Vida Y Salud-Health Systems $500,000 Data Breach Settlement, Claim Up to $3,500 by January 18, 2027

People whose private information was potentially affected by the October 2025 data breach at Vida Y Salud-Health Systems, Inc. (VSHSI) can claim two years of free medical identity monitoring and a cash payment. The cash options are up to $3,500 for documented losses, up to $80 for lost time, or a flat $50 with no proof. Total cash payments to the whole class are capped at $500,000.

You must file a claim to get a payment. The deadline is January 18, 2027. The deadline to opt out or object is January 4, 2027.

• Official settlement website: https://vsidatasettlement.com/
• Online claim form: https://vsidatasettlement.com/form/claim/
• Settlement documents and dates: https://vsidatasettlement.com/documents/ and https://vsidatasettlement.com/dates/

Status as of October 22, 2026: This is a proposed settlement. The court has not granted final approval. The final approval hearing is February 2, 2027 at 9:00 a.m. Central Time, by Zoom. Payments will not go out until the court approves it and any appeals are resolved.

Quick Facts

Detail	Information
Case name	Murray, et al. v. Vida Y Salud-Health Systems, Inc.
Case number	26-01-15726-ZCV
Court	293rd District Court, Zavala County, Texas
Defendant	Vida Y Salud-Health Systems, Inc. (VSHSI)
Cap on cash benefits	$500,000 (payments reduced pro rata if claims exceed it)
Documented out-of-pocket losses	Up to $3,500
Lost time	Up to 4 hours at $20 per hour, a maximum of $80
Alternative cash payment	One-time $50, instead of any other cash payment, no proof needed
Medical identity monitoring	Two years of CyEx Medical Shield Complete, with $1 million of medical identity theft insurance
Who is eligible	People residing in the U.S. whose private information was potentially impacted in the October 2025 data incident, including people who received notice
Official settlement website	https://vsidatasettlement.com/
Online claim form	https://vsidatasettlement.com/form/claim/
Claim deadline	January 18, 2027 (online, or paper claim postmarked)
Opt-out deadline	January 4, 2027
Objection deadline	January 4, 2027
Final approval hearing	February 2, 2027, 9:00 a.m. CT, via Zoom
Settlement administrator	Simpluris, Inc.
Administrator phone (24/7)	(866) 221-3193
Administrator email	[email protected]

What Happened in the VSHSI Data Breach?

VSHSI, based in Crystal City, Texas, is a community health provider that serves families in several South Texas counties. According to the settlement website, certain files containing private information were accessed during a data security incident affecting VSHSI in October 2025. Reports on the breach say VSHSI detected suspicious activity on its network on October 8, 2025, and that an unauthorized party accessed it between October 7 and 8.

What information may have been exposed. The settlement website says the files may have contained a person’s name, Social Security number, claims information, diagnosis or condition information, and credit card or bank account numbers. Not every person’s file necessarily had every item. Check the breach notice you received for what applied to you.

What “potentially impacted” means. Being in the class does not mean your information was misused. The settlement is based on the fact that files with private information were accessed, not on a finding that every person suffered fraud.

What Is the Lawsuit About?

The lawsuit alleges that, during the October 2025 incident, files containing private information were accessed. The class representatives are Faith Murray, Henry Cherry, Guadalupe Munoz and Yolanda Cervera Lavenant.

VSHSI denies wrongdoing. The court has not decided who is right. Both sides settled to avoid the costs and risks of a trial and to let class members receive benefits. The official materials do not list every legal claim in the original petition, so this article does not describe the claims beyond what the settlement website states.

Who Qualifies?

The court defined the class as:

All individuals residing in the United States whose Private Information was potentially impacted in the Data Incident affecting VSHSI on or around October 2025, including all those who received notice of the Data Incident.

