Published
August 20, 2026
This settlement resolves claims against MCNA, the dental benefits administrator for many Medicaid and CHIP members, over a data incident on its network between February 26 and March 7, 2023. If you were sent a notice about it, two years of medical data monitoring come to you with no claim form, and you can separately file for up to $2,500 in documented out-of-pocket losses by October 19, 2026.
Current Status
Claims are open. A Claim Form for the cash benefit must be submitted online by 11:59 p.m. Eastern Time on October 19, 2026, or mailed so that it is postmarked by that date. The court has authorized notice to the class but has not yet decided whether to approve the settlement: the final approval hearing is scheduled for November 16, 2026 at 2:00 p.m. Eastern Time in Fort Lauderdale, Florida, and the notice warns the date and time can change without further notice. No payments have been issued and no payment date has been announced. If you were sent a notice about the MCNA data incident, the step to take now is to decide whether you have documented out-of-pocket losses worth filing for, and to hold onto the notice — the enrollment code printed on it is what activates the medical data monitoring later.
Status
Claims Open
Notice underway · final approval hearing November 16, 2026 · no ruling yet
Claim Deadline
October 19, 2026
11:59 p.m. Eastern Time online · mailed claims postmarked by the same date · also the opt-out and objection deadline
Estimated Payout
Up to $2,500
Documented out-of-pocket losses only, from a $250,000 aggregate cap and reduced pro rata if claims exceed it · plus 2 years of medical data monitoring that needs no Claim Form
Proof Required
Yes
Class Member ID from your notice to log in online, plus third-party documentation of the loss · the monitoring needs the enrollment code from that same notice
What Changed Recently?
A settlement was reached with Managed Care of North America, Inc., MCNA Insurance Company and Healthplex, Inc., the court authorized notice to the class, and the claim process opened in August 2026 with an October 19, 2026 deadline. That is what is new here — this page covers a settlement that has just become claimable, not a later development in one.The defendants deny all of the plaintiffs' claims and any wrongdoing whatsoever, and the notice states plainly that no court or other judicial body has made any judgment or determination that the defendants did anything wrong. Both sides say they agreed to settle to avoid the costs and risks of a trial and to let class members receive benefits sooner.
OCA has covered this incident since the notice letters went out. Our earlier MCNA Dental data breach investigation page describes what was known in 2023, before any settlement existed.
What Is This Settlement About?
MCNA administers dental and orthodontic benefits, largely for people enrolled in Medicaid and the Children's Health Insurance Program. On or about March 7, 2023, the defendants became aware that an unauthorized party had potentially accessed personally identifiable information and private health information on MCNA's network between February 26 and March 7, 2023. Notice letters to potentially affected people began going out on May 26, 2023.According to the settlement notice, the information potentially involved varied by person and may have included some combination of names, physical addresses, email addresses, dates of birth, Social Security numbers, driver's license numbers, government-issued ID numbers, health insurance information such as plan details and member numbers, Medicaid and Medicare ID numbers, information about dental and orthodontic care, and plan or group numbers. That is an unusually broad mix — a Social Security number plus a Medicaid ID plus treatment history in one place.
The plaintiffs allege negligence and breach of implied contract, among other claims. The settlement documents describe the event only as potential unauthorized access and do not attribute it to any particular group; contemporaneous reporting in 2023 tied it to the LockBit ransomware operation, which publicly claimed responsibility. That claim came from the attackers rather than from MCNA, and it has not been established in court.
Who Qualifies?
The settlement class is all living individuals in the United States who were sent a notice of the data incident stating that their private information was potentially impacted. Membership turns on having been sent that notice, not on whether you can show you were harmed. The 2023 breach notifications reached roughly 8.9 million people, which makes this one of the larger health-sector classes currently claimable.Four groups are excluded: directors, officers and agents of the defendants or their subsidiaries and affiliated companies; governmental entities; the judge assigned to the case, that judge's immediate family and court staff; and anyone who timely and properly opts out.
If your notice concerned a minor, the settlement website states that any claim submitted on the minor's behalf must be completed and submitted by the minor's parent or court-appointed legal guardian. Given who MCNA covered, a large share of the notices went to households with children.
