Patients mailed notice that their protected health information was exposed in the October 2024 breach at Drug and Alcohol Treatment Services may qualify to claim up to $5,000 in documented out-of-pocket losses, or an alternate flat cash payment instead, from the DATS data breach class action settlement. Claims close September 24, 2026, and one year of medical identity theft monitoring can be claimed alongside either cash option.
Current Status
Claims are open, and the window is short. Claim Forms must be submitted online by September 24, 2026, or mailed with a September 24, 2026 postmark; the notice gives the date without an official timezone, so only the date is published here. The deadlines to exclude yourself from the class or to object have already passed — both closed August 25, 2026.The Court of Common Pleas of Lackawanna County, Pennsylvania granted preliminary approval and scheduled the final approval hearing for November 24, 2026 at 10:30 a.m. in Courtroom #1 of the Lackawanna County Courthouse. No final approval order has been entered, and no payment date has been announced. Nothing in this settlement is paid automatically: a class member who files no Claim Form receives no cash and no monitoring, and still releases their claims if the court approves the deal.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Changed Recently
The claim process opened under a court-authorized notice program in Woytach v. Drug and Alcohol Treatment Services, Inc., Case No. 2025-CV-03681, in the Court of Common Pleas of Lackawanna County, Pennsylvania. RG/2 Claims Administration is administering the settlement, and class members were mailed a postcard notice carrying the Class Member ID and Pin Code needed to file online.Drug & Alcohol Treatment Service — identified in the case caption as Drug and Alcohol Treatment Services, Inc. — is a Scranton, Pennsylvania provider of drug and alcohol treatment services. The complaint alleges that an unauthorized actor accessed the company's computer network between October 5 and October 6, 2024, reaching files that held patient records, and pleads claims for negligence, negligence per se, breach of contract, breach of implied contract, breach of fiduciary duty, breach of confidence and unjust enrichment. DATS disagrees with those claims and denies any wrongdoing. The court has not decided who is right; both sides agreed to settle after a full-day private mediation to avoid the cost and risk of continued litigation.
The timeline behind the case is unusually long. DATS posted notice of the incident on its website on December 5, 2024, while its review of the affected data was still under way, then mailed written notice to individuals on or around May 2, 2025. Eight putative class actions followed beginning around May 12, 2025, and the court consolidated them in September 2025.
Who Qualifies?
The court provisionally certified a class of all persons in the United States whose personal information was impacted by the data breach DATS announced in May 2025, including everyone who was sent notice of it. The preliminary approval order states that DATS notified about 22,215 individuals. If a postcard notice arrived with a Class Member ID and Pin Code, that is the confirmation of eligibility.Three groups are excluded: the directors, officers and agents of DATS and of its subsidiaries and affiliated companies; governmental entities; and the judge assigned to the case, along with the judge's immediate family and court staff. Anyone who mailed a valid request for exclusion by the August 25, 2026 postmark deadline is also out of the class and cannot file a claim.
The information at issue varied by person. According to the notice, the files involved held patient names, addresses, dates of birth, Social Security numbers, health insurance information, patient account numbers, medication information, diagnosis and treatment information, doctors' names, and medical claims and billing information. Substance use treatment records are among the most sensitive categories a breach can reach, which is part of why this settlement's monitoring benefit is medical rather than the credit monitoring most data breach settlements offer.
How Much Can You Get?
The cash side is an either/or choice, and the medical monitoring sits alongside whichever cash option is selected.Cash Payment A — Documented Losses. Up to $5,000 per class member for unreimbursed out-of-pocket expenses more likely than not traceable to the breach and incurred on or after October 5, 2024. The notice lists the categories that qualify: unreimbursed bank fees; long distance phone charges; cell phone charges, but only if billed by the minute; data charges, but only if billed by the amount of data used; postage; gasoline for local travel; and fees for credit reports, credit monitoring or other identity theft insurance products bought between October 2024 and the claims deadline. Reasonable documentation is required — credit card statements, bank statements, invoices, telephone records, screenshots or receipts. A self-prepared note can add context to other documentation but is not enough on its own.
Cash Payment B — Alternate Cash Payment. A flat cash payment that needs no receipts and no explanation of loss. Choosing it forecloses the documented-loss route. The settlement does not fix its dollar value anywhere, and that is deliberate: the amount rises or falls pro rata depending on the total dollar value of valid claims submitted.
Medical Monitoring. One year of medical identity theft protection through CyEx Medical Shield, claimable in addition to either cash option. It is available whether or not the class member accepted the credit monitoring DATS offered with its original breach notice. Anyone who took that earlier offer, or who bought monitoring elsewhere because of the breach, can postpone activating this benefit for up to twelve months so the two do not overlap.
