This settlement resolves claims over a September 2025 targeted cyberattack on the computer systems of Brevard Skin & Cancer Center, a Florida dermatology and skin cancer practice, in which files containing patient information were accessed. If the practice sent you a notice, you can claim a flat $45 with no documentation or up to $2,500 in documented losses instead, plus a year of medical data monitoring — and unusually, the attorneys' fees are being paid separately by the practice rather than out of your payment.
Current Status
Claims are open. Claim forms must be submitted online or by email, or postmarked, no later than November 16, 2026. The deadline to exclude yourself or to object comes earlier, on November 2, 2026, so the decision about whether to stay in the class closes two weeks before the claim window does. The Final Approval Hearing is scheduled for November 30, 2026 at 9:00 a.m. Eastern Time in Brevard County, Florida. No final approval order has been entered, and the Notice states that payments will be distributed only after the Court grants final approval and after any appeals are resolved. No payment date had been announced as of August 28, 2026.What Changed Recently?
The case is In Re: Brevard Skin & Cancer Center Data Breach Litigation, Case No. 05-2025-CA-054649-XXCA-BC, in the Circuit Court for Brevard County, Florida. The defendant is DRS Roberts & Bryan PA, which does business as Brevard Skin & Cancer Center. The Court has authorized notice to the class, which is the event that opened the claim process.The lawsuit alleges that during a targeted cyberattack on the practice's computer systems in September 2025, certain files containing private information were accessed. According to the Notice, those files may have contained names, dates of birth, home addresses, billing and claims information, Social Security numbers, diagnosis and clinical information, phone numbers, email addresses, and health conditions included in FMLA forms.
Brevard Skin & Cancer Center denies that it did anything wrong, and the Notice states that the Court has not decided who is right. The parties agreed to settle to avoid the costs, risks, disruptions and uncertainties of continuing the litigation. No court has found the practice liable.
Who Qualifies?
The Court has defined the class as all living individuals residing in the United States who were sent a notice by the defendant that their private information may have been impacted in the Data Incident.That definition is doing more work than it looks. Eligibility turns on whether the practice sent you a notice, not on whether you were a patient in a particular period or can prove anything about your own records. The Notice states that the practice's records indicate recipients are class members entitled to benefits, and adds that you may have received an earlier notice directly from the practice about the incident itself. The class is nationwide rather than limited to Florida, because it follows the notice list rather than where anyone lives.
Excluded are the defendant's directors, officers and agents; governmental entities; the judge assigned to the action, that judge's immediate family and court staff; and anyone who timely opts out.
If you are not sure whether you are a class member, the settlement website's contact page is the place to ask the Settlement Administrator, and it is free to do so.
How Much Can You Get?
There are two things on offer, and they work differently from each other.The first is one year of medical data monitoring through CyEx Medical Shield Complete, which the Notice describes as available to all class members. It comes with $1 million of medical identity theft insurance and monitors for healthcare insurance ID exposure, Medical Record Number exposure and unauthorized Health Savings Account spending, with access to a fraud resolution agent if something suspicious turns up. That is a more medically specific product than the generic credit monitoring most breach settlements offer, which fits a class whose exposed data included diagnosis and clinical information rather than only financial details.
The second is cash, and here you have to pick one of two options. Cash Payment A reimburses actual, documented out-of-pocket losses caused by the Data Incident, up to $2,500, for losses incurred between September 28, 2025 and November 16, 2026. Cash Payment B is a one-time $45 payment that the Notice describes as available instead of any other payment, with no proof or explanation required. Most people with no traceable losses will be choosing the $45.
One detail in the Notice is easy to miss and worth acting on: the documented-losses window runs all the way to November 16, 2026, the same day claims are due. Expenses you incur between now and the deadline still count, so if you are partway through freezing credit or replacing identification, the receipts you generate in the meantime are inside the window.
The genuinely unusual feature of this settlement is where the lawyers' money comes from. Class Counsel will ask the Court to approve $350,000 in attorneys' fees and litigation costs, plus service awards of $2,500 for each of the class representatives, and the Notice states that both are to be paid by Brevard Skin & Cancer Center. They are not carved out of a common fund the way most data breach settlements work, so an award of fees does not reduce anyone's $45 or documented-losses payment. Both amounts still require the Court's approval, and the Court may award less.
The Notice does not disclose an aggregate settlement fund, and it does not describe a pro rata reduction or publish a cap on total payouts. This page does not assert that there is no cap — only that the published documents do not state one.
What Proof or Notice ID Is Required?