How Much Can You Get?
There are two benefits, and they work very differently from one another.Two years of medical data monitoring, automatically. If you do not opt out, you are entitled to two years of CyEx Medical Shield Complete without submitting a Claim Form. The notice describes it as financial and identity data protection combined with five medical data monitoring categories, plus insurance for financial, identity and medical fraud, at no cost to you. Activation is not automatic even though eligibility is: the notice you received by mail or email carries a unique enrollment code, and codes become active within thirty days after the Effective Date of the settlement, which the notice currently estimates at January 15, 2027.
Cash for documented out-of-pocket losses. You may separately file a claim for unreimbursed out-of-pocket losses of up to $2,500. The defendants provide a total of up to $250,000 for these payments, and if the total value of all valid claims exceeds that figure, every payment is reduced pro rata. Against a class of this size, that aggregate cap is the number to pay attention to — the $2,500 is a per-claim ceiling, not an expected payment.
To count, a loss has to be an actual, documented and unreimbursed monetary cost due to fraud or identity theft, fairly traceable to the data incident, incurred after the incident, and one you made reasonable efforts to avoid or to get reimbursed elsewhere, including exhausting any credit monitoring or identity theft insurance you already had. You cannot be reimbursed for a cost that another source already covered, whether that was an identity protection product or a bank's consumer fraud policy.
There is no flat alternative cash payment here. Many data breach settlements offer $50 or $100 to anyone in the class who asks; this one does not, so a class member with no documented losses receives the monitoring and nothing else.
The defendants separately pay all settlement administration costs and any court-awarded attorneys' fees. Class Counsel will ask the court to award fees of up to $6,400,000 plus reimbursement of litigation costs of no more than $1,313,000, and if approved those amounts are paid by the defendants rather than taken out of a class fund.
What Proof or Notice ID Is Required?
Both benefits are gated on something printed in the notice you were sent, which is why this page is marked proof-required even though part of the settlement is automatic.The online claim portal opens with a login screen asking for your Class Member ID, which the form says can be found on the notice you received. Someone who never got a notice, or who threw it away, cannot simply file. The mailed paper Claim Form treats the Class Member ID as optional, so that is the route if you believe you are in the class but cannot locate your ID; you can also request it through the contact form on the official settlement website.
The cash benefit needs documentation on top of that. Reasonable supporting documentation means records generated by a third party — telephone records, correspondence, receipts and the like. A personal certification, declaration or affidavit does not count as the documentation on its own, though you may include one to add context to records you do submit. If you file without reasonable supporting documentation, or the administrator rejects your claim and you do not cure it, the claim is rejected.
One discrepancy is worth flagging before you file. The settlement website and the court-approved long form notice both say a qualifying loss must have occurred after the data incident and before March 7, 2026. The mailed paper Claim Form instead prints March 7, 2023 in the same sentence, which would leave no eligible window at all and appears to be a typographical error. Follow the settlement website's version, and if your loss falls between those two dates it is worth confirming with the administrator through the site's contact form before the deadline.
What Is the Deadline?
October 19, 2026 is the deadline for everything you might want to do in this settlement. Claim Forms must be submitted online by 11:59 p.m. Eastern Time that day, or mailed so that they are postmarked by that date. The same date is the deadline to exclude yourself from the class and the deadline to object to the settlement.Doing nothing has consequences worth understanding. If you take no action you stay in the class, you keep the automatic two years of medical data monitoring, and you give up the right to sue the defendants over the legal claims this settlement resolves — but you do not receive any cash, because the documented-loss payment requires a Claim Form.
How Do You Take Action?
File on the official settlement website, MCNA Data Breach Settlement. Log in with the Class Member ID from your notice, fill in your contact information, elect the cash payment for documented out-of-pocket losses, list each cost with its approximate date and amount, upload the third-party documentation supporting each one, choose your electronic payment method, then sign the attestation. Cash payments are made by electronic payment.A paper Claim Form may be mailed instead, and the site also offers a contact form for a lost Class Member ID or enrollment code, or to update your address after filing. Keep a copy of whatever you submit.