• You do not have to live in Texas. The definition is based on U.S. residence and being potentially affected.
• A breach notice letter is strong evidence you are covered. The class definition expressly includes people who received notice. If you are unsure, ask the administrator for free help.
• Excluded: VSHSI and its officers, directors and related companies; anyone who validly opts out; the judge and the judge’s family and staff; and anyone who carried out the data incident.
• Notice mailing. The settlement dates page lists the notice mailing as beginning October 19, 2026. You may also have received an earlier letter directly from VSHSI. That earlier letter is not the settlement notice.

If you cannot find your settlement notice, contact the administrator at [email protected] or (866) 221-3193 and ask whether you are in the class and what you need to file.

Related article: L. Louise Lucas Indicted, Virginia Senator Faces Federal Racketeering, Marijuana Conspiracy and Money Laundering Charges

Settlement Benefits

1. Two Years of Medical Identity Monitoring

Every class member can claim two years of CyEx Medical Shield Complete. It includes:

• $1 million of medical identity theft insurance
• Monitoring for healthcare insurance ID exposure
• Monitoring for Medical Record Number exposure
• Monitoring for unauthorized Health Savings Account spending
• Access to a fraud resolution agent if something suspicious happens

Monitoring does not stop all identity theft. It alerts you so you can act.

2. Cash Payment Options

Option	Amount	Proof needed?
Out-of-pocket expenses	Up to $3,500	Yes, documentation
Lost time	Up to 4 hours at $20 per hour, a maximum of $80	You must have spent the time on tasks related to the incident
Alternative cash payment	One-time $50, instead of any other payment	No proof or explanation

Out-of-pocket expenses. These must be actual, documented losses caused by the data incident that occurred between October 7, 2025 and January 18, 2027. Covered examples:

• Losses from identity theft or fraud
• Fees for credit reports, credit monitoring, or freezing and unfreezing your credit
• The cost of replacing IDs
• Postage to contact banks by mail

Send proof such as bank statements or receipts showing the amount and that it was caused by the incident. You can add notes or papers you made yourself to explain other proof, but those alone are not enough. You cannot claim expenses that a third party has already reimbursed.

Illustration: if you paid $120 for credit monitoring and $80 in other documented, eligible costs, you could claim $200. That is an example, not a promise that any given expense will be approved.

Lost time. Examples include changing passwords, investigating suspicious account activity, and researching the incident.

The $50 alternative payment. This replaces the other cash options. It is the simple choice if you have no documented losses. It is not an extra $50 on top of a documented-loss or lost-time claim.

Can you combine cash options? The FAQ says you can claim one or more of the cash options, except that the $50 payment is instead of any other payment. So a person with both documented losses and lost time could claim both, for a theoretical maximum of $3,580, before any reduction.

Will You Actually Get the Maximum? The $500,000 Cap

There is an aggregate cap of $500,000 on monetary settlement benefits. If the total value of the monetary benefits claimed exceeds $500,000, everyone’s payments are reduced pro rata so they add up to $500,000.

The amounts above are therefore maximums. Your payment could be lower if many people claim. The official materials do not give an average payment or the number of class members.

Attorneys’ Fees and Service Awards

Class counsel will ask the court to approve $265,000 for attorneys’ fees and litigation costs, plus $2,500 for each of the four class representatives ($10,000 total). VSHSI pays these amounts, and the settlement website does not describe them as coming out of class members’ benefits. The court decides what to approve.

How to File a Claim

Deadline: January 18, 2027.

Option 1: Online (fastest). Use the claim form at https://vsidatasettlement.com/form/claim/. Your notice may include identifying details to access the form. If you cannot find them, contact the administrator.

Option 2: By mail. Download the claim form from the settlement documents page, or ask the administrator to send you one by email or mail. Complete and sign it, attach supporting documents, and mail it so it is postmarked by January 18, 2027 to:

VSHSI Data Incident Settlement c/o Settlement Administrator P.O. Box 25226 Santa Ana, CA 92799-9958

Tips for a stronger claim:

1. Choose the right option. If you have documented losses worth more than $50, the documented-loss route can be worth more. If not, the $50 option needs no proof.
2. Gather bank statements and receipts first, and highlight the relevant charges.
3. Make sure expenses fall between October 7, 2025 and January 18, 2027.
4. Do not claim anything already reimbursed by your bank, insurer or another party.
5. Keep copies of everything you submit, and a confirmation if you file online.
6. Do not wait until the last day.

