Healthcare Services Group Reaches $3 Million Settlement Over 2024 Data Breach

If your sensitive personal or health information was exposed in a major cybersecurity incident at Healthcare Services Group, you may be eligible to claim up to $5,000 in cash reimbursement along with three years of free credit monitoring.

Healthcare Services Group, Inc. (HSG), a Pennsylvania-based provider of dining, environmental, and nutritional support services to healthcare and long-term care facilities nationwide, has agreed to establish a $3 million settlement fund. The agreement resolves class action litigation alleging the company failed to maintain adequate cybersecurity measures to protect the sensitive personal and protected health information (PHI) of over 624,000 individuals.

While Healthcare Services Group denies all allegations and maintains it did nothing wrong, the settlement allows affected consumers to recover documented out-of-pocket financial losses and receive cash payouts without enduring a prolonged court battle.

What Happened During the Healthcare Services Group Cyberattack?

The security incident began in late September 2024, when an unauthorized third party breached Healthcare Services Group’s internal network. According to forensic investigations, the intruder maintained undetected access to company systems between September 27, 2024, and October 3, 2024.

Suspicious network activity was first detected around October 7, 2024, prompting HSG to launch an emergency incident response. However, before IT systems could be fully secured, the attackers exfiltrated files containing extensive personal, financial, and medical information.

Following an in-depth review of the stolen data, the company determined that the breach impacted precisely 624,496 individuals. Formal notification letters were subsequently mailed to affected patients and employees.

What Types of Personal and Medical Information Were Compromised?

Data breaches in the healthcare sector are particularly dangerous because stolen records often contain permanently identifying details that cybercriminals can use for identity theft, financial fraud, or medical fraud.

According to case filings, the stolen files contained a combination of highly sensitive data elements, including:

• Full Names and Contact Information

• Social Security Numbers

• Driver’s License and State Identification Numbers

• Financial Account Details and Access Credentials

• Medical Information and Health Insurance Records

When compromised, these categories of data expose everyday people to significant risks, ranging from fraudulent credit applications to unauthorized medical billing in their names.

What Settlement Benefits and Cash Reimbursements Are Available?

The $3,000,000 settlement fund will cover administrative expenses, court-approved attorney fees, and service awards for class representatives. The remaining net fund will be distributed directly to eligible class members who submit valid claims before the court deadline.

Under the terms of the agreement, class members can claim multiple types of relief:

• Reimbursement for Documented Out-of-Pocket Losses: You can submit a claim for up to $5,000 if you incurred unreimbursed financial losses directly traceable to the breach, such as credit monitoring fees, fraudulent charges, or professional fees incurred to resolve identity theft.

• Free Credit Monitoring Services: All class members are entitled to claim three years of single-bureau credit monitoring services, which include identity restoration assistance and up to $1 million in identity theft insurance.

• Pro Rata Cash Payout: Class members may also elect to receive a one-time pro rata cash payment. The final monetary value of these cash payments will depend entirely on the total number of valid claims filed, as remaining funds will be distributed to exhaust the settlement pool.

Understanding Your Rights Under Federal Health Privacy Laws

This litigation underscores the crucial obligation healthcare providers and their vendor partners have under federal law. The Health Insurance Portability and Accountability Act (HIPAA) requires covered entities and their business associates to maintain administrative, physical, and technical safeguards to preserve the confidentiality and integrity of protected health information.

When an organization fails to implement sufficient network encryption, access controls, or employee security training, cybercriminals can exploit those vulnerabilities. Class action lawsuits serve as a essential mechanism for everyday people to enforce standards, hold corporations accountable when data safeguards fall short, and secure compensation for resulting risks.

Who Is Eligible to Receive Settlement Benefits?

You may be eligible to participate in the settlement if you received a formal notice or if your personal information or protected health information was stored on Healthcare Services Group’s network systems and compromised during the September–October 2024 cyberattack.

To verify whether your records were involved:

• Check your mail for an official court-approved class notice containing a unique Claim ID.

• Review prior notification letters sent by Healthcare Services Group regarding the 2024 incident.

• Contact the official settlement administrator once the official claims portal opens to verify your inclusion on the class roster.

Crucial Dates and Deadlines for Filing Your Claim

If you wish to participate in the settlement, submit a claim, or opt out of the agreement, you must adhere to strict court-mandated deadlines:

• September 4, 2026 – Exclusion and Objection Deadline: If you want to exclude yourself from the settlement to retain your right to sue Healthcare Services Group individually, or if you want to object to the terms of the deal, your request must be submitted by this date.

• September 24, 2026 – Final Fairness Hearing: The court will hold a hearing to review the proposed settlement, evaluate any objections, and decide whether to grant final legal approval.

• October 1, 2026 – Claim Submission Deadline: All claims for credit monitoring, out-of-pocket loss reimbursements up to $5,000, or cash payouts must be submitted online or postmarked by this date.

Payments will be distributed to approved claimants approximately 75 days after the court grants final approval or within 21 days of claim verification, whichever is later.