If Aspire Health Alliance notified you that your health information may have been exposed in its September 2023 cyberattack, you are set to receive a pro rata check and a year of medical data monitoring automatically — or you can claim up to $2,500 for documented losses instead.
What Is This Settlement About?
South Shore Mental Health Center, Inc., which does business as Aspire Health Alliance, is a Massachusetts behavioral health provider. According to the court-authorized notice, a targeted cyberattack on Aspire's computer systems in September 2023 potentially gave an unauthorized party access to files containing Private Information. Those files may have contained names, dates of birth, dates of medical services, individual health insurance policy numbers, physician or medical facility information, medical condition or treatment information, Medicare or Medicaid numbers, and patient account information.The incident led to a class action lawsuit, Tozzi v. South Shore Mental Health Center, Inc. d/b/a Aspire Health Alliance, Case No. 2484CV02307, pending in the Superior Court of Suffolk County, Massachusetts. Aspire denies that it did anything wrong, and the court has not decided who is right. The parties agreed to a $400,000 settlement to avoid the costs, risks, and uncertainties of continued litigation.
This settlement is unusual in a helpful way: class members who do nothing still get paid. Everyone in the class automatically receives a pro rata cash payment and a year of medical data monitoring, while those with documented out-of-pocket losses can instead file a claim for up to $2,500 by September 16, 2026. This page explains who qualifies, what each payment covers, and how to file or update your payment details.
Who Qualifies?
The court defined the Settlement Class as all living individuals who were sent a notice by Aspire that their Private Information may have been impacted in the September 2023 Data Incident. If Aspire's records show you are a class member, you may have already received a previous notice directly from Aspire about the incident, and you should have received a settlement notice with a LoginID and PIN.Excluded from the class are Aspire's employees, directors, officers, and agents; governmental entities; the judge assigned to the case, the judge's immediate family, and court staff; and anyone who validly excludes themselves from the settlement. If you are not sure whether you are included, you can confirm your status through the contact page of the official settlement website.
How Much Can You Get?
Aspire will establish a Settlement Fund of $400,000. Court-approved attorneys' fees and costs, a service award for the class representative, and settlement administration costs are paid from the fund first; the net remainder pays class member benefits. Every class member receives medical data monitoring plus one of two cash payments:Medical Data Monitoring — one year of CyEx Medical Shield for all Settlement Class Members, with $1 million of medical identity theft insurance and monitoring for healthcare insurance ID exposure, Medical Record Number (MRN) exposure, and unauthorized Health Savings Account (HSA) spending. If anything suspicious happens, you can work with a fraud resolution agent. The administrator will provide enrollment instructions after the settlement becomes final, and you can request a reminder email with those instructions through the settlement website.
Cash Payment A — Documented Losses — up to $2,500 if you incurred actual, documented, unreimbursed out-of-pocket losses due to the Data Incident between September 13, 2023 and September 16, 2026. Covered expenses include losses from fraud or identity theft, costs of freezing and unfreezing your credit, credit monitoring costs incurred on or after the mailing of the incident notice, and miscellaneous expenses such as notary, fax, postage, copying, mileage, and long-distance telephone charges. Claims must include proof such as receipts; personal certifications, declarations, or affidavits do not count as reasonable documentation on their own, and expenses already reimbursed by a third party are not eligible.
Cash Payment B — Pro Rata Cash — if you do not submit a claim for Cash Payment A, you automatically receive an equal share of the money remaining in the net settlement fund after documented-loss claims are deducted. No claim form is required. Through the settlement website you can provide an updated mailing address or elect to receive this payment by Venmo, Zelle, or PayPal instead of a paper check.
Class counsel will ask the court to approve attorneys' fees of 35% of the settlement fund plus litigation costs, and a service award of up to $2,500 for the class representative, all paid from the fund before class member payments are calculated.
How to File a Claim
You only need to file a Claim Form if you are claiming Cash Payment A for documented losses — if you do nothing, the pro rata payment and monitoring come automatically. The fastest way to file is online at the official settlement website, Aspire Data Incident.com. To start an online claim you must log in with the LoginID and PIN printed on the notice that was sent to you; if you cannot locate them, request them through the settlement website's contact options with your full name and mailing address.You can also download a printable Claim Form from the settlement website and submit it by mail with your supporting documentation. Online claims must be submitted, and mailed claims postmarked, by September 16, 2026. If you file by mail, an approved payment comes as a paper check; the PayPal, Venmo, and Zelle options are only available when you file or make a payment selection online.