Your Options

Option	What it means	Deadline
Submit a claim	The way to receive benefits and payment. You stay in the class and give up the released claims	January 18, 2027
Opt out	No benefits, but you keep any right to sue VSHSI yourself	January 4, 2027
Object	You tell the court why you disagree. You cannot object if you opt out, and you can still file a claim if you object	January 4, 2027
Do nothing	No benefits, and you give up the rights described in the release	N/A

What Happens If You Do Nothing?

You receive no benefit, and you still give up the rights described in the settlement’s release if the settlement is approved. Ignoring the notice does not preserve a later lawsuit. To keep your right to sue, you must opt out.

What You Give Up

If you stay in the class, you cannot be part of any other lawsuit against VSHSI about the issues the settlement covers. Section X of the Settlement Agreement, “Releases,” describes exactly which claims are released. If you may want to sue on your own, talk to a lawyer before January 4.

How to Opt Out

Send a signed request that includes:

1. The case name and number: Murray, et al. v. Vida Y Salud-Health Systems, Inc., Case No. 26-01-15726-ZCV, 293rd District Court, Zavala County, Texas
2. Your full name, mailing address, telephone number and email address
3. Your personal signature
4. The words “Request for Exclusion” or a clear statement that you do not want to participate

You can only exclude yourself, not anyone else. The request must be postmarked or emailed by January 4, 2027.

Mail to: VSHSI Data Incident Settlement ATTN: Exclusion Request P.O. Box 25226 Santa Ana, CA 92799-9958

The FAQ does not state which email address to use for exclusion requests, so if you want to email yours, confirm the correct address with the administrator first. Mailing is the safer route, and keeping proof of mailing is wise.

How to Object

You can object only if you stay in the class. Your objection must include:

1. The case name and number
2. Your full name, mailing address, telephone number and email address
3. A clear description of all the reasons you object, with any legal support such as documents
4. If you hired a lawyer for the objection, their name, bar number and contact information
5. Whether you or your lawyer want to speak at the final approval hearing
6. Your signature (or your lawyer’s)

Every item is required. File the complete objection with the Clerk of the Court by January 4, 2027, and send a copy to the administrator.

File with	Send a copy to
Clerk of the Court, 200 E. Uvalde St., Suite 13, Crystal City, TX 78839	VSHSI Data Incident Settlement, ATTN: Objections, P.O. Box 25226, Santa Ana, CA 92799-9958

The Final Approval Hearing

• When: February 2, 2027, 9:00 a.m. Central Time, by Zoom
• Purpose: The court decides whether to approve the settlement, how much class counsel is paid, and whether to award service awards. It considers any objections.
• Do you have to attend? No. A timely objection is considered even if you do not attend.
• The date and time may change without further notice. Check the settlement website.

The Laws Involved in a Healthcare Data Breach

This is general legal background. It does not mean VSHSI violated any of these laws. The court has made no such finding, and the settlement is not an admission of liability.

