People sent notice by CPAP Medical Supplies and Services, Inc. that their private information may have been exposed in the December 2024 cyberattack on the company’s computer systems may qualify to claim up to $5,000 in documented out-of-pocket losses, plus two years of CyEx Medical Shield Complete monitoring with $1 million of medical identity theft insurance. Claims close November 26, 2026, the deadlines to opt out or object fall almost a month earlier on October 30, 2026, and unlike most data breach settlements this one has no flat cash payment available without receipts.
Current Status
Claims are open. The deadline to file is November 26, 2026, whether the claim goes in online, by email or by mail with a postmark. The deadlines to opt out and to object come earlier, on October 30, 2026, so the decision about whether to stay in the class shuts almost a month before the money does. The Court has set a Final Approval Hearing for December 1, 2026 at 8:30 a.m. Eastern Time, held by Zoom, and the settlement has not been approved yet. No payment date has been announced: the Notice says settlement payments are distributed if the Court grants final approval and after any appeals are resolved. If a notice reached you, it carries the LoginID and PIN that open the online claim form.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Changed Recently?
The settlement is newly open to claims. CPAP Medical Supplies and Services, Inc. has agreed to resolve Brett Conner v. CPAP Medical Supplies and Services, Inc., Case No. CACE-26-011830, in the Circuit Court for Broward County, Florida, and the Court has authorized notice to the class. Simpluris, Inc. is administering it, and the claim portal, the long-form notice, the claim form and the settlement agreement are all live on the official settlement website.CPAP denies that it did anything wrong, and the Court has not decided who is right. The Notice states that the parties agreed to settle to avoid the costs and risks, disruptions and uncertainties of continuing the litigation, and that the Court did not decide whether the plaintiffs or the defendant are right. No finding of liability has been made against the company.
The Thing That Makes This Settlement Different: No Flat Cash Payment
Most data breach settlements offer two cash routes, and the choice between them is the decision the reader has to make: a flat payment claimable on a signature alone, or a documented out-of-pocket losses tier claimable with receipts, one instead of the other. This settlement has only the second one.The Notice lists exactly two benefits, and describes them as available together rather than as alternatives: two years of Medical Data Monitoring from CyEx, Inc., and a Cash Payment for Documented Losses of up to $5,000. There is no Alternate Cash Payment, no flat amount, and no pro rata share of a common fund payable without proof. A class member who has not spent money because of the breach can still claim the monitoring, and should — but there is no cash here for someone with nothing to document.
That shape changes the arithmetic of whether to bother filing. On a settlement with a $50 or $75 no-proof tier, the flat payment is the floor and the documented route is the upside. Here the floor is the monitoring, and the cash is available only to the subset of the class who kept paper. Anyone who bought credit monitoring, paid to freeze and unfreeze their credit, replaced an ID, or lost money to fraud after the notice arrived is in that subset and probably does not realize it — those are exactly the expenses the Notice lists as covered. Our explainer on how data breach class actions work covers what these cases typically pay and what a release costs.
Who Qualifies?
The Court defined the Class as all living individuals residing in the United States who were sent notice by the Defendant that their Private Information may have been impacted in the Data Incident. The class is nationwide rather than Florida-only, even though the case sits in a Broward County courtroom: what matters is having been sent a notice, not where you live now.Two parts of that definition do real work. The first is sent notice — the administrator built the class list from CPAP’s records, and the LoginID and PIN needed to file online are printed on that mailing, so in practice the notice is the working signal of membership. Class members may also have received an earlier notice directly from CPAP, separate from the court-authorized one. The second is living, which the Notice does not explain: nothing in it says how the definition applies to someone who received a notice and has since died, or whether an estate may file, and that is a question for the Settlement Administrator through the official settlement website.
Excluded from the Class are the directors, officers and agents of the Defendant; governmental entities; the Judge assigned to the case, that Judge’s immediate family and Court staff; and anyone who timely and properly opts out of the Settlement.
The lawsuit alleges that during the December 2024 targeted cyberattack on CPAP’s computer systems, certain files containing private information were accessed. The Notice says those files may have contained names, physical addresses, email addresses, telephone numbers, Social Security numbers, driver’s license numbers, health insurance information, medical histories, treatment plans and financial information. That is the full range — identity documents, payment data and clinical records in the same file — which is why the settlement’s monitoring benefit is a medical product rather than a credit one.
