The roughly 258,070 U.S. residents whose Social Security numbers were compromised in the November 2023 American Vision Partners data breach may qualify to claim a pro rata share of a $1.75 million fund, or instead up to $3,000 in documented out-of-pocket losses, from the eye-care group's class action settlement. Claims close November 12, 2026, and the Class Member ID from the emailed notice is a required field on the claim portal.
Current Status
Claims are open. A Claim Form must be submitted online by November 12, 2026, or mailed so that it is postmarked by that date. The notice does not state a timezone for the online deadline, so none is given here.The court has not yet approved the settlement. The final fairness hearing is scheduled for December 10, 2026 at 10:00 a.m. MT before Judge Diane J. Humetewa in the U.S. District Court for the District of Arizona, and the notice warns the hearing may be moved to a different date or time without additional notice. No payments have been made and no payment date has been announced — the notice says benefits are distributed only after the settlement obtains approval and the time for all appeals has expired.
One thing to check before you start: the online claim portal opens on a login screen asking for a Class Member ID, and it treats that ID as a required field. Unlike some settlements that let a claimant skip the ID step, this one does not advance without it.
What Is This Settlement About?
American Vision Partners is an eye-care network operating through a group of affiliated practices. The defendants named in the settlement are Medical Management Resource Group, L.L.C.; Barnet Dulaney Perkins Eye Center, PC; Marc Ellman, M.D., P.A. d/b/a Southwest Eye Institute; Southwestern Eye Center, Ltd.; and Eye Associates of Nevada d/b/a Wellish Vision Institute.According to the court-authorized notice, the case arises from a cyberattack the defendants discovered on or about November 14, 2023, in which an unauthorized third party gained access to the defendants' computer network and the information of approximately 1,600,000 individuals. Plaintiffs allege that the exposed data included names, dates of birth, Social Security numbers and contact information, along with medical treatment and health insurance information — protected health information under HIPAA. The defendants deny any wrongdoing whatsoever, and no court or other judicial body has made any determination that they did anything wrong. The parties agreed to settle to avoid the cost and risk of continued litigation.
The case is captioned Hulewat et al. v. Medical Management Resource Group, L.L.C. d/b/a American Vision Partners, et al., No. 2:24-cv-00377-DJH, in the U.S. District Court for the District of Arizona. Under the settlement the defendants fund a $1,750,000 non-reversionary Settlement Fund for the Damages Class. Separately, and at their own cost rather than out of that fund, the defendants agreed to implement and maintain a set of cybersecurity measures the notice values at approximately $2,787,630.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Who Qualifies?
This settlement has two classes, and only one of them is paid. That distinction is the single most important thing on this page, because roughly 1.6 million people were caught up in the incident while the group eligible for cash is far smaller.• Damages Settlement Class. Approximately 258,070 U.S. residents whose Social Security numbers and other personal information were compromised in the data breach. Only these class members are eligible to submit a Claim Form for the Damages Class Benefits described below.
• Injunctive Relief Class. All individuals whose personal information is collected or maintained by the defendants. This class receives the cybersecurity commitments rather than a payment — there is nothing for its members to claim.
Excluded from both classes are the defendants and their representatives, any judicial officer presiding over the matter along with that officer's immediate family members and staff, and any class member who timely and validly requests exclusion.
The security measures the defendants agreed to maintain include creating and maintaining a Chief Information Officer role, retaining a dedicated information security training specialist, operating a cross-functional cybersecurity steering committee, running an enterprise-wide security awareness training program, engaging an independent third-party vendor for periodic penetration testing alongside monthly vulnerability scanning, enhanced data classification policies and access controls for electronic protected health information, third-party management of SIEM, SOC and firewall, an improved email security gateway and disaster recovery solution, regular security risk assessments with external vendors, and amended security policies including an updated incident response policy. The notice describes these as contractually enforceable obligations of the settlement agreement.
How Much Can You Get?