If your mailing address has changed — or you prefer a digital payment for the automatic pro rata check — submit the Address Update/Payment Selection Form on the settlement website by September 16, 2026.
Key Deadlines
- File a documented-losses claim: September 16, 2026
- Update your address or select a digital payment: September 16, 2026
- Exclude yourself (opt out): September 16, 2026
- Object to the settlement: September 16, 2026
- Final approval hearing: October 1, 2026 at 2:00 p.m. ET (Suffolk County Courthouse, Boston)
If you stay in the class, you give up the right to sue Aspire and the released parties over the claims this settlement resolves, and you receive the settlement benefits. Excluding yourself is the only way to keep your right to sue, but you receive no cash payment or monitoring if you opt out. Payments are distributed after the court grants final approval and any appeals are resolved, so distribution timing can shift.
Frequently Asked Questions
Who qualifies for the Aspire Health Alliance data breach settlement?
You qualify if you are a living individual who was sent a notice by South Shore Mental Health Center, Inc. d/b/a Aspire Health Alliance that your Private Information may have been impacted in the September 2023 data incident. Excluded are Aspire's employees, directors, officers, and agents; governmental entities; the judge assigned to the case, the judge's immediate family, and court staff; and anyone who validly opts out.
What can I get from the Aspire Health Alliance settlement?
All Settlement Class Members receive one year of CyEx Medical Shield medical data monitoring with $1 million of medical identity theft insurance, plus one of two cash payments from the $400,000 fund: up to $2,500 for documented out-of-pocket losses if you file a valid claim, or an automatic equal pro rata share of the remaining net fund if you do not.
Do I have to file a claim to get an Aspire settlement payment?
No. If you do nothing, you automatically receive the pro rata cash payment and medical data monitoring. A Claim Form is only required for the documented-losses payment of up to $2,500, and it must be submitted online or postmarked by September 16, 2026.
Do I need proof to file an Aspire documented-losses claim?
Yes. Filing online requires the LoginID and PIN printed on the notice you were sent, and documented-loss claims must include reasonable third-party documentation such as receipts showing unreimbursed out-of-pocket losses incurred between September 13, 2023 and September 16, 2026. Personal certifications, declarations, or affidavits alone are not enough.
What is the deadline for the Aspire Health Alliance settlement?
The deadline to file a Claim Form for documented losses, opt out, or object is September 16, 2026. The final approval hearing is scheduled for October 1, 2026 at 2:00 p.m. Eastern Time at the Suffolk County Courthouse in Boston. Payments are sent after the court grants final approval and any appeals are resolved.
Is AspireDataIncident.com legit?
Yes. AspireDataIncident.com is the official, court-authorized settlement website for Tozzi v. South Shore Mental Health Center, Inc. d/b/a Aspire Health Alliance, Case No. 2484CV02307, pending in the Superior Court of Suffolk County, Massachusetts, and administered by Simpluris. Aspire denies wrongdoing, and the court has not decided who is right. File only through the official settlement website.
When will Aspire settlement checks be sent?
Payments are distributed after the court grants final approval and any appeals are resolved. The final approval hearing is scheduled for October 1, 2026, so checks and digital payments (Venmo, Zelle, or PayPal, if you selected one on the settlement website) would go out after that date. Medical data monitoring enrollment instructions are also emailed after the settlement becomes final.
What information was involved in the Aspire Health Alliance data breach?
According to the court-authorized notice, files potentially accessed in the September 2023 cyberattack may have contained names, dates of birth, dates of medical services, individual health insurance policy numbers, physician or medical facility information, medical condition or treatment information, Medicare or Medicaid numbers, and patient account information.
Watch Out for Scams
Legitimate settlement administrators do not charge a fee to release a class action payment, and they will not ask for your banking passwords or a "processing payment" by text or phone. Use only the official settlement website linked on this page, and ignore unsolicited messages demanding money or credentials to "release" your check. Massachusetts behavioral health patients were also covered by the Gándara Mental Health Center data breach settlement; to compare this case with others, see our roundup of open data breach settlements and our explainer on how a data breach class action works.Sources
- Tozzi v. South Shore Mental Health Center, Inc. d/b/a Aspire Health Alliance — Official Settlement Website
- Massachusetts Trial Court Case Access — Case No. 2484CV02307 (Suffolk County Superior Court)
