This $3,100,000 settlement covers people whose private information was compromised in a cybersecurity incident on Palomar Health Medical Group's computer systems between April 23 and May 5, 2024. If you were mailed a notice, you can take an alternative cash payment the administrator estimates at $60 with no documentation, or claim up to $5,000 in documented losses instead — and two years of credit monitoring can be added to either, or claimed entirely on its own.
Current Status
Claims are open. Claim Forms must be submitted online or mailed with a postmark no later than October 22, 2026; the notice states a date rather than a cutoff time. The deadline to opt out or to object is earlier, on October 7, 2026, and the final approval hearing is scheduled for 10:30 a.m. on November 6, 2026 in San Diego — so the court has not yet decided whether to approve the settlement, and no payment date had been announced as of August 30, 2026. If you were mailed a notice with a Notice ID and Confirmation Code, the action to take now is to file a Claim Form. Nothing here arrives automatically: the notice says a class member who does nothing receives no benefits and still gives up the right to sue.What Changed Recently?
Notice has gone out to the settlement class and the claim window is now running toward its October 22, 2026 close. The case is captioned Castro et al. v. Arch Health Partners, Inc. d/b/a Palomar Health Medical Group, Case No. 37-2024-00024339-CU-NP-CTL, in the Superior Court of California, County of San Diego. Arch Health Partners, Inc. is the entity that does business as Palomar Health Medical Group, the San Diego County medical group named in the case.According to the court-authorized notice, the Data Incident is a cybersecurity incident on the defendant's computer systems that occurred between April 23, 2024 and May 5, 2024, in which class members' Private Information was accessed, acquired, disclosed or compromised. The notice does not itemize which categories of information were involved; that detail sits in the complaint and the settlement agreement rather than in the notice.
The plaintiffs allege Palomar Health is liable for the incident and pleaded a number of legal claims. Palomar Health denies all the claims and contentions against it and denies all charges of wrongdoing or liability, and the notice states plainly that the settlement is not an admission of wrongdoing and is not an indication that the defendant violated any law. The court has not decided in favor of either side.
The notice also records something the settlement fund does not pay for: since the incident, the defendant says it has deployed endpoint detection and response tools, added backup storage capabilities and expanded network monitoring, and has borne the cost of those changes separately from the $3,100,000.
Who Qualifies?
The Settlement Class is all individuals whose Private Information was accessed, acquired, disclosed or compromised in the Data Incident. Class members were sent notice by mail, and the notice tells recipients that if they received it, they are eligible to submit a Claim Form. If you are unsure whether you are included, the official settlement website's contact page is the place to ask.Excluded are the defendant's directors, officers and agents, along with those of its subsidiaries and affiliated companies; governmental entities; and the judge assigned to the action together with that judge's immediate family and court staff.
Worth being clear on one point, because the case is in a California state court and the defendant is a San Diego County medical group: the class definition is not limited by residency. Eligibility turns on whether your information was compromised in the incident, not on where you live. The notice does not say how many people are in the class.
How Much Can You Get?
The settlement creates a $3,100,000 Settlement Fund, and that one figure has to cover everything: all class member benefits, all settlement administration costs, and any attorneys' fees, costs and service awards the court awards. Class counsel will apply for fees of up to one-third of the fund plus reimbursement of costs, and for service awards of $2,500 for each of the five class representatives. The court may award less than requested. What is left after those deductions is the Net Settlement Fund the cash payments come out of.Every class member chooses one of two cash options:
- Cash Payment A — Documented Losses. Up to $5,000 for reasonable documented losses related to the incident, supported by documentation and a sworn attestation.
- Cash Payment B — Alternative Cash. A flat payment the notice estimates at $60, with no documentation required. The notice says the final amount is not determined until all Claim Forms have been received and evaluated.
The $60 is an estimate in both directions, which is unusual enough to be worth stating carefully. The notice says all cash payments are subject to a pro rata increase if valid claims do not exhaust the Net Settlement Fund, or a pro rata decrease if valid claims exceed it. Most settlements only warn about the downward adjustment; here an under-subscribed fund raises the payment instead of reverting. Either way, the figure a claimant eventually receives depends on how many people file and on what the court awards in fees and costs.
Cash Payment A is capped at $5,000 per class member and is limited to unreimbursed losses. The notice says expenses already reimbursed from another source do not qualify — and it names one source specifically: compensation provided in connection with the credit monitoring and identity theft protection product Palomar Health offered in its original breach notification letter. If that product already paid you back for something, you cannot claim the same expense here.