A Damages Class member who files a valid and timely Claim Form selects one of two benefits. They are alternatives — the notice does not offer both to the same claimant.• Pro rata cash payment. A share of the fund, with no documentation required. There is no fixed per-person figure: the notice says the administrator will make pro rata settlement payments which may increase or decrease, subject to the Settlement Fund cap. The amount depends on how many valid claims come in and on what the court awards out of the fund, so any figure quoted before claims are processed is an estimate rather than a promise. See our explainer on how pro rata settlement payments are calculated.
• Out-of-pocket expense claim. Reimbursement of documented out-of-pocket losses reasonably and fairly traceable to the data breach, subject to an individual cap of $3,000 per claimant.
The notice lists what out-of-pocket losses can cover: unreimbursed losses relating to fraud or identity theft; professional fees including attorneys' fees, accountants' fees and fees for credit repair services; costs of freezing or unfreezing credit with a credit reporting agency; credit monitoring costs incurred on or after November 2023 that the claimant attests were caused by the breach, through the date of claim submission; and miscellaneous expenses such as notary, fax, postage, copying, mileage, data charges where charged by the amount of data used, cell phone charges only where charged by the minute, and long-distance telephone charges.
Expenses cannot be claimed if they were already reimbursed from another source — including compensation provided through the credit monitoring and identity theft protection product offered in the defendants' original notification letter.
Both benefits are paid from the same $1,750,000 fund, which is also the source of attorneys' fees, litigation costs and service awards. Class counsel will ask the court for fees of 33.33% of the value of the settlement, a figure the notice says is calculated inclusive of the value of the relief made available to the Injunctive Relief Class, plus reasonable costs, and for service awards of up to $2,500 for each class representative. The court may award less than the amounts requested.
What Proof or Notice ID Is Required?
Proof is required, in two separate senses, and it is worth being precise about which applies to you.Every claimant needs the Class Member ID. The online claim form opens on a login step that asks for a Class Member ID and labels it a required field; submitting without it returns a validation error rather than advancing. The notice says the ID is printed in the top left corner of the emailed notice you received. Because filing is gated on an administrator-issued identifier, this settlement is Proof Required even for the pro rata cash option, where no receipts are involved.
Out-of-pocket claimants additionally need documentation. Those claims must be supported by receipts or other documentation that is not self-prepared by the claimant. The notice states that self-prepared documents such as handwritten receipts are, by themselves, insufficient to receive reimbursement, though they may be considered to add clarity or support to other submitted documentation. Every out-of-pocket claim must also include an attestation that the monetary losses are fairly traceable to the data breach and were not incurred due to some other event or reason.
The claim form itself is organized into sections covering claimant information, proof of Damages Class membership, the pro rata cash payment, out-of-pocket expense claims, payment information, and a closing attestation and signature.
What Is the Deadline?
Four dates matter here, and they do not fall together:• November 12, 2026 — Claim Form deadline. Online submissions must be in by this date; paper forms must be postmarked by it.
• October 13, 2026 — deadline to exclude yourself. A written request for exclusion must be individually signed and postmarked by this date. Excluding yourself means receiving no benefits, and it is the only way to keep your own right to sue over the breach.
• October 13, 2026 — deadline to object, or to give notice of intent to appear at the hearing. An objection must be submitted or postmarked by this date and must include the objector's full name and address, the case name and docket number, a written statement of all grounds with any legal support, the identity of any counsel representing the objector, a statement whether the objector or counsel will appear at the hearing, and a signature.
• December 10, 2026 at 10:00 a.m. MT — final fairness hearing.
The notice specifies Mountain Time for the hearing only. It gives no timezone for the claim deadline, so treat November 12 as the date and file well before it rather than guessing at a cutoff hour. More on what stepping out of a settlement means in our guide to opting out of a class action.
How Do You File a Claim?
File through the official settlement website, American Vision Settlement.com, which the administrator identifies as the only authorized website for this settlement. Have the emailed notice open before you start, since the Class Member ID from its top left corner is what gets you past the login screen.One detail worth planning around: the notice states that to receive an electronic or ACH payment for a valid claim, the Claim Form must be filed online. A paper Claim Form submitted by mail remains an option, but choosing it forecloses the electronic payment methods. The claim form also asks you to complete the payment information section, so decide how you want to be paid before you begin.