Law	What it generally does	How it connects to this case
HIPAA Security Rule (45 C.F.R. Part 164, Subpart C)	Requires covered healthcare providers and their business associates to protect electronic health information with administrative, physical and technical safeguards	Sets the federal standard for how providers protect patient data
HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400-414)	Requires notice to affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured health information, plus reporting to HHS	VSHSI has said it reported the incident to regulators, including HHS
No private right of action under HIPAA	HIPAA is enforced by HHS and state attorneys general, and courts generally do not let individuals sue directly under it	Why data breach class actions usually rely on state-law claims instead
Texas Business & Commerce Code § 521.052	Requires businesses to use reasonable procedures to protect sensitive personal information	A Texas standard for protecting data like Social Security and financial account numbers
Texas Business & Commerce Code § 521.053	Requires notice to affected individuals without unreasonable delay and no later than the 60th day after determining a breach occurred, and notice to the Texas Attorney General for breaches affecting 250 or more Texans, as soon as practicable and no later than 30 days	Governs the timing of breach notices in Texas
Texas Medical Records Privacy Act (Health & Safety Code ch. 181)	Regulates how covered entities handle protected health information; enforced by the Texas Attorney General with possible civil penalties (see § 181.201)	Texas’s healthcare privacy statute; it does not by itself give individuals a damages claim
Texas Data Privacy and Security Act (Business & Commerce Code ch. 541, effective July 1, 2024)	Gives consumers rights over their personal data, enforced by the Texas Attorney General	Has exclusions for certain entities, including nonprofits and HIPAA-covered entities, so it is not a blanket remedy for medical data breaches
State-law claims	Negligence, breach of contract, invasion of privacy and similar theories are commonly used in data breach suits	Turn on duty, security measures, injury and causation
Texas Rule of Civil Procedure 42	Governs class actions in Texas courts, including court approval of class settlements after notice	Why there is a notice, a claim period and a final approval hearing

Fair, reasonable and adequate. Before approving a class settlement, a court weighs whether it is fair to the class, considering the strength of the claims, the risks of continuing and the benefits offered.

What to Do Now to Protect Yourself

Whether or not you file a claim, consider these steps:

• Read your breach letter to see what information of yours was involved.
• Review your accounts, medical bills and explanations of benefits (EOBs) for charges, services or claims you do not recognize, and report problems to your bank, insurer or provider right away.
• Freeze your credit with the three major credit bureaus. Freezes are free under federal law, and they help block new accounts opened in your name. They do not stop every kind of medical identity theft.
• Consider a fraud alert, and check your credit reports regularly at AnnualCreditReport.com.
• Watch for medical identity theft. Ask your provider and insurer for records of services billed in your name, and ask to correct anything that is wrong.
• Be wary of follow-up scams. After a breach, criminals sometimes pretend to be the provider or settlement administrator. The settlement never asks you to pay a fee to file a claim.
• Report identity theft to the Federal Trade Commission at IdentityTheft.gov.
• Keep records of your time and costs from the moment you respond to the breach. They support a claim.

When Will Payments Be Made?

The court will hold the final approval hearing on February 2, 2027. Settlement benefits will be distributed if the court grants final approval and after any appeals are resolved. The settlement website does not say whether appeals will be filed or how long they would take, and it announces no payment date.

Taxes

The official settlement materials do not give tax guidance on settlement payments. If you receive a payment and are unsure how to report it, consult a tax professional.

Who Represents the Class?

The court appointed Raina Borrelli of Strauss Borrelli PLLC, Leigh Montgomery of Ellzey Kherker Sanford Montgomery LLP, and Danielle Perry of Mason LLP as class counsel. You are not charged for their services. You may hire your own lawyer at your own expense.

Key Dates

Event	Date
October 7 to 8, 2025	Data incident, per breach reports
October 7, 2025	Earliest date for covered out-of-pocket losses
October 19, 2026	Settlement notice mailing begins
January 4, 2027	Opt-out and objection deadline
January 18, 2027	Claim deadline; last date for covered losses
February 2, 2027, 9:00 a.m. CT	Final approval hearing, via Zoom
After final approval and any appeals	Benefits distributed

Frequently Asked Questions

Is the Vida Y Salud-Health Systems data breach settlement real?

Yes. It is a court-supervised class action settlement in Murray, et al. v. Vida Y Salud-Health Systems, Inc., Case No. 26-01-15726-ZCV, with an official website and an independent administrator. It is not yet finally approved.

How much can I get?

