Dialysis patients caught up in a February 2024 intrusion at Innovative Renal Care have a proposed $900,000 class settlement, filed in the U.S. District Court for the Middle District of Tennessee as In re American Renal Management LLC Data Breach Litigation.
The intrusion surfaced February 29, 2024, three days after the extortion group entered. Investigators traced access from February 21 to March 1, 2024, and found that files had been copied out. The haul spanned identifiers, driver’s license numbers, financial accounts, insurance and claims detail, and clinical records. American Renal Management operates more than 200 kidney care locations across 28 states under the Innovative Renal Care name.
Notification is the sharper failure. Letters did not reach patients until February 14, 2025, roughly eleven months after the intrusion was identified. The federal filing still carries a placeholder figure of 501 individuals because the operator never updated it; the lawsuit puts the notified population at 59,400 living people.
Five named plaintiffs argued the company ran inadequate safeguards and then delayed disclosure, costing patients the chance to freeze credit early. Claims covered negligence, implied contract, unjust enrichment and California consumer statutes.
Innovative Renal Care denies liability. Class members can document losses up to $5,000 or take a pro rata payment estimated near $100. Opt-out and objection deadlines land November 20, 2026, claims close December 21, and the fairness hearing is set for February 1, 2027.
For compliance officers, the timeline is the lesson. A placeholder count left unrevised for two years is a discovery problem, not a paperwork one.