What About the Credit Monitoring?
Two years of single-bureau credit monitoring is available, and it comes with $1,000,000 in identity fraud insurance and dark web monitoring. The notice is explicit that it may be claimed alone or in addition to either cash payment — so unlike settlements where monitoring is offered instead of cash, taking it here costs you nothing and does not reduce or replace your Cash Payment A or Cash Payment B claim.It is still a claimed benefit rather than an automatic one. On the Claim Form it is its own checkbox, and the form warns that you must supply an email address in the contact section, because the activation code is emailed rather than mailed. That code goes out only after the court grants final approval and the settlement becomes effective, so nothing arrives immediately after filing.
What Proof or Notice ID Is Required?
Proof is required. The online claim portal opens with a login asking for the Notice ID and Confirmation Code from the personalized notice mailed to you, and the portal instructs claimants to enter the full Notice ID exactly as it appears on that notice. That is an administrator-issued credential a claimant can only get from the mailing, so under OCA's standard this is a Proof Required: Yes settlement even for the alternative cash payment, which otherwise asks for no documentation at all.The paper Claim Form is looser on this point: it asks for the "Notice ID, if known" alongside your name, address, email and telephone number, so the code is not strictly mandatory on that route. If you cannot find your Notice ID and Confirmation Code, the official settlement website's contact page is the route to ask for them or to request a paper Claim Form by mail.
Cash Payment A carries a separate and heavier requirement. It needs reasonable documentation, which the notice defines as documentation contemporaneously generated or prepared by a third party or by the class member supporting a claim for expenses paid — with telephone records, correspondence including emails, and receipts given as examples. The distinction to watch is that a personal certification, declaration or affidavit does not itself count as reasonable documentation; it may be submitted to add clarification, context or support for other documentation, but not in place of it. Claiming Cash Payment A also requires checking a box attesting under penalty of perjury that the losses occurred, were related to the incident, and have not been reimbursed.
Cash Payment B requires no documentation. Either way, the whole Claim Form is signed under penalty of perjury, the administrator decides whether a claim is complete and valid, and the notice warns that a claim may go unpaid if the administrator asks for additional information and does not receive it in a timely manner.
What Is the Deadline?
- File a Claim Form: online or postmarked by October 22, 2026
- Exclude yourself (opt out): postmarked by October 7, 2026
- Object to the settlement: submitted by October 7, 2026, with copies sent to the court, class counsel, the defendant's counsel and the administrator
- Final approval hearing: 10:30 a.m. on November 6, 2026, Courtroom SD-64, Hall of Justice, San Diego
The notice gives dates without an accompanying cutoff time for filing, so we publish only the dates. Note that the opt-out and objection deadline falls about two weeks before claims close, which means the decision about whether to stay in the class has to be made before the last day to file.
How Do You Take Action?
File through the official settlement website, PHMG Data Settlement.com. The online form starts with the Notice ID and Confirmation Code from your notice, then collects your contact details and asks you to select Cash Payment A or Cash Payment B, plus the credit monitoring checkbox if you want it. For documented losses you list each expense with its amount in a table, attach the supporting records, and check the perjury attestation. The form then asks how you want to be paid — PayPal, Venmo, Zelle, a virtual prepaid card or a mailed check — and ends with a signature.A printable Claim Form can be downloaded from the settlement website's Important Documents page for anyone who would rather file on paper, and the administrator will send one by mail on request through the site's contact page. Keep a copy of whatever you submit: the notice says supporting materials are not returned, so do not send your only copy of a document. If your contact information changes after you file, it is on you to tell the administrator.
Staying in the class means releasing your claims against Palomar Health and the other released parties over the issues this settlement resolves. Opting out is the only way to keep the right to sue, and it requires a personally signed letter mailed to the administrator and postmarked by October 7, 2026, giving your name, address, telephone number, email address if you have one, and a statement that you want out. The notice says exclusion requests must be made individually — mass or class opt-outs are not accepted — and that opting out forfeits every settlement benefit and the ability to object.
What Happens Next?
The next milestone is the November 6, 2026 final approval hearing, at which the court will hear argument on the motion for final approval and on the application for attorneys' fees, costs and service awards, and will consider any timely objections. Class members do not have to attend, and an objection filed on time is considered whether or not its author appears; a class member who wants to speak must follow the objection requirements in the notice first.A hearing being held is not the same as approval being granted. The notice says that even if the court approves the settlement there may be appeals, that resolving them can take additional time, and that processing all the Claim Forms takes time of its own depending on how many are filed. No payment date had been announced as of August 30, 2026.
