How much can I get from the Carolina Arthritis Associates settlement?

You have two cash payment options (pick one): Option A is up to $5,000 for documented out-of-pocket losses from identity theft, fraud, or other expenses caused by the breach. Option B is an estimated $100 cash payment with no proof needed. Both options are pro rata, meaning the amount may go up or down. On top of either cash option, all class members can also enroll in two years of medical data monitoring with $1 million in medical identity theft insurance.

When is the deadline to file a Carolina Arthritis Associates settlement claim?

The deadline to submit a claim form is February 23, 2026. Claims can be filed online at CAADataSettlement.com or mailed to the Settlement Administrator.

What information was stolen in the Carolina Arthritis Associates data breach?

The breach involved a wide range of sensitive medical and personal data: names, dates of birth, Social Security numbers, medical diagnoses, clinical information, medical history, mental or physical condition information, prescription information, medical treatment and procedure details, health insurance information, and medical claim forms. This is particularly sensitive because it combines financial identity data with detailed health records.

Do I need proof to get the $100 cash payment?

No. Cash Payment B (the estimated $100 payment) requires no proof or documentation. You simply file the claim form. If you have actual documented losses from the breach, you should choose Cash Payment A instead, which pays up to $5,000 but requires receipts or bank statements as proof.

What security improvements did Carolina Arthritis Associates make?

As part of the settlement, CAA confirmed it has implemented several security upgrades including 24/7/365 endpoint detection monitoring, multifactor authentication on all workstations and remote-access computers, additional security awareness training for all employees, upgrading its fiber modem, and decommissioning a secondary server that contained old files. These improvements were paid for separately and are not part of the $600,000 settlement fund.

What happens if I do nothing in the Carolina Arthritis settlement?

If you do nothing, you get no money and no medical data monitoring. You also give up your right to sue Carolina Arthritis Associates over this breach. The only way to receive benefits is to file a claim by February 23, 2026.

Carolina Arthritis Associates Data Breach Settlement: $100 Cash or Up to $5,000 + Medical Monitoring

Q: What is the Carolina Arthritis Associates data breach settlement?

A $600,000 class action settlement resolving claims that Carolina Arthritis Associates failed to protect patient data from a cyberattack in September 2024. Hackers accessed the clinic's computer systems and obtained files containing patient names, dates of birth, Social Security numbers, medical diagnoses, prescriptions, medical history, health insurance information, and medical claim forms. The case is In re Carolina Arthritis Associates Data Incident Litigation, Case No. 25-CV002250-640, in the Superior Court of New Hanover County, North Carolina.

Q: Who qualifies for the Carolina Arthritis Associates settlement?

Anyone whose personal information was accessed or acquired by an unauthorized party during the September 2024 cyberattack on Carolina Arthritis Associates. If you are a patient of the clinic and received a breach notification, you qualify.

Q: What is medical data monitoring and how is it different from credit monitoring?

Medical data monitoring watches for misuse of your health information specifically, not just your financial accounts. The service provided in this settlement is CyEx Medical Shield Complete, which monitors for healthcare insurance ID exposure, medical record number exposure, and unauthorized spending from your Health Savings Account (HSA). It also includes $1 million in medical identity theft insurance and access to a fraud resolution agent. This is different from standard credit monitoring because it's designed to catch someone using your stolen medical identity to get healthcare, fill prescriptions, or file insurance claims in your name.

By Steve Levine

Carolina Arthritis Associates Data Breach Class Action Settlement

Published: February 14, 2026

Claim Form Deadline: February 23, 2026

Payout: $100 cash (no proof needed) OR up to $5,000 for fraud losses + 2 years medical data monitoring with $1M insurance

Who Qualifies: Patients of Carolina Arthritis Associates whose information was accessed in the September 2024 cyberattack

If you're a patient of Carolina Arthritis Associates and received a letter about a data breach, you can file a claim for cash and free medical data monitoring. The deadline is February 23, 2026.

