Community Dental Care, a nonprofit Medicaid dental provider in Minnesota, has agreed to settle class action litigation over a cyberattack and data breach that exposed patients' personal and protected health information. The intrusion occurred on or around 20 December 2024, when a cybercriminal actor accessed the provider's network and potentially exfiltrated the data of more than 130,000 individuals — names, health insurance information, dates of birth, medical information and Social Security numbers, the last affecting approximately 7,100 people. Notification letters began to be mailed on 28 March 2025, and a class action was filed in Ramsey County District Court days later; four further complaints were consolidated into a single action alleging the breach resulted from negligence and a failure to implement reasonable cybersecurity measures. The provider denied all claims and moved to dismiss; the court granted that motion in part and denied it in part, allowing the negligence, negligence per se and breach of implied contract claims to proceed. After mediation and before discovery, the parties agreed terms that let class members claim documented, unreimbursed losses of up to US$5,000, or a one-time cash payment of $50, alongside injunctive commitments to be detailed in the final agreement.

• Source article