The alternate payment is whatever the fund has left, so the order the fund is spent in decides its size. DATS is funding a $549,000 non-reversionary settlement fund — non-reversionary meaning no unclaimed portion goes back to the company once the settlement takes effect. Administration costs, taxes, court-approved attorneys' fees of up to $183,000 plus litigation costs, and service awards of up to $2,000 for each class representative come out of that fund first, leaving the net settlement fund.
The net fund is then spent in a fixed order: medical monitoring claims are paid first, documented-loss claims second, and only what survives both is divided among the alternate cash claims, split evenly across the number of valid ones. So the alternate payment is the residual, and its size cannot be known until the claims are counted. The agreement also sets out the downside case — if documented-loss claims alone exceed the net fund, those claims are cut pro rata and no alternate cash payments are made at all. Money still left over more than 120 days after the first distribution goes out in a second round to alternate-payment claimants who cashed their first check, repeating until the average payment would fall below the threshold the agreement sets, after which the remainder goes to a court-approved nonprofit recipient.
Separately from the money, DATS agreed to adopt, maintain or implement data security measures designed to strengthen its information security for a period of five years, and to give class counsel a confidential declaration confirming those measures were put in place.
What Proof or Notice ID Is Required?
This settlement is proof-required, and the gate is the login rather than receipts. The settlement website states that the unique Class Member ID and Pin Code printed on the postcard notice are required to access the online Claim Form, and the claim portal asks for both before it will open a form. A class member who never received the postcard, or who threw it away, cannot file online without first asking the settlement administrator to reset the credentials through the official settlement website.The paper route is the escape hatch. A Claim Form can be completed and mailed to the settlement administrator, and the settlement agreement instructs the administrator to use reasonable efforts to verify a claim submitted without a unique class member identifier. That does not help someone who wants to file online, which is why the facts strip above reads Yes rather than No — and with a September 24, 2026 postmark deadline, the mail route leaves very little margin.
The documentation each cash option requires then differs. The alternate cash payment needs no proof or explanation of loss. Documented out-of-pocket claims need reasonable supporting documentation of the kind listed above, and expenses already reimbursed from another source do not qualify. The medical monitoring needs no documentation, only the claim and a valid email address, because the activation code is emailed.
If a claim comes in incomplete, it is not simply denied. The administrator sends a notice of deficiency and gives the class member time to cure it. A documented-loss claim that is rejected and not cured may be treated as a claim for the alternate cash payment instead, so a failed receipts claim does not automatically leave someone with nothing.
What Is the Deadline?
Online Claim Forms must be submitted by September 24, 2026. Mailed Claim Forms, including any supporting documentation, must be postmarked no later than September 24, 2026. The notice gives these as dates without an official timezone, so no time of day is published here.The other two deadlines are gone. Requests for exclusion had to be postmarked by August 25, 2026, and objections had to reach the settlement administrator by first-class mail no later than the same date. Class members who let both pass are bound by the settlement if the court approves it, which means releasing their claims against DATS and the released parties over the breach whether or not they ever file a Claim Form. Filing is the only remaining step that changes the outcome.
How Do You Take Action?
The fastest route is the online claim form at the official settlement website, DATSDataBreachSettlement.com. Enter the Class Member ID and Pin Code from the postcard notice, choose either the documented-loss payment or the alternate cash payment, add the medical monitoring if you want it, upload any supporting documents, and submit before September 24, 2026.The claim form also asks how you want to be paid. Electronic payment through PayPal or Venmo is an option, and the settlement website walks through setting it up; class members who do not choose one receive a paper check by mail. A check has to be deposited or cashed within 90 days of distribution, and an email address is required on the form if you are claiming the medical monitoring, since the activation code arrives by email.
To file on paper, complete and sign the Claim Form, attach supporting documentation for any documented-loss claim, and mail it to the settlement administrator so it is postmarked by September 24, 2026. A paper Claim Form can be downloaded from the settlement website or requested from the administrator through it. If you cannot find your Class Member ID and Pin Code, the settlement website's contact page is where to ask for a login reset.
What Happens Next?
The next milestone is the final approval hearing on November 24, 2026 at 10:30 a.m. in Courtroom #1 of the Lackawanna County Courthouse. At that hearing the court will consider whether the settlement is fair, reasonable and adequate, whether to grant the requested attorneys' fees and costs, and whether to award the requested service awards to the class representatives. The notice warns that the hearing may move to a different date, time or location without further notice, so the settlement website is the place to check.If the court grants final approval, the settlement becomes effective the day after the approval order when no objections were filed; if objections were filed, the effective date is pushed to 30 days after entry of the order, or later if anyone appeals. Benefits are then distributed no later than 75 days after final approval or 30 days after the effective date, whichever is later. No payment date had been announced as of September 17, 2026.