How Much Can You Get?
There are two benefits, and they stack:- Documented Out-of-Pocket Losses — up to $5,000. Actual, documented, unreimbursed losses caused by the Data Incident and incurred between December 13, 2024 and November 26, 2026, supported by proof such as bank statements or receipts.
- Medical Data Monitoring — two years. CyEx Medical Shield Complete, with $1 million of medical identity theft insurance. No documentation is required to claim it.
The $5,000 is a ceiling, not an estimate, and it sits under a second ceiling that matters more. The Notice sets a maximum of $500,000 payable by CPAP for the documented-loss benefit, and says that if the total dollar amount of all valid claims exceeds that amount, class members’ distribution amounts are reduced pro rata. Whether anyone actually receives close to $5,000 therefore depends on how many people file and for how much — a figure nobody can know before the claim window closes. Treat the cap as the real number to plan around and the $5,000 as the per-person limit.
The covered expenses are broader than people expect and are worth reading before assuming there is nothing to claim. The Notice lists losses because of identity theft or fraud; fees for credit reports, credit monitoring, or freezing and unfreezing your credit; the cost to replace your IDs; and postage to contact banks by mail. Anyone who bought their own monitoring subscription or paid a bureau to freeze their credit after the notice arrived already has a documented loss. Expenses already reimbursed by a third party cannot be claimed.
The medical monitoring is the benefit that fits this class best, and it is the one most likely to be left unclaimed. CyEx Medical Shield Complete monitors for healthcare insurance ID exposure, Medical Record Number exposure and unauthorized Health Savings Account spending, and puts a fraud resolution agent on the line if something surfaces. That is a different product from ordinary credit monitoring, and it is aimed squarely at the risk in a file that held health insurance details and treatment plans: medical identity theft, where someone else’s care gets billed to your policy and lands in your records.
There is no common settlement fund. The Notice discloses no total settlement amount, and the $500,000 documented-loss cap is the only aggregate figure in it. The attorneys’ fees and the service awards are paid by CPAP separately rather than deducted from anything a class member receives, so nothing here shrinks to pay the lawyers — only the pro rata cap can reduce a cash payment.
What Proof Is Required?
Filing online requires the LoginID and PIN printed on the notice mailed to you. The settlement website says so on the claim form login screen — you must log in with your LoginID and PIN, and both are on the Notice that was sent to you — which is why this page treats the settlement as Proof Required: Yes even though the monitoring benefit asks for no documentation at all.The paper route is looser. The same site hosts a downloadable Claim Form that can be printed, completed and returned by email or by mail with any supporting documentation. That is a real path for someone whose notice went astray, but it is an envelope rather than an open online door, so it does not make this a no-proof settlement. Anyone missing their credentials can request them through the official settlement website by giving a full name and mailing address.
Past that credential, the documentation burden splits by benefit:
- Medical Data Monitoring, two years: nothing beyond the claim form. The Notice states all Class Members are eligible to claim it.
- Out-of-Pocket Losses, up to $5,000: proof such as bank statements or receipts showing how much you spent or lost, and showing that the expense was because of the Data Incident.
The documented tier carries a limit worth reading twice: notes or papers you made yourself are not enough on their own. The Notice says they can explain or support other proof but cannot carry a claim by themselves. Expenses already reimbursed by a third party are out, and the loss has to fall inside the December 13, 2024 to November 26, 2026 window.
What Are the Deadlines?
The dates here do not all land on the same day, and the two that come first are the ones people miss:- October 30, 2026 — opt out. A written Request for Exclusion must be postmarked by this date. It must carry the case name and number, your full name, mailing address, telephone number and email address, your personal signature, and the words “Request for Exclusion” or a clear equivalent. You may exclude only yourself, not another person.
- October 30, 2026 — object. A complete objection must be filed with the Clerk of Court by this date, with copies sent to the Settlement Administrator, Class Counsel and counsel for the Defendant.
- November 26, 2026 — submit a claim. Online or by email by that date, or the completed and signed Claim Form with supporting documentation postmarked no later than that date.
- December 1, 2026 — Final Approval Hearing. 8:30 a.m. Eastern Time, held by Zoom, with the connection details printed in the Notice.