The online claim form is gated. The settlement website states that to start your claim online you must log in with the LoginID and PIN printed on the notice that was mailed to you. Because filing online depends on an administrator-issued identifier, this page marks the settlement Proof Required: Yes, even though the $45 tier itself asks for no receipts.There are other routes if you no longer have the notice. The settlement website offers a downloadable claim form you can complete and return with any supporting documentation, and the Notice says you can contact the Settlement Administrator to request a paper claim form. If you cannot locate your LoginID and PIN, use the contact page on the official settlement website to ask for them, giving your full name and mailing address — do not guess at a code.
If you are claiming documented losses, you additionally need proof such as bank statements or receipts showing what you spent or lost, and the proof should show the expense was because of the Data Incident. The Notice allows self-prepared notes or papers to explain or support other proof, but states clearly that such notes on their own are not enough to make a valid claim. The $45 alternate cash payment requires no documentation of any kind.
How Does the Medical Data Monitoring Get Turned On?
Not through the claim form, which is the part most likely to trip people up. The Notice says enrollment codes were mailed to all class members by postcard, separately from the notice itself, and the settlement website carries a dedicated page where you can ask to be sent enrollment instructions by email once the settlement becomes final. So the monitoring runs on its own track: a code you were mailed, redeemed after final approval, rather than something the claim form switches on.If you no longer have your enrollment code, the Notice directs class members to contact the Settlement Administrator, and the settlement website's contact page is where to do that. Filing a claim form for cash is still worth doing on its own timetable — the November 16, 2026 deadline applies to the claim form, and nothing about the monitoring extends it.
What Is the Deadline?
Claim forms submitted online or by email must be in by November 16, 2026, and mailed claim forms must be postmarked no later than that date. The Notice gives the date without a time of day, so this page publishes only the date.The deadline to exclude yourself from the settlement, and the deadline to object to it, are both November 2, 2026 — two weeks earlier. That ordering matters: the choice that is hardest to undo, whether to stay in the class at all, closes first. Once November 2 passes, you are in the class and bound by the release whether or not you go on to file a claim.
How Do You File a Claim?
Filing online is the fastest route. Open the official settlement website, Brevard Skin Data Settlement, and start the claim form with the LoginID and PIN from your notice. If you would rather file on paper, the same website offers a downloadable claim form that you complete, sign and return with any supporting documentation. Whichever route you take, decide first which cash option you are claiming, because you cannot take both.If you are claiming documented losses, gather the supporting records before you start — the claim has to go in with its documentation attached, and there is no separate later window to supply it. Keep a copy of whatever you submit.
The Settlement Agreement, the long-form Notice and the claim form are all posted on the settlement website's Important Documents page if you want to read the underlying filings before you decide.
What If You Want Out — or Want to Object?
Excluding yourself means you receive no settlement benefit or payment but keep any right you have to sue the practice on your own over the legal issues in this case. A request for exclusion must be submitted, postmarked or emailed by November 2, 2026, and the Notice requires it to contain the name of the litigation and its case number; your full name, mailing address, telephone number and email address; your personal signature; and the words "Request for Exclusion" or a clear and similar statement that you do not want to participate. You may exclude only yourself, not anyone else.Objecting is different: you stay in the class, can still file a claim for benefits, and tell the Court why you think it should not approve the settlement. A complete objection has to be filed with the Clerk of Court by November 2, 2026, with copies sent to Class Counsel, defense counsel and the Settlement Administrator.
The objection requirements in this case are more demanding than most, and every one of them has to be met for the objection to be valid. Beyond your contact details, your signature — an attorney's signature is expressly not sufficient — and all grounds for the objection with any legal support, the Notice requires you to disclose how many times you have objected to a class action settlement in the past five years, with the caption of each case and copies of any orders ruling on those objections; the identity of all counsel representing you, including any who may be compensated in connection with the objection; the same five-year objection history for your counsel and their law firm; whether you or your counsel will appear or testify at the Final Approval Hearing; and a list of anyone who will be called to testify in support. The Notice also requires a statement confirming whether you or your counsel used any form of artificial intelligence in preparing the objection — a disclosure requirement that has only recently started appearing in class action notices.
If you do nothing, you stay in the class, receive nothing, and give up the released claims.
What Am I Giving Up?
If you stay in the class, you cannot be part of any other lawsuit against Brevard Skin & Cancer Center about the issues this settlement covers. The Notice points to the Releases section of the Settlement Agreement, Section XI, for the full description of the claims given up, and the Agreement is posted on the settlement website. The release binds you whether or not you ever file a claim — which is why the November 2 exclusion deadline, rather than the November 16 claim deadline, is the date that decides whether this settlement affects your legal rights.What Happens Next?
