US post-acute provider Etairos Health has agreed to settle class-action litigation stemming from a 20 February 2024 ransomware attack and data breach that exposed the personal information of current and former employees, including names, phone numbers, addresses, government-issued IDs and Social Security numbers. A class action — Isabel Garcia Bueno v. Etairos Health, Inc. — was filed in May 2024 in Pinellas County, Florida, asserting negligence and breach of implied contract and alleging Etairos should have prevented the breach with appropriate security measures. Under the negotiated settlement, Etairos denies liability but will pay up to US$146,500 in attorneys' fees, a US$3,500 service award, and class-member benefits — up to US$4,500 as reimbursement for documented unreimbursed losses (including up to eight hours of lost time at $15/hour), or a one-time US$75 cash payment for those not claiming reimbursement. The exclusion/objection deadline is 20 November 2026, the claim deadline 21 December 2026, and the final approval hearing is set for 20 January 2027. The case is a concrete legal-consequence datapoint for ransomware-breach class litigation.

• Source article