The four-week gap between the exclusion deadline and the claim deadline is the trap. Someone who reads the notice in mid-November can still file, but the decision to leave the class and keep the right to sue on their own has already been made for them by the calendar. Our glossary entry on opting out of a class action covers what that choice trades away. Objecting does not cost you the money — an objector stays in the class and can still file a claim — while opting out means no settlement benefits at all.
Objecting demands considerably more than an opinion. Beyond the case name and number and your own contact details, the Notice requires all grounds for the objection with any legal support; the identity of every lawyer representing you, including any who may be paid in connection with the objection; a count of how many times you have objected to a class action settlement in the preceding five years, with the caption of each case and copies of any orders ruling on those objections; the same five-year history for your counsel and their law firm; whether you or your counsel will appear or testify at the hearing; a list of any witnesses; your own physical signature, which an attorney’s signature cannot substitute for; and one requirement newer than most settlement notices — a statement confirming whether you or your counsel used any form of artificial intelligence in preparing the objection.
How Do You File?
Claims go through the official settlement website, CPAP Data Incident Settlement.com, administered by Simpluris, Inc. Log in to the claim form with the LoginID and PIN from your notice, then claim the two years of medical data monitoring and, if you have documented losses, itemize them and attach the supporting paper. Both benefits are claimed on the same form; claiming the monitoring does not cost you the cash or the other way round.If you prefer paper, the same site hosts a downloadable Claim Form that can be printed, completed and returned by email or by mail with any supporting documentation, postmarked by November 26, 2026. Keep a copy of whatever you submit. Filing is free, and class members are not charged for Class Counsel’s services. If your contact information changes after you file, tell the administrator through the official settlement website.
Is This the Philips CPAP Recall Settlement?
No, and the overlap in the name is worth untangling because both cases reach people who use a CPAP machine at home.The $479 million Philips Respironics settlement was about the devices themselves — recalled CPAP and BiPAP machines whose sound abatement foam could degrade — and it paid device owners for recall-related losses. Its claim window has closed. This case is against CPAP Medical Supplies and Services, Inc., a separate company in the business of selling CPAP supplies, and it is about a cyberattack on that company’s computer systems in December 2024. No device is at issue, and nothing about the condition of a machine matters to eligibility here.
The practical test is simple: this class is defined by having been sent a data incident notice by CPAP Medical Supplies and Services. Owning a Philips machine does not put anyone in it, and having filed in the Philips settlement neither helps nor hurts a claim here.
Who Pays the Fees
CPAP does, separately from anything class members receive. Class Counsel will ask the Court to approve $400,000 as reasonable attorneys’ fees and reimbursement of litigation costs, plus service award payments of $1,000 for each of the class representatives, and the Notice states that both amounts will be paid by CPAP. The Court appointed Jeff Ostrow of Kopelowitz Ostrow P.A. and Mariya Weekes of Milberg PLLC as Class Counsel.That structure matters more than it sounds. On a common-fund settlement, fees and service awards come off the top of a fixed pot before any claimant is paid, which is why so many flat payments are published as estimates that shrink later. Nothing here is deducted from what a class member gets: the documented-loss cash and the monitoring are funded by CPAP on top of the fees. The one thing that can still reduce a payment is the $500,000 cap on the documented-loss benefit.
What You Give Up
Staying in the class means you cannot sue CPAP over the claims this settlement resolves. The Settlement Agreement’s Releases section defines the Released Claims broadly: every claim, known or unknown, accrued or unaccrued, fixed or contingent, under any federal, state, local, statutory or common law, arising out of or relating to the facts, events, acts, disclosures, statements, omissions or failures to act relating to the Data Incident. The Released Parties reach past the company itself to its affiliates, divisions, employees, members, providers, partners, principals, directors, officers and owners, and their attorneys, insurers, predecessors, successors, agents and assigns.A release written that way covers harm you have not found yet. A fraudulent medical bill that surfaces in 2029 and traces back to this incident is released now, before anyone knows about it, and that is the real price of the monitoring and the cash.
Doing nothing does not avoid the release. A class member who never files still gives up those claims and is still bound by the Court’s orders — they simply receive nothing in exchange. The only way to keep the right to sue CPAP individually is to opt out by October 30, 2026, which forfeits the cash and the monitoring alike. Given that the monitoring requires no documentation at all, doing nothing is the one option with no upside.
What Happens Next?