You do not need to do anything today for the medical data monitoring — just keep the notice, because the enrollment code on it is what turns the coverage on once the settlement takes effect.
What Happens Next?
The claim window closes October 19, 2026. The court then holds the final approval hearing on November 16, 2026 at 2:00 p.m. Eastern Time in Fort Lauderdale, Florida, where it will decide whether to approve the settlement and rule on Class Counsel's request for fees and costs. A hearing taking place is not the same as approval being granted, and the notice says the date and time may change without further notice.If the court approves the settlement, there may be appeals, and the notice is candid that it is always uncertain whether appeals will be filed or how long they take to resolve. Benefits become available as soon as possible after final approval and after any appeals are resolved. The notice gives an estimated Effective Date of January 15, 2027, with monitoring enrollment codes activating within thirty days after that — an estimate, not a commitment. No payment date had been announced as of August 20, 2026.
Sources and Verification
This page is based on the official settlement website and the court-approved settlement documents:- Official settlement website — MCNA Data Breach Settlement
- Court-approved long form Notice of Proposed Class Action Settlement (PDF)
- Official Claim Form and general instructions, Settlement Administrator file 83443
- Frequently asked questions on the official settlement website
- Crowe, et al., v. Managed Care of North America, Inc., et al., Case No. 0:23-cv-61065-AHS, U.S. District Court for the Southern District of Florida
OpenClassActions.com is a consumer news site and is not the settlement administrator or a law firm.
Questions
Do I have to file anything to get the two years of medical data monitoring?
No. If you do not opt out of the settlement, you are automatically entitled to two years of CyEx Medical Shield Complete and no Claim Form is required for it. You do need the unique enrollment code that came with your mailed or emailed notice to activate the coverage. The notice says enrollment codes become active within thirty days after the Effective Date of the settlement, which is currently estimated at January 15, 2027. The Claim Form is only for the separate cash payment for documented out-of-pocket losses.
Is there a no-proof cash payment in the MCNA settlement?
No. Unlike many data breach settlements, this one has no flat alternative cash payment that anyone in the class can claim without documentation. The only cash benefit is reimbursement of documented out-of-pocket losses, up to $2,500 per claim, and it requires reasonable supporting documentation generated by a third party, such as telephone records, correspondence or receipts. A personal certification, declaration or affidavit is not accepted as the documentation on its own.
What happens if more than $250,000 in valid claims are filed?
Cash payments are reduced pro rata. The Defendants provide a total of up to $250,000 for documented out-of-pocket loss payments, capped at $2,500 per individual claim. If the total dollar value of all valid claims exceeds $250,000, every payment is reduced proportionally, so the amount you actually receive can be less than the amount you claim.
What if I received a notice for a child?
The settlement website states that if you received a notice concerning a minor, any claim submitted on the minor's behalf must be completed and submitted by the minor's parent or court-appointed legal guardian. MCNA administered dental benefits for Medicaid and Children's Health Insurance Program recipients, so a substantial share of the notices went to households with children.
When would payments and monitoring actually start?
Not before the court rules. The final approval hearing is scheduled for November 16, 2026 at 2:00 p.m. Eastern Time in Fort Lauderdale, Florida, and the notice says the date and time can change without further notice. Settlement Class Member Benefits become available if and when the court grants final approval and after any appeals are resolved. The notice gives an estimated Effective Date of January 15, 2027 for the monitoring enrollment codes. No payment date had been announced as of August 20, 2026.
Official Settlement Notice
For more class actions keep scrolling below.
Settlement Amount
Up to $250,000 in cash claims
No common fund — the defendants separately pay the medical data monitoring, all administration costs, and any court-awarded fees and costs
Case Title
Crowe, et al., v. Managed Care of North America, Inc., et al.
Case Number
0:23-cv-61065-AHS
Court
U.S. District Court, Southern District of Florida
Final Approval Hearing
November 16, 2026 at 2:00 PM ET
Fort Lauderdale, Florida — the date and time may change without further notice
Administrator
Kroll Settlement Administration
Official Website
MCNA Data Breach Settlement