If you are unsure whether you are in the Damages Class, or you cannot find your Class Member ID, use the Contact Us page on the official settlement website to reach the administrator.
What Happens Next?
The next milestone is the December 10, 2026 final fairness hearing at the Sandra Day O'Connor U.S. Courthouse in Phoenix, where the court will consider whether the settlement is fair, reasonable and adequate, hear any timely objections from class members who asked to speak, and rule on the requests for attorneys' fees, costs and service awards. Attending is not required, and the notice says class counsel will present the class to the court.A hearing being held is not the same as approval being granted. If the court does approve the settlement, the notice says there may still be appeals, that resolving them can take time, and that processing the Claim Forms takes time as well — benefits are distributed only after approval is obtained and the time for all appeals has expired. No payment date had been announced as of August 31, 2026.
The notice also reminds class members that keeping the administrator updated on a change of address is their own responsibility, which matters on a settlement whose payments may be a year or more away.
Sources and Verification
• Official settlement website — American Vision Settlement.com (deadlines, FAQs and settlement documents)• Court-Authorized Notice of Proposed Class Action Settlement (PDF) — class definitions, benefits, deadlines and the final fairness hearing
• Official claim portal — the Class Member ID login step and the claim form sections
• Hulewat et al. v. Medical Management Resource Group, L.L.C. d/b/a American Vision Partners, et al., No. 2:24-cv-00377-DJH, U.S. District Court for the District of Arizona
Questions
About 1.6 million people were notified, so why are only 258,070 eligible for money?
Because the settlement has two classes and only one of them is paid. The notice says the cyberattack involved the information of approximately 1,600,000 individuals, but the Damages Settlement Class — the group eligible to submit a Claim Form for cash — is limited to approximately 258,070 U.S. residents whose Social Security numbers and other personal information were compromised. Everyone else falls in the Injunctive Relief Class, defined as all individuals whose personal information is collected or maintained by the defendants. That class receives the cybersecurity commitments the defendants agreed to, not a payment.
Can I take both the pro rata cash payment and the out-of-pocket reimbursement?
No. The notice presents them as alternatives — a class member selects one of the two Damages Class Benefits, not both. The pro rata cash payment is a share of the net fund with no documentation attached. The out-of-pocket option reimburses documented losses fairly traceable to the breach up to $3,000 per claimant. Which one is worth more depends on whether you actually incurred documented losses, since the pro rata amount is not fixed and is not known until claims are processed.
What if I never received the emailed notice or lost my Class Member ID?
The online claim portal treats the Class Member ID as a required field and will not advance past the login screen without it, so it is not optional the way some settlements make an ID optional. The notice says the ID appears in the top left corner of the emailed notice. If you cannot locate it, use the Contact Us page on the official settlement website to reach the administrator and ask about your ID or request a paper Claim Form.
What counts as documentation for an out-of-pocket expense claim?
The notice asks for receipts or other documentation that is not self-prepared by the claimant and that documents the costs incurred. It says self-prepared documents such as handwritten receipts are, by themselves, insufficient to receive reimbursement, though they may be considered to add clarity or support to other submitted documentation. Every out-of-pocket claim must also include an attestation that the losses are fairly traceable to the data breach and were not incurred for some other reason. Expenses already reimbursed from another source, including through the credit monitoring or identity theft protection offered in the defendants’ original notification letter, cannot be claimed again.
Why is the opt-out deadline a month earlier than the claim deadline?
The two dates serve different purposes and this settlement does not align them. Requests for exclusion and objections must be postmarked by October 13, 2026, because the court needs them in hand before the December 10, 2026 final fairness hearing. Claim Forms are processed by the administrator rather than the court, so they run to November 12, 2026. The practical consequence is that the decision to leave the settlement and keep your own right to sue closes about a month before the decision to file for money does.
When will payments be sent?
No payment date has been announced. The notice says Damages Class Benefits will be distributed after the settlement obtains court approval and after the time for all appeals has expired, and that processing the Claim Forms also takes time. The final fairness hearing is scheduled for December 10, 2026, and the court had not ruled as of August 31, 2026. A hearing being scheduled is not the same as approval being granted, and approval is not the same as appeals being resolved.