At the December 1, 2026 hearing the Court will decide whether to approve the Settlement, will rule on how Class Counsel should be paid and on whether to award the service award payments, and will consider any timely objections. Nobody is required to attend — the Notice says Class Counsel will answer the Court’s questions and that a timely objection will be considered whether or not the objector appears. The Notice also warns that the date and time may change without further notice, with any change posted on the settlement website.If approval is granted, there may be appeals. The Notice says plainly that it is not known whether appeals will be filed or how long they would take to resolve, and that settlement payments are distributed only if the Court grants final approval and after any appeals are resolved. No payment date has been announced, and a hearing being held is not the same as approval being granted.
Sources and Verification
• Official settlement website — CPAP Data Incident Settlement.com, including its Home, FAQs, Important Documents, Important Dates and claim form login pages• Notice of Proposed Class Action Settlement (PDF)
• Brett Conner v. CPAP Medical Supplies and Services, Inc., Case No. CACE-26-011830 (Fla. Cir. Ct., Broward Cnty.) — Settlement Agreement and Release, Section X (Releases)
• FTC — IdentityTheft.gov recovery steps
• U.S. Department of Health and Human Services — health information privacy for individuals
Questions
Is there a flat cash payment I can claim without receipts?
No, and that is the main thing separating this settlement from most data breach settlements. The Notice describes exactly two benefits: two years of medical data monitoring, and a Cash Payment for Documented Losses of up to $5,000. There is no alternate cash payment, no flat amount and no pro rata share of a fund available on a sworn statement alone. A class member with no documented out-of-pocket losses can still claim the monitoring, but there is no cash route that does not require proof.
Is this the same as the Philips Respironics CPAP recall settlement?
No. Different company, different case, different kind of claim. The Philips Respironics settlement was about recalled CPAP and BiPAP machines whose sound abatement foam could degrade, and its claim window has closed. This case is against CPAP Medical Supplies and Services, Inc., a separate company that sells CPAP supplies, and it is about a December 2024 cyberattack on its computer systems rather than about any device. Being a Philips device owner does not put anyone in this class, and vice versa: this class is defined by having been sent a data incident notice by CPAP Medical Supplies and Services.
Do I have to file a claim to get the two years of medical monitoring?
Yes. The settlement website and the Notice both state that the only way to receive benefits or payments from this Settlement is by submitting a valid and timely Claim Form, and the Notice's answer on doing nothing says a class member who does nothing will not receive a benefit. Nothing in the Notice describes a separate enrollment code mailed for the monitoring, so the claim form is the route to both benefits. Claiming the monitoring requires no documentation, which makes filing worthwhile even for someone with no out-of-pocket losses to prove.
What counts as documentation for a claim up to $5,000?
Third-party paper showing what you spent or lost, such as bank statements or receipts, and showing that the expense was because of the Data Incident. The Notice says notes or papers you made yourself can explain or support other proof but are not enough on their own to make a valid claim. Expenses already reimbursed by a third party cannot be claimed. The losses must have been incurred between December 13, 2024 and November 26, 2026.
What happens if the documented-loss claims add up to more than $500,000?
Everyone's payment is cut proportionally. The Notice sets a maximum of $500,000 payable by CPAP for the documented-loss benefit and states that if the total dollar amount of all valid claims exceeds that amount, class members' distribution amounts are reduced pro rata. So the $5,000 figure is a per-person ceiling rather than a promise, and the amount actually paid depends on how many people file and for how much. The medical monitoring is not described as subject to that cap.
What is CyEx Medical Shield Complete and how is it different from credit monitoring?
It is medical identity monitoring rather than credit monitoring. The Notice says it comes with $1 million of medical identity theft insurance and monitors for healthcare insurance ID exposure, Medical Record Number exposure, and unauthorized Health Savings Account spending, with a fraud resolution agent available if something surfaces. That is aimed at the specific risk in a file holding health insurance details and medical histories: someone else's care being billed to your policy and ending up in your records, which ordinary credit monitoring does not watch for.
The class is defined as living individuals — can an estate file for someone who has died?
The Notice does not say. The Court defined the Class as all living individuals residing in the United States who were sent notice by the Defendant that their Private Information may have been impacted in the Data Incident, and neither the Notice nor the settlement website explains how that applies to someone who received a notice and has since died, or whether an estate or personal representative may file. For a class drawn from a home medical equipment customer list that is a real question, and it is one to put to the Settlement Administrator directly through the official settlement website rather than to guess at.
