Southern California community health network DAP Health has agreed to pay $1.3M to end a class action over a July 2024 email server intrusion that exposed records tied to 129,048 individuals.
The attacker accessed an email server around July 22, 2024 and exfiltrated emails and files carrying personally identifiable information and protected health information. Stolen data included names, Social Security numbers, driver’s license and passport numbers, financial account numbers, Medicare and Medicaid identifiers, and medical information, according to the settlement notice.
Two class actions filed in January and February 2025 were consolidated, and an amended complaint was lodged in Riverside County Superior Court in June 2025. The plaintiffs alleged negligence, breach of implied contract, unjust enrichment, and violations of California privacy and consumer protection laws. DAP Health denies all material allegations.
Under the deal, DAP Health will fund a $1.3M settlement pool covering attorneys’ fees, administration costs, and service awards. Class members can claim documented out-of-pocket losses up to $5,000, a pro rata cash payment estimated at $25, and an extra $75 statutory payment for California residents. Everyone covered also receives two years of credit monitoring and identity theft protection. The exclusion and objection deadline is September 1, 2026.
The breach was reported to the HHS Office for Civil Rights in December 2024, when notification letters went out. The case shows email server compromises can produce million-dollar payouts years after the initial incident, and class members should watch for claim forms in the mail.
