About Lawyer, she covers a wide range of legal topics — from high-profile lawsuits and courtroom stories to state traffic laws and everyday legal questions — all with a focus on accuracy, clarity, and public understanding.
Her writing blends real legal insight with plain-English explanations, helping readers stay informed and legally aware.
Read more about Sarah