The exclusion and objection windows close November 2, 2026, and the claim window closes November 16, 2026. The Final Approval Hearing is scheduled for November 30, 2026 at 9:00 a.m. Eastern Time at the Circuit Court for Brevard County in Viera, Florida, or by Zoom at the Court's discretion. At that hearing the Court will decide whether to approve the settlement, how Class Counsel should be paid, whether to award the service awards, and will consider any objections. Class members are not required to attend, and the Notice warns that the date and time may change without further notice — the settlement website is where changes are posted.The Notice is unusually direct about what comes after: if the Court approves the settlement there may be appeals, it is not known whether any will be filed or how long they would take to resolve, and payments will be distributed only after final approval and after any appeals are resolved. A hearing being held is not approval being granted, and approval is not the same as money going out. No final approval order had been entered and no payment date had been announced as of August 28, 2026.
Sources and Verification
• Official settlement website — Brevard Skin Data Settlement• Official settlement website — Frequently Asked Questions
• Notice of Proposed Class Action Settlement (PDF)
• Official case documents — Settlement Agreement, Notice and claim form
• In Re: Brevard Skin & Cancer Center Data Breach Litigation, Case No. 05-2025-CA-054649-XXCA-BC, Circuit Court for Brevard County, Florida
• IdentityTheft.gov — FTC identity theft recovery steps
• HHS Office for Civil Rights — your health information privacy rights
Questions
Do the attorneys' fees come out of my payment?
No, and this is the unusual part of the deal. The Notice states that Class Counsel will ask the Court to approve $350,000 in attorneys' fees and litigation costs, and service awards of $2,500 for each class representative, and that both are to be paid by Brevard Skin & Cancer Center. They are not deducted from a common fund the way most data breach settlements work, so an award of fees does not shrink anyone's $45 or documented-losses payment. The Court still has to approve those amounts and may award less.
Can I take the $45 and the medical data monitoring, or do I have to choose?
You can have both. The Notice describes the monitoring as available to all class members and separately offers a choice between two cash options. What you must choose between is Cash Payment A, up to $2,500 in documented out-of-pocket losses, and Cash Payment B, the flat $45 with no proof — the Notice describes the $45 as being available instead of any other payment, so you cannot claim both cash tiers.
How does the medical data monitoring actually get turned on?
Through an enrollment code, not through the claim form. The Notice says enrollment codes were mailed to all class members by postcard, separately from the notice itself, and the settlement website carries a dedicated page where you can ask to be emailed enrollment instructions once the settlement becomes final. The coverage is one year of CyEx Medical Shield Complete, which the Notice describes as including $1 million of medical identity theft insurance and monitoring for healthcare insurance ID exposure, Medical Record Number exposure and unauthorized Health Savings Account spending. If you no longer have your enrollment code, the settlement website's contact page is where to request it.
I threw away the notice and do not have my LoginID and PIN. Can I still file?
The online claim form is gated: the settlement website states you must log in with the LoginID and PIN printed on your notice to start it. The site also offers a downloadable claim form you can complete and return, and says you can request a claim form from the Settlement Administrator. If you cannot find your credentials, use the contact page on the official settlement website to ask for them rather than guessing at a code. Because the online route is gated on an administrator-issued identifier, this page treats the settlement as Proof Required: Yes.
Why is the opt-out deadline two weeks before the claim deadline?
That is how the schedule is written, and it is worth knowing because the decision that is hardest to reverse comes first. The deadline to exclude yourself or to object is November 2, 2026, while claim forms are accepted until November 16, 2026. So you have to decide whether to stay in the class two weeks before you have to decide whether to file for money. If November 2 passes and you do nothing, you are in the class and bound by the release whether or not you ever file a claim.
What counts as a documented out-of-pocket loss, and what period does it cover?
The Notice gives examples: losses from identity theft or fraud, fees for credit reports, credit monitoring or freezing and unfreezing credit, the cost of replacing IDs, and postage to contact banks by mail. Losses must have occurred between September 28, 2025 and November 16, 2026 — a window that runs right up to the claim deadline itself. You have to send proof such as bank statements or receipts showing what you spent or lost, and the proof should connect the expense to the Data Incident. The Notice allows self-prepared notes as support for other proof but states that such notes alone are not enough to make a valid claim.
Is there a total settlement fund, and could my payment be cut pro rata?
The Notice does not disclose an aggregate settlement fund, and it does not describe a pro rata reduction of the cash benefits. It also does not publish a cap on total payouts. Because no fund figure or cap is stated in the official documents, this page does not claim there is either one — the $45 and the up-to-$2,500 are the amounts the Notice describes, and anything beyond that about how the total is limited is not something the published documents establish.
When would payments actually go out?
Not before the Court rules and any appeals are resolved. The Final Approval Hearing is set for November 30, 2026 at 9:00 a.m. Eastern Time in Brevard County, Florida, and the Notice states plainly that if the Court approves the settlement there may be appeals, that it is unknown whether any will be filed, and that payments will be distributed only after final approval and after any appeals are resolved. A hearing being held is not the same as approval being granted. No final approval order had been entered and no payment date had been announced as of August 28, 2026.
Official Settlement Notice
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
