DATS Proposes $549,000 Settlement After Cyberattack Put Patient Records at Risk
An unauthorized actor reached the treatment provider’s network while Social Security numbers, medication details, diagnoses and other patient information were present. A signed settlement would compensate a class of roughly 22,000 people, but every payment would come from one fund that also covers fees and administration.
What the agreement says
- DATS detected unauthorized access to its computer network between October 5 and October 6, 2024.
- The affected environment contained patient identity, insurance, medication, diagnosis, treatment and billing information. The categories varied by person.
- A signed settlement agreement proposes a $549,000 fund for a class estimated at approximately 22,000 people.
- Members could claim up to $5,000 for documented losses or choose an alternate pro rata payment. They could also request one year of medical identity theft monitoring.
- The same fund would pay administration, taxes, court-approved legal fees and other approved awards before class benefits are fully distributed.
- DATS denies wrongdoing and liability. The settlement does not establish that the company was negligent or that affected information was misused.
For scale only, $549,000 divided by an estimated 22,000 class members is about $25 per person before any deductions. This is not an estimated payout and the fund will not be divided equally among every class member.
The breached environment held more than account data
Names and Social Security numbers were present in the same network environment as medication, diagnosis and treatment information. According to the settlement agreement, DATS detected a cyberattack during which an unauthorized actor accessed its network over October 5 and 6, 2024.
DATS later reviewed the potentially affected data and determined that protected health information belonging to patients was present. The precise mix differed by individual, a limitation that matters when describing the scope. The agreement does not say every listed field was involved for every person.
Identity information
- Names and addresses
- Dates of birth
- Social Security numbers
- Patient account numbers
Clinical information
- Medication information
- Diagnosis information
- Treatment information
- Doctors’ names
Insurance and billing
- Health insurance information
- Medical claims information
- Medical billing information
For patients of a drug and alcohol treatment provider, the privacy stakes are unusually personal. The exposed categories can identify not only a person, but details about care. The supplied record establishes that this information was present in the affected system. It does not establish that every category was copied, published, sold or used for fraud.
A website notice came first, individual letters months later
While its review was underway, DATS posted notice of the incident on its website on December 5, 2024. The agreement says written notices went to potentially affected individuals on or around May 2, 2025, almost seven months after the network access.
The lawsuits accused DATS of negligence, breach of contract, breach of fiduciary duty, breach of confidence and other claims. A draft proposed order summarizes the plaintiffs’ alleged harms as risk of fraud and identity theft, mitigation expenses and lost time, invasion of privacy and emotional distress.
Those are allegations, not court findings. The supplied agreement does not document how many people experienced fraudulent transactions, medical identity theft or another concrete misuse of their information.
Established by the agreement: unauthorized network access occurred, protected health information was present in the affected environment, DATS notified potentially affected people, litigation followed and the parties negotiated a proposed settlement.
Not established by the supplied record: that DATS was legally negligent, that every listed data field was accessed for every class member, or that the incident caused identity theft or a specific financial loss for every affected person.
The headline fund is not the amount patients split
The $549,000 is an all-in fund. Under the agreement, it would finance settlement administration, taxes, court-approved attorneys’ fees and costs, service awards, medical monitoring and cash claims.
Class counsel may ask the court for attorneys’ fees of up to one-third of the fund, or $183,000, plus reasonable litigation expenses. If the court awarded the full fee request, $366,000 would remain before expenses, administration, taxes, service awards and class benefits.
The settlement is described as non-reversionary once it becomes effective. That means the remaining fund generally would not return to DATS after final approval. The agreement instead calls for additional distributions when practical and eventual transfer of a small residual to a court-approved nonprofit recipient.
Three benefits, with one important tradeoff
Class members would have to submit a valid claim to receive money or monitoring. They could choose either documented losses or the alternate cash payment, not both. Medical monitoring could be requested in addition to either cash option.
| Benefit | What a claimant must show | What remains uncertain |
|---|---|---|
| Documented losses | Up to $5,000 for unreimbursed losses more likely than not traceable to the breach, supported by reasonable documentation. | Claims can be reduced pro rata if approved losses exceed the net fund. |
| Alternate cash | No documented financial loss is required, but a valid claim must be filed. | No fixed amount is promised. Payment depends on remaining money and the number of valid claims. |
| Medical monitoring | A claimant may request one year of medical identity theft protection through CyEx Medical Shield. | The agreement does not state the per-person cost paid from the fund. |
Examples of potentially reimbursable costs in the draft claim form include bank fees, postage, certain phone or data charges, local travel and identity protection products. Supporting records are required. A self-prepared statement can add context but generally is not enough by itself.
The agreement also contains a consequential rule for people who do nothing. If the court approves the settlement, a class member who neither opts out nor files a valid claim would release covered claims without receiving a benefit.
DATS denies wrongdoing, while promising five years of security measures
DATS denies the plaintiffs’ claims, disclaims fault and says the agreement is not an admission of liability. The company entered the settlement to avoid further litigation costs, burden and disruption, according to the document.
The agreement also requires DATS to adopt, maintain or implement measures designed to strengthen data and information security for five years. It may replace a measure with an equivalent or stronger control as technology and assessed risks change.
DATS must give class counsel a confidential declaration describing and confirming the security enhancements. The agreement does not publicly identify the specific controls, their deadlines or independent testing requirements. Readers therefore cannot evaluate the promised improvements from this document alone.
The next numbers will decide what the settlement means
The signed agreement is not the final word. The court must approve it, an official notice must supply the missing dates and claim information, and the administrator must determine how many claims qualify.
What affected patients should watch
- Court approval: The supplied proposed order is unsigned and does not establish that preliminary or final approval has occurred.
- Official deadlines: The draft materials leave the claim, opt-out, objection and hearing dates blank.
- Fee and expense awards: Every approved deduction changes the amount available for class benefits.
- Claim participation: The number and type of valid claims will determine whether documented losses are reduced and how large alternate payments become.
- Security implementation: The promised measures last five years, but the confirming declaration goes confidentially to class counsel.
A settlement framework, not a known recovery
The breach involved categories of information that can expose both identity and intimate medical history. Yet the financial response is a single $549,000 pool shared across compensation, monitoring, lawyers, administration and other costs for a class estimated at roughly 22,000 people.
Until the court rules, fees are set and claims are counted, the proposal cannot answer how much an affected patient will actually receive. It does show where the burden now falls: patients must recognize an official notice, document losses when seeking reimbursement and act before deadlines that the supplied drafts have not yet filled in.
Explore by category
Antitrust
Monopolies and anti-competition tactics used to crush rivals.
View Cases →Product Safety Violations
When companies sell dangerous goods, consumers pay the price.
View Cases →Environmental Violations
Pollution, ecological collapse, and unchecked greed.
View Cases →Labor Exploitation
Wage theft, worker abuse, and unsafe conditions.
View Cases →Data Breaches & Privacy
Misuse and mishandling of personal information.
View Cases →Financial Fraud & Corruption
Lies, scams, and executive impunity that distort markets.
View Cases →Intellectual Property
IP theft that punishes originality and rewards copying.
View Cases →Misleading Marketing
False claims that waste money and bury critical safety info.
View Cases →
