CorrectCare Settles Data Breach Lawsuit for $6.49M

CorrectCare Settles Data Breach Lawsuit for $6.49M

Introduction

A class action lawsuit against CorrectCare Integrated Health LLC (CorrectCare) over a 2022 data breach affecting approximately 600,000 individuals has been settled for $6.49 million.

The Kentucky-based third-party administrator, which manages access to medical care and payment of claims for inmates at correctional facilities, identified a web server misconfiguration in July 2022 that exposed sensitive data online. This data, available from January 22 to July 7, 2022, included names, dates of birth, inmate numbers, diagnosis codes, treatment dates, and in some cases, Social Security numbers, for individuals treated between 2012 and 2022.

A class action lawsuit was filed in December 2022 in the U.S. District Court for the Eastern District of Kentucky, with an amended complaint submitted in March 2024. Despite CorrectCare's attempt to dismiss the case, a settlement agreement was reached and received preliminary approval in April 2024. The final approval for the $6.49 million settlement was granted on September 17, 2024, after more than 100,000 claims were filed, representing about 17% of the affected class.

Some individuals missed the deadline for filing claims, but class counsel granted an extension for late filers. According to the plaintiffs' legal team, many of the affected individuals would not have pursued legal action individually, but the class action allowed them to receive compensation.

One-third of the settlement will cover legal fees, with $12,313 allocated to litigation costs, and the five named plaintiffs will receive service awards of $2,500 each.