In September 2024, hackers broke into the clinic's computer systems and accessed files containing patient records. This wasn't just names and addresses — the stolen data included Social Security numbers, medical diagnoses, prescriptions, treatment records, and health insurance details. A $600,000 class action settlement has been reached, and there are two ways to get paid.

What Happened?

Carolina Arthritis Associates (CAA) is a medical practice. In September 2024, their computer systems were hit by a cyberattack. Hackers accessed files that contained a wide range of sensitive patient information: names, dates of birth, Social Security numbers, medical diagnoses, clinical information, medical history, mental and physical condition information, prescription details, treatment and procedure records, health insurance information, and medical claim forms.

This is a particularly serious type of breach because it combines two things criminals want most — your financial identity (SSN, insurance info) and your medical identity (diagnoses, prescriptions, medical records). Someone with both can commit regular identity theft and medical identity theft, which means they could use your insurance to get healthcare, fill prescriptions in your name, or file fraudulent insurance claims. Medical identity theft is especially dangerous because it can corrupt your medical records with someone else's health information, which can affect your future care.

The lawsuit alleges CAA failed to properly protect this data. CAA denies any wrongdoing, and the court has not decided who is right. The two sides agreed to settle.

Who Qualifies?

You qualify if your personal information was accessed or acquired during the September 2024 cyberattack on Carolina Arthritis Associates. If you received a breach notification from the clinic, you're in.

What Can You Get?

Every class member can enroll in medical data monitoring, plus choose one of two cash payment options.

2 years of medical data monitoring with $1 million insurance. All class members can enroll in CyEx Medical Shield Complete at no cost. This is specifically designed for medical data breaches — it's different from standard credit monitoring. It watches for healthcare insurance ID exposure, medical record number (MRN) exposure, and unauthorized spending from your Health Savings Account (HSA). It also comes with $1 million in medical identity theft insurance and access to a fraud resolution agent. This is available to everyone regardless of which cash option you choose.

Cash Payment A: Up to $5,000 for documented losses. If the breach actually cost you money — through identity theft, fraud, credit monitoring you paid for, credit freeze fees, ID replacement costs, or other out-of-pocket expenses — you can claim up to $5,000 in reimbursement. You'll need documentation like bank statements or receipts. Personal notes alone aren't sufficient proof, but they can be included alongside other documentation. The losses must have occurred between September 27, 2024 and February 23, 2026. You can't claim expenses that were already reimbursed by someone else.

Cash Payment B: Estimated $100 cash — no proof needed. If you don't have documented losses but want to get paid for the breach, you can claim an estimated $100 cash payment with no proof or documentation required. Just file the claim form. This amount is pro rata, so it could go up if fewer people file or down if more people file.

You pick one cash option or the other — not both. If you have documented losses exceeding $100, go with Option A. If you don't have documented losses, Option B gets you easy cash with no paperwork.

Security Improvements

As part of the settlement, CAA confirmed it has made security upgrades including 24/7/365 endpoint detection monitoring, multifactor authentication on all workstations and computers with remote access, additional security training for all employees, upgrading its fiber modem, and decommissioning a secondary server that contained old files. These costs were paid by CAA separately from the $600,000 settlement fund.

Important Dates

• Cyberattack: September 2024
• Eligible Loss Period: September 27, 2024 – February 23, 2026
• Opt-Out Deadline: February 6, 2026 (passed)
• Objection Deadline: February 6, 2026 (passed)
• Claim Form Deadline: February 23, 2026
• Final Approval Hearing: March 10, 2026 at 10:00 AM ET — North Carolina Business Court, 1965 Wake Forest Road, Room 3205, Winston-Salem, NC 27109

Attorneys' Fees

Class Counsel (A. Brooke Murphy of Murphy Law Firm and Gary M. Klinger of Milberg Coleman Bryson Phillips Grossman PLLC) will request up to one-third of the settlement fund in attorneys' fees plus reimbursement of litigation costs. Service awards of $2,500 each are being requested for the four class representatives: Donna Johnson, April Jenkins, Ronald Lewis, and Bernest Hewett. Both the fees and service awards come from the $600,000 fund.