Up to $3,500 for documented losses, up to $80 for lost time, or a flat $50 with no proof (the $50 is instead of any other cash payment). Payments are reduced pro rata if total claims exceed the $500,000 cap.

Do I need proof to file a claim?

Not for the $50 payment or the medical identity monitoring. Out-of-pocket losses need documents such as bank statements or receipts.

Can I get the monitoring and a cash payment?

Yes. Medical identity monitoring is available to every class member, and you can also claim a cash option.

Can I claim $3,500 and also the $50?

No. The $50 is an alternative to every other cash payment.

Do I have to live in Texas?

No. The class covers individuals residing in the United States whose information was potentially impacted.

I did not receive a notice. Can I still claim?

Contact the administrator at (866) 221-3193 or [email protected] and ask whether you are in the class.

Does the settlement prove Vida Y Salud broke the law?

No. The court has not decided who is right. The settlement is a compromise, not a finding of liability.

Can I file after January 18, 2027?

No. Online claims must be submitted, and mailed claims postmarked, by January 18, 2027.

What happens if the court does not approve the settlement?

No benefits are paid under it. Check the settlement website for updates after the hearing.

Can I opt out and still get benefits?

No. Opting out means no benefits, but you keep any right to sue VSHSI on your own.

Who do I contact with questions?

The settlement administrator, Simpluris, at (866) 221-3193 or [email protected]. Do not contact the court or the Clerk of Court about the settlement.

Related Reading

• Summit Medical Data Breach Settlement, Check If You Qualify: Harris, et al. v. Summit Medical Group, PLLC, No. 2-119-25
• Hospital Español Auxilio Mutuo $500,000 Data Breach Settlement, Claim $25 or Up to $2,500 by December 21, 2026
• Valley Oaks Health Data Breach Settlement, Check If You Qualify: In re: Valley Oaks Data Incident Litigation, No. 79D01-2403-PL-00032

Each healthcare breach settlement has its own class definition, cap, documentation rules and deadlines, so a benefit in one does not carry over to another.

Sources

1. Official settlement website, Murray, et al. v. Vida Y Salud-Health Systems, Inc. (https://vsidatasettlement.com/)
2. Official settlement FAQ (https://vsidatasettlement.com/faq/)
3. Official settlement Important Dates page (https://vsidatasettlement.com/dates/)
4. Official settlement Important Documents page: Settlement Agreement, Long Form Notice and Claim Form (https://vsidatasettlement.com/documents/)
5. Strauss Borrelli PLLC, Vida Y Salud-Health Systems data breach investigation, January 6, 2026 (https://straussborrelli.com/2026/01/06/vida-y-salud-health-systems-data-breach-investigation/)
6. HHS, HIPAA Security Rule and Breach Notification Rule guidance (https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html)
7. Texas Business & Commerce Code ch. 521, including §§ 521.052 and 521.053 (https://statutes.capitol.texas.gov/GetStatute.aspx?Code=BC&Value=521.053)
8. Texas Health & Safety Code ch. 181 (https://tcss.legis.texas.gov/resources/HS/htm/HS.181.htm)
9. Texas Business & Commerce Code ch. 541, Texas Data Privacy and Security Act (https://statutes.capitol.texas.gov)
10. Texas Rules of Civil Procedure, Rule 42 (https://www.txcourts.gov)
11. Texas Attorney General, data breach reporting (https://www.texasattorneygeneral.gov/consumer-protection/data-breach-reporting)
12. Federal Trade Commission, IdentityTheft.gov (https://www.identitytheft.gov/)

Written by Israr Ahmad, Founder and Legal Content Researcher, AllAboutLawyer.com. This article is general settlement and legal information, not legal advice, and AllAboutLawyer.com is not a law firm. The settlement remains subject to final court approval. Eligibility, benefits, deadlines and release terms are governed by the official notice, the Settlement Agreement and court orders. Always confirm dates and instructions with the official settlement website or the administrator.