DC Health Link Data Breach: $1.45M Settlement Announced – Are You Eligible?

The District of Columbia Health Benefit Exchange Authority (HBX), which provides affordable health insurance plans to Washington DC residents and small businesses, has agreed to a $1.45 million settlement to settle a class action lawsuit filed over a data breach in 2023. The data leak was a major cyber attack affecting DC Health Link customers, in which sensitive information of thousands of people was leaked online.

How many people were affected?

In March 2023, HBX confirmed that personal information of 56,415 customers was accessed by an unauthorized person and shared publicly. However, it is estimated that up to 170,000 people may have been affected by this leak, including residents of the Washington, DC area, members of the US Congress and their families.

The leaked information included the following:

  • ✔ Name
  • ✔ Social Security Number
  • ✔ Date of Birth
  • ✔ Gender
  • ✔ Health Plan Information
  • ✔ Employer Information
  • ✔ Enrollee Information

Why was the lawsuit filed?

Victims of the data leak filed a lawsuit against HBX, alleging that the company failed to implement strong cybersecurity measures. Had HBX adopted proper security protocols, the data breach could have been prevented. The case was later combined into a single lawsuit called Lawless, et al. v. District of Columbia Health Benefit Exchange Authority d/b/a DC Health Link.

Why did the company settle?

HBX decided to settle without admitting any wrongdoing to avoid the risk and uncertainty of pursuing a lawsuit. The settlement will compensate members of the class action group, which is divided into two parts:

  • Group 1 – people whose information was stolen and published online.
  • Group 2 – people whose information was exposed in a data breach but was not shared online.

How will compensation and benefits be received?

✔ Group 1 members:

  • They can claim up to $10,000 if they have suffered financial damages such as identity theft, fraud, or incorrect tax returns.

✔ Group 1 and Group 2 members:

  • Can claim up to $2,500 if they have had to spend on bank fees or credit monitoring services.
  • Can also get 12 months of free credit monitoring and identity restoration services.
  • If a member does not want to make a claim, he can opt for a cash payment, which will be given after deducting lawyers’ fees and other expenses from the total settlement amount.
  • The cash amount received by Group 1 will be three times more than that of Group 2.

Important Dates

  • 📌 Last date to file objection and exit the settlement: 22 February 2025
  • 📌 Date of final hearing: 21 February 2025
  • 📌 Last date to submit claim: 28 March 2025

Those who do not file a claim will automatically be considered included in the settlement but will not get any benefits.

Conclusion

This case of DC Health Link data breach is a significant example of how cybersecurity vulnerabilities can put sensitive information of millions of people at risk. If you are eligible for this settlement, make sure to file a claim in time so that you can get proper compensation.

FAQs

Q. Who is eligible for the settlement?

A. Anyone affected by the DC Health Link data breach, including individuals whose data was stolen and published online (Group 1) and those whose data was exposed but not published (Group 2).

Q. How much compensation can I receive?

A. Group 1 members can claim up to $10,000 for documented financial losses, while both Group 1 and Group 2 can claim up to $2,500 for ordinary losses like bank fees and credit monitoring costs.

Q. Do I need to submit a claim to receive compensation?

A. Yes, eligible individuals must submit a claim by March 28, 2025, to receive any financial benefits. Those who do not file a claim will not receive compensation.

Q. What other benefits are included in the settlement?

A. Both Group 1 and Group 2 members can receive 12 months of free credit monitoring and identity restoration services.

Q. What is the deadline to object or opt out of the settlement?

A. The deadline to object to or exclude yourself from the settlement is February 22, 2025.

Leave a Comment