What Happens If I Do Nothing?

If you do nothing, you get no money and no medical data monitoring. You also give up your right to sue Carolina Arthritis Associates on your own over this breach. The only way to receive any benefit is to file a claim by February 23, 2026.

How to File a Claim

File your claim online at CAADataSettlement.com. You can also download a printable claim form from the website or request one by mail. The deadline is February 23, 2026.

File a Claim

How Do I Find Class Action Settlements?

Find all the latest class actions you can qualify for by getting notified of new lawsuits as soon as they are open to claims:

Case Information

The case is In re Carolina Arthritis Associates Data Incident Litigation, Case No. 25-CV002250-640, in the General Court of Justice, Superior Court Division, New Hanover County, North Carolina.

Class Representatives: Donna Johnson, April Jenkins, Ronald Lewis, and Bernest Hewett.

Class Counsel: A. Brooke Murphy of Murphy Law Firm and Gary M. Klinger of Milberg Coleman Bryson Phillips Grossman PLLC (Chicago, IL).

Defense Counsel: David A. Cole of Freeman Mathis & Gary LLP (Atlanta, GA).

Settlement Administrator: P.O. Box 25226, Santa Ana, CA 92799-9958.

Settlement Website: CAADataSettlement.com

Settlement Notice

Sources

• Class Action Settlement Notice, In re Carolina Arthritis Associates Data Incident Litigation, Case No. 25-CV002250-640 (Superior Court, New Hanover County, NC)
• Settlement Website: CAADataSettlement.com

Filing Class Action Settlement Claims

Please submit only truthful information when filing your claim. If you are unsure whether you qualify, contact the Settlement Administrator or Class Counsel. OpenClassActions.com is a consumer news site and is not the settlement administrator or a law firm.

For more class actions keep scrolling below.

Open Class Action Lawsuit and Class Action Settlement

$25 Amazon Gift Card

Enter Here

Video Game Addicts Lawsuit

Deadline: Pending

Submit Claim

DraftKings & FanDuel Addiction Lawsuits

Status: Open

Submit Claim

Children playing Roblox and using Discord?

Pre-Qualify Here

Submit Claim

RoundUp Cancer Lawsuits: How to Qualify

Status: Open to Claims

Submit Claim

$5.5M Mid America Pet Food Settlement

Deadline: February 5, 2026

Submit Claim

File a rebate form to get a coupon, refund, rebate, or payment from this class action settlement

$4.17M RevitaLash Conditioner Settlement

Deadline: April 20, 2026

Submit Claim

$87.5M Beef Prices Settlement

Deadline: June 30, 2026

Submit Claim

Dollar General Bait & Switch Settlement

Deadline: April 13, 2026

Submit Claim

Class Action Summary
Status	Open — Accepting Claims
Claim Deadline	February 23, 2026
Payout Options	~$100 cash (no proof) OR up to $5,000 losses + 2 yrs medical monitoring w/ $1M insurance
Settlement Fund	$600,000
Category	Data Breach / Medical Records / Identity Theft
Defendant	Carolina Arthritis Associates, P.A.
Data Exposed	SSNs, diagnoses, prescriptions, medical history, insurance info, claim forms
Cyberattack	September 2024
Eligible Loss Period	September 27, 2024 – February 23, 2026
Case Number	25-CV002250-640
Court	Superior Court, New Hanover County, NC
Opt-Out Deadline	February 6, 2026 (passed)
Final Approval Hearing	March 10, 2026 at 10:00 AM ET — Winston-Salem, NC
Attorneys' Fees	Up to 1/3 of fund
Settlement Website	CAADataSettlement.com