Sources and Verification
- Castro et al. v. Arch Health Partners, Inc. — Official Settlement Website
- Official Settlement FAQs — benefits, deadlines, opt-out and objection requirements
- Official Important Documents Page — settlement agreement, notice, complaint and paper Claim Form
- Official Claim Portal — Notice ID and Confirmation Code login
- Court-Authorized Notice of Proposed Class Action Settlement and Claim Form (PDF)
Questions
Who qualifies for the Palomar Health data breach settlement?
The Settlement Class is all individuals whose Private Information was accessed, acquired, disclosed or compromised in the Data Incident — the cybersecurity incident on Palomar Health Medical Group's computer systems between April 23, 2024 and May 5, 2024. Class members were sent notice by mail, and the notice says that if you received it you are eligible to file. Excluded are the defendant's directors, officers and agents along with those of its subsidiaries and affiliated companies, governmental entities, and the assigned judge together with that judge's immediate family and court staff. The class is not limited by where you live.
How much does the Palomar Health settlement pay?
You choose one of two cash options. Cash Payment A reimburses up to $5,000 for reasonable documented losses related to the incident. Cash Payment B is an alternative cash payment the notice estimates at $60 and that requires no documentation. Both come out of a $3,100,000 Settlement Fund, and the notice says the final amount of the alternative payment is not set until every Claim Form has been received and evaluated.
Can I get the credit monitoring and a cash payment?
Yes. The notice is explicit that the two years of credit monitoring may be claimed alone or in addition to either cash payment, so it does not use up your cash option the way an either-or benefit would. It is a separate checkbox on the Claim Form. The service is single-bureau monitoring with $1,000,000 in identity fraud insurance and dark web monitoring, and the activation code is emailed only after the court grants final approval and the settlement becomes effective — so an email address on the Claim Form is required to receive it.
Do I need proof to file a Palomar Health claim?
Yes. The online claim portal opens with a login that asks for the Notice ID and Confirmation Code from the personalized notice mailed to you, so an administrator-issued credential gates the online route even for the no-documentation alternative payment. The paper Claim Form treats the Notice ID as optional. The up-to-$5,000 tier separately requires reasonable documentation such as receipts, telephone records or correspondence, and a sworn attestation.
What is the deadline for the Palomar Health data breach settlement?
Claim Forms must be submitted online or postmarked no later than October 22, 2026. The separate deadline to opt out of the settlement or to object to it is October 7, 2026 — two weeks earlier, so the decision to stay in the class has to be made before the claim window closes.
Could the $60 alternative payment change?
Yes, in either direction. The notice calls $60 an estimate and says all cash payments are subject to a pro rata increase if valid claims do not exhaust the Net Settlement Fund, or a pro rata decrease if valid claims exceed it. The Net Settlement Fund is what remains of the $3,100,000 after settlement administration costs and any attorneys' fees, costs and service awards the court awards, so how many people file and what the court awards both move the final figure.
Is PHMGDataSettlement.com legit?
Yes. PHMGDataSettlement.com is the court-authorized settlement website for Castro et al. v. Arch Health Partners, Inc. d/b/a Palomar Health Medical Group, Case No. 37-2024-00024339-CU-NP-CTL, in the Superior Court of California, County of San Diego, and it is administered by Angeion Group. Palomar Health denies all claims and all charges of wrongdoing or liability, and the court has not decided who is right. File only through the official settlement website.
When will Palomar Health settlement payments be sent?
Payments go out only if the court grants final approval and after any appeals are resolved, and the notice says processing all the Claim Forms takes additional time on top of that. The final approval hearing is scheduled for 10:30 a.m. on November 6, 2026 in San Diego. No payment date had been announced as of August 30, 2026. Claimants choose PayPal, Venmo, Zelle, a virtual prepaid card or a mailed check on the Claim Form.
Watch Out for Scams
A court-appointed administrator never charges a fee to release a class action payment and will not ask for banking passwords or a "processing payment" by text or phone. Use only the official settlement website linked on this page. Medical groups and clinics keep producing settlements on similar terms — the DAP Health settlement and the Summit Medical Group settlement are two open examples. For a wider view, see our roundup of open data breach settlements and our explainer on how a data breach class action works.Official Settlement Notice
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
