People whose personal or health information may have been exposed in the cyberattack on Hospital Español Auxilio Mutuo de Puerto Rico that the hospital learned of around September 2023 may qualify to claim $25 or up to $2,500 in documented losses from the Auxilio Mutuo Hospital data breach class action settlement. Claims are open through December 21, 2026.
Current Status
Claims are open. The deadline is December 21, 2026: 11:59 p.m. for online claims, or postmarked that day for mailed claims. Judge María Antongiorgi-Jordán of the U.S. District Court for the District of Puerto Rico granted preliminary approval on August 24, 2026, and the final approval hearing is set for January 20, 2027. No payment date has been set. Filing online requires the Class Member ID from the notice.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Changed Recently?
Hospital Español Auxilio Mutuo de Puerto Rico, Inc., which does business as Auxilio Mutuo Hospital, agreed to settle the class action over a data incident the hospital learned of around September 2023, when it was targeted by a cybercriminal group. According to the settlement notice, the hospital began notifying potentially affected people on or around April 21, 2025. The case is Morales Rosario v. Hospital Español Auxilio Mutuo de Puerto Rico, Inc., No. 3:25-cv-01244, in the U.S. District Court for the District of Puerto Rico, and Judge María Antongiorgi-Jordán granted preliminary approval on August 24, 2026. The plaintiffs allege negligence, breach of implied contract, unjust enrichment, invasion of privacy and other claims. The hospital denies all of the claims and any wrongdoing, and the court has not decided who is right.Who Qualifies?
The settlement class is all individuals living in the U.S. whose personal information may have been accessed or acquired by an unauthorized party in the cyberattack on the hospital. The hospital represented in the settlement agreement that the class has about 41,000 people, described in the notice as current and former patients. According to the notice, the information involved includes, but is not limited to, names, dates of birth, Social Security numbers, driver's license, state ID and passport numbers, financial and banking information, account numbers, billing codes, payment cards, medical information and health insurance information.Excluded are the hospital, the judges assigned to the case and their staff and families, anyone who opts out, and anyone found guilty of causing or helping cause the incident.
How Much Can You Get?
Class members can claim one of two cash payments, not both, and everyone who stays in the settlement gets monitoring:• Alternative cash payment — $25. A flat payment with no documentation required.
• Out-of-pocket losses — up to $2,500. This covers actual, documented, unreimbursed losses that were more likely than not caused by the incident and happened between September 2023 and December 21, 2026. The claimant must also have made reasonable efforts to avoid the loss or get it reimbursed, including using any available credit monitoring or identity theft insurance. Receipts or other third-party documentation are required; self-prepared documents such as handwritten receipts are not enough on their own.
• Two years of credit and medical monitoring. Every class member who does not opt out can enroll in two years of one-bureau credit and medical monitoring through CyEx with at least $1 million in fraud protection, using the enrollment code in the mailed notice. It activates after final approval; no claim form is needed.
The hospital will pay up to $500,000 in total for the cash payments, and payments can be reduced pro rata to stay within that cap. Unlike many data breach settlements, attorneys' fees, notice and administration costs and service awards are paid separately by the hospital, not out of the $500,000. Class counsel will ask for up to $200,000 in fees and costs and a $2,500 service award for each class representative. The settlement agreement says the hospital has also adopted data security measures costing about $1,105,400.
What Proof or Notice ID Is Required?
The online claim form opens with a login that asks for the Class Member ID from the notice. The paper claim form, which can be printed from the settlement website and mailed, asks for the Class Member ID if known. The $25 payment needs no documentation; a loss claim needs third-party documentation.What Is the Deadline?
Claims must be submitted online by 11:59 p.m. on December 21, 2026, or mailed and postmarked by December 21, 2026. Requests to opt out and objections must also be postmarked by December 21, 2026.How Do You Take Action?
Claims are filed on the official Hospital Español Auxilio Settlement website with the Class Member ID from the notice, or on the paper claim form posted there. Electronic payment is available only on claims filed online; claims sent by mail are paid by check. The notice is also available in Spanish on the Spanish-language settlement website. People who did not get a notice can reach the settlement administrator, Kroll, through the website's contact form.What Happens Next?
The court's August 24, 2026 order and the long-form notice set the final approval hearing for January 20, 2027 at 1:30 p.m. AST at the Clemente Ruiz Nazario U.S. Courthouse in Hato Rey. The settlement website's important-dates page lists the same day at 9:30 a.m. AST, and the date or time can change, so the settlement website is the place to check before attending. Payments go out only after final approval and the end of any appeals; no payment date has been set.Sources and Verification
• Official settlement website (Kroll, administrator): Hospital Español Auxilio Settlement — home page, FAQ, important dates, documents and claim form• Settlement Agreement and Release, and Order Granting Preliminary Approval of Class Action Settlement (ECF No. 50, August 24, 2026), Morales Rosario v. Hospital Español Auxilio Mutuo de Puerto Rico, Inc., No. 3:25-cv-01244 (D.P.R.)
• Long Form Notice, embedded below
Questions
Who qualifies for the Auxilio Mutuo Hospital data breach settlement?
The settlement class is everyone living in the U.S. whose personal information may have been accessed or taken in the cyberattack on Hospital Español Auxilio Mutuo de Puerto Rico that the hospital learned of around September 2023. The hospital told the court the class has about 41,000 people. The hospital, the judges in the case and anyone who opts out are excluded.
How much is the Auxilio Mutuo settlement payment?
Class members can claim either a flat $25 cash payment with no documentation or up to $2,500 for documented, unreimbursed losses from the incident, but not both. Cash payments share a $500,000 cap and can be reduced pro rata if claims exceed it. Every class member who stays in the settlement can also enroll in two years of credit and medical monitoring without filing a claim.
Is a Class Member ID needed to file an Auxilio Mutuo claim?
The online claim form starts with a login that asks for the Class Member ID from the notice. The paper claim form, which can be printed from the settlement website and mailed, asks for the Class Member ID if known. People who did not get a notice can reach the settlement administrator, Kroll, through the website's contact form.
What is the deadline for the Auxilio Mutuo settlement?
Claims must be submitted online by 11:59 p.m. on December 21, 2026, or mailed and postmarked by that date. Requests to opt out and objections must also be postmarked by December 21, 2026.
When is the Auxilio Mutuo final approval hearing?
The court's preliminary approval order and the long-form notice set the final approval hearing for January 20, 2027 at 1:30 p.m. AST before Judge María Antongiorgi-Jordán in Hato Rey, Puerto Rico. The settlement website lists the same date at 9:30 a.m. AST, and the date or time can change. Payments go out only after final approval and the end of any appeals.
