Inside American Vision’s $1.75M Data-Breach Deal

The Facts

The lawsuit followed a cyberattack that American Vision discovered on or about November 14, 2023. According to the settlement notice, an unauthorized third party gained access to the defendants’ computer network and information associated with approximately 1.6 million individuals.

The defendants are Medical Management Resource Group, LLC, doing business as American Vision Partners; Barnet Dulaney Perkins Eye Center, PC; and Southwestern Eye Center, Ltd. The case is being overseen by Judge Diane J. Humetewa in the United States District Court for the District of Arizona.

The plaintiffs allege that cybercriminals may have accessed names, dates of birth, Social Security numbers, contact information, medical-treatment information and health-insurance information. The latter medical and insurance records are forms of protected health information under the Health Insurance Portability and Accountability Act, commonly called HIPAA.

The notice does not establish that every listed data category was exposed for every affected person. It also does not report a judicial finding about what security failure permitted access, whether the defendants could have prevented it, or whether the compromised information was subsequently misused.

One Incident, Two Very Different Classes

The headline number—approximately 1.6 million people—does not describe the group eligible to submit claims for money. The proposed settlement creates two classes with different rights.

The damages class

Approximately 258,070 U.S. residents whose Social Security numbers and other personal information were compromised belong to the damages settlement class. Subject to the exclusions stated in the notice, these are the people who may submit claims for cash benefits.

The injunctive-relief class

The second class includes all individuals whose personal information is collected or maintained by the defendants. “Injunctive relief” means a required change in conduct rather than a payment to each class member. Here, it refers to the defendants’ promised cybersecurity practices.

The proposed deal’s broadest class receives the benefit of promised security changes. Its much smaller damages class is the group eligible to ask for money.

This distinction matters because inclusion in the wider injunctive-relief class does not, by itself, make someone eligible for a cash claim. Anyone uncertain about inclusion is directed by the notice to the settlement administrator at AmericanVisionSettlement.com or (833) 630-5366.

What the $1.75 Million Fund Actually Offers

A damages-class member who submits a valid claim on time must choose between two forms of relief. The first is a pro-rata cash payment. In practical terms, the available money will be divided among qualifying claims, so the amount may rise or fall depending on the claims and the fund’s limit. The notice does not promise a specific payment.

The second option is reimbursement for documented out-of-pocket losses reasonably and fairly traceable to the incident, up to $3,000 per claimant. The notice identifies potentially eligible expenses including unreimbursed fraud or identity-theft losses, professional fees, credit-repair services, credit freezes, qualifying credit monitoring and certain communication, postage, copying, mileage and notary expenses.

Claimants seeking reimbursement must provide supporting records and attest that the losses came from the data incident rather than another cause. A self-prepared record, such as a handwritten receipt, is not enough by itself, although the administrator may consider it alongside other documentation.

The Cybersecurity Commitments Are Worth More on Paper Than the Cash Fund

The notice values the proposed cybersecurity measures at approximately $2,787,630—more than the $1.75 million damages fund. It says the defendants will bear those costs separately from the fund.

The listed commitments include creating and maintaining a chief information officer role; retaining a dedicated information-security training specialist; and operating a steering committee that includes the company’s security officer, chief information officer, chief executive officer, general counsel and other senior managers.

The proposal also calls for company-wide cybersecurity training, monthly vulnerability scans and periodic penetration testing by an independent vendor. Penetration testing is a controlled effort to find weaknesses by testing how systems withstand attempted intrusion. The notice says identified risks would be classified using the Common Vulnerability Scoring System, a framework for rating their severity.

Other commitments cover tighter classification and access controls for electronic health information, outside management of security-monitoring operations and the corporate firewall, improved email security and disaster recovery, regular risk assessments by external vendors, and updated incident-response policies.

These are described as contractually enforceable obligations if the settlement becomes final. There is, however, a significant detail missing from the notice: it says the measures will remain in place for a minimum period “to be addressed in a long-form settlement agreement,” but it does not provide the duration for each commitment.

The Deadlines—and the Cost of Doing Nothing

The legal choices are not interchangeable. Filing a claim seeks a benefit. Objecting asks the court not to approve some or all of the deal as presented. Opting out rejects the settlement and preserves the right to pursue a separate case over the incident, while giving up settlement benefits.

A final fairness hearing is the proceeding at which the judge decides whether a class settlement is fair, reasonable and adequate. It is not a trial over whether the defendants caused the alleged harm. Approval would make the settlement binding, subject to any appeals.

If the settlement receives final approval, a class member who neither claims nor opts out receives no damages-class benefit but remains bound by the release. That release covers claims that were or could have been brought against the defendants and related entities over the data incident. The precise legal scope appears in Section 7 of the settlement agreement, according to the notice.

What the Court Has—and Has Not—Decided

The court authorized distribution of the notice so potentially affected people could learn about the deal and their options. That authorization is not a ruling that the plaintiffs proved their allegations, and it is not final approval of the settlement.

The defendants deny wrongdoing. The plaintiffs and class counsel support the proposal because, according to the notice, it avoids the expense and risk of trial and appeals while providing benefits. The court has not chosen either side on the underlying claims.

Benefits will be distributed only after the court approves the settlement and the time for appeals has expired. If appeals are filed, distribution must wait until they are resolved. The notice does not provide a payment date.

What a Legitimate Fix Looks Like

The source document is a settlement notice, not a forensic security report. It does not explain the attack’s technical cause, identify a previously ignored warning, or establish that any defendant violated a legal duty. That limits what can responsibly be said about whether the proposed remedies address the original weakness.

The listed measures nevertheless provide a framework against which the final agreement and implementation can be judged.

What Remains Unresolved

The proposed settlement supplies a structure for compensation and future security practices, but it does not resolve the incident’s full factual record. The notice does not identify the technical route of entry, establish which safeguards existed before November 2023, determine whether particular stolen records were misused, or quantify losses across the affected population.

It also leaves the value of an ordinary cash claim unknown. That figure depends on valid claims, available funds and court-approved deductions. The enforceable duration of the cybersecurity commitments is another material detail not provided in the notice itself.

The next decisive public event is the December 10, 2026 fairness hearing—unless its date or time changes. Until the judge rules and any appeals are resolved, this remains a proposal: consequential enough to require action, but not yet final.