People who were sent a notice that their information was affected by the April 2025 data breach at Gateway Community Services may qualify to claim an expected $75 or up to $5,000 in documented losses from the Gateway Community Services data breach class action settlement, and all of them get three years of medical identity monitoring. Claims close January 25, 2027.
Current Status
Claims are open. The deadline to file is January 25, 2027. The court granted preliminary approval on October 7, 2026, and the final approval hearing is set for February 23, 2027. No payment date had been announced as of November 13, 2026, and payments will not go out unless the court grants final approval.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Changed Recently?
The claim form opened on the official settlement website after the Duval County Circuit Court granted preliminary approval on October 7, 2026. Gateway Community Services, Inc., a behavioral health and addiction treatment provider in Jacksonville, Florida, agreed to the settlement to resolve a class action over a cyberattack on its network.According to the settlement agreement, Gateway experienced a disruption on its IT network on April 11, 2025, determined that certain files may have been taken without authorization, finished reviewing the affected data on May 16, 2025, and began mailing notice letters to patients on May 28, 2025. The plaintiffs allege Gateway failed to adequately protect the information. In March 2026 the court allowed the negligence claim to proceed and dismissed the other claims. Gateway denies any fault or liability, and the court has not decided who is right.
Who Qualifies?
The class includes all living people residing in the United States who were sent a notice from Gateway that their private information was affected by the April 2025 data incident. According to the settlement documents, that information included names, addresses, Social Security numbers, dates of birth, driver’s license or state ID numbers, medical or treatment information and health insurance information.The class excludes Gateway’s directors, officers and agents, government entities, the judge and court staff, and anyone who opts out. A person who did not receive a breach notice from Gateway is not in the class.
How Much Can You Get?
Claimants choose one of two cash options:Cash Payment A covers documented out-of-pocket losses of up to $5,000 per person tied to the breach. Each expense needs documentation such as receipts, bills, invoices, telephone records or correspondence; a self-prepared statement alone does not qualify, and expenses already reimbursed are not covered. Rejected Payment A claims that are not fixed are converted to Payment B.
Cash Payment B is an alternative payment the notice says is expected to be $75 and may be larger or smaller depending on the claims filed. It requires no documentation.
Gateway is paying $250,000 for cash claims. The settlement agreement caps Payment A and Payment B together at that amount and allows pro rata reductions if valid claims exceed it. The settlement website describes the cap as applying to the $75 payments; the agreement’s wording is the controlling text.
Every class member also gets three years of CyEx Medical Shield Complete without filing a claim. It monitors for medical identity theft, such as exposure of health insurance ID numbers and medical record numbers or unauthorized health savings account spending, and includes $1 million of medical identity theft insurance. It is not credit monitoring. The enrollment code was sent with the postcard notice.
Gateway pays attorneys’ fees and costs of up to $275,000, service awards of $2,500 for each class representative and the administration costs separately from the $250,000, if the court approves them. Before final approval, Gateway is also to give class counsel a description of the security measures it has put in place since the incident.
What Proof or Notice ID Is Required?
The online claim form requires the Login ID and PIN printed on the notice. Its login page states that a claimant must sign in with those credentials to start a claim, and someone who cannot find them has to request them from the settlement administrator through the official website by giving a full name and mailing address. The printed claim form asks for the Login ID only if known and can be mailed instead.The $75 payment requires no receipts. Documented-loss claims require records for each expense.
What Is the Deadline?
Claims must be submitted by January 25, 2027. The settlement website says mailed claims must be postmarked by that date, while the printable form says it must be received by then. The settlement documents do not name a time zone. Requests to opt out and objections are also due January 25, 2027.How Do You Take Action?
Claims are filed on the official Gateway data incident settlement claim form. The form asks the claimant to log in with the notice’s Login ID and PIN, choose Cash Payment A or Cash Payment B, and pick a payment method: PayPal, Venmo, Zelle or a virtual prepaid card.Class members who do nothing receive no cash payment, remain eligible for the medical monitoring and give up the right to sue Gateway over the incident.
What Happens Next?
Circuit Judge Michael S. Sharrit will hold the final approval hearing on February 23, 2027 at 1:30 p.m. Eastern time by Zoom. Payments depend on final approval and on any appeals being resolved.Sources and Verification
- Official Gateway data incident settlement website, its FAQ and important dates
- Long-form notice
- Settlement agreement
- Preliminary approval order (Oct. 7, 2026)
- Printable claim form
Questions
Why might the $75 payment come in lower?
Gateway is paying $250,000 for cash claims. Under the settlement agreement, that cap covers both documented-loss claims and the $75 alternative payments together, and if valid claims add up to more than $250,000 they may be reduced pro rata. The notice describes $75 as an expected amount that may be larger or smaller.
Is the medical monitoring automatic?
Yes. Every class member is entitled to three years of CyEx Medical Shield Complete without filing a claim, using the enrollment code sent with the postcard notice. It monitors for medical identity theft, such as exposure of health insurance IDs and medical record numbers, and includes $1 million of medical identity theft insurance. It is not a credit monitoring product.
Do attorneys’ fees come out of class members’ payments?
No. Gateway pays attorneys’ fees and costs of up to $275,000, service awards of $2,500 for each class representative and the costs of administration separately from the $250,000 set aside for cash claims, if the court approves them.
What did the lawsuit claim Gateway did wrong?
The plaintiffs allege Gateway Community Services failed to adequately protect patients’ personal and health information, which was exposed in a cyberattack on its network in April 2025. Gateway denies wrongdoing, and the court has not decided who is right.