Frequently Asked Questions
Who qualifies for the DATS data breach settlement?
The settlement class is everyone in the United States whose personal information was impacted by the data breach Drug and Alcohol Treatment Services announced in May 2025, including everyone who was sent notice of it. DATS mailed written notice to about 22,215 people on or around May 2, 2025. Excluded are the company's directors, officers and agents and those of its subsidiaries and affiliates, governmental entities, and the judge assigned to the case along with the judge's immediate family and court staff.
How much does the DATS data breach settlement pay?
Class members choose one of two cash options. Cash Payment A reimburses documented out-of-pocket expenses traceable to the breach, up to $5,000 per person, with supporting documentation. Cash Payment B is an alternate flat cash payment that needs no receipts; its size is not fixed in advance and is calculated pro rata from whatever remains in the $549,000 fund. Either option can be combined with one year of CyEx Medical Shield medical identity theft monitoring.
Do I need my Class Member ID and Pin Code to file a DATS claim?
To file online, yes. The settlement website states that the unique Class Member ID and Pin Code printed on the postcard notice are required to access the online Claim Form, and the claim portal will not open without both. A paper Claim Form can be completed and mailed instead, and the settlement agreement directs the administrator to make reasonable efforts to validate a mailed claim submitted without the identifier. Anyone who cannot find their credentials can ask the settlement administrator to reset them through the official settlement website.
What is the deadline for the DATS data breach settlement?
Claim Forms must be submitted online by September 24, 2026, and mailed Claim Forms must be postmarked no later than September 24, 2026. The notice gives the date without an official timezone, so no time of day is published here.
Can I still opt out of or object to the DATS settlement?
No. Both windows have closed. Requests for exclusion and written objections had to be postmarked no later than August 25, 2026. Class members who did not exclude themselves by that date remain in the settlement class, and will release their claims against the company and the other released parties if the court grants final approval, whether or not they file a Claim Form.
Is datsdatabreachsettlement.com legit?
Yes. DATSDataBreachSettlement.com is the official, court-authorized settlement website for Woytach v. Drug and Alcohol Treatment Services, Inc., Case No. 2025-CV-03681, in the Court of Common Pleas of Lackawanna County, Pennsylvania, and RG/2 Claims Administration is the court-appointed settlement administrator. DATS denies the claims and denies any wrongdoing, and the court has not decided who is right. File only through the official settlement website.
When will DATS settlement payments be sent?
No payment date has been announced. Under the settlement agreement, benefits are distributed no later than 75 days after final approval or 30 days after the settlement becomes effective, whichever is later, and the effective date itself can be pushed back by an appeal. The final approval hearing is scheduled for November 24, 2026. Class members can elect PayPal or Venmo on the claim form, and anyone who does not receives a paper check, which has to be deposited or cashed within 90 days.
What information was exposed in the Drug and Alcohol Treatment Services data breach?
According to the court-authorized notice, the files involved contained protected health information that varied by individual but included patient names, addresses, dates of birth, Social Security numbers, health insurance information, patient account numbers, medication information, diagnosis and treatment information, doctors' names, and medical claims and billing information.
Watch Out for Scams
A court-appointed settlement administrator never charges a fee to release a class action payment and never asks for banking passwords or an upfront processing payment by text or phone. Filing is free through the official settlement website linked on this page, and that is the only place a claim should be submitted. Records from a substance use treatment provider are among the most sensitive a breach can expose, and follow-on phishing that references a real diagnosis or a real prescription is far more convincing than a generic scam message.OCA has followed this incident since the notices went out, in our earlier Drug and Alcohol Treatment Services data breach report. Behavioral health providers have produced several of these cases: the Valley Oaks Health data breach settlement and the Coleman Professional Services data breach settlement both have claims still open. For how these cases work generally, read our explainer on the data breach class action, or browse the current roundup of open data breach settlements.
Sources and Verification
- Woytach v. Drug and Alcohol Treatment Services, Inc. — Official Settlement Website
- Notice of Class Action and Proposed Settlement, Woytach v. Drug and Alcohol Treatment Services, Inc., Case No. 2025-CV-03681 (embedded below)
- Class Action Settlement Agreement and Release, and the Claim Form and Postcard Notice attached to it as exhibits (embedded below)
- Order Granting Preliminary Approval of Class Action Settlement, Court of Common Pleas of Lackawanna County, Pennsylvania (embedded below)
- Lackawanna County Courts — Court of Common Pleas
