$1.45M District of Columbia Health Benefit Exchange Authority data breach class action settlement

The District of Columbia Health Benefit Exchange Authority agreed to a $1.45 million class action lawsuit settlement to resolve claims it failed to prevent a 2023 data breach.

The District of Columbia Health Benefit Exchange Authority settlement benefits individuals who received a notification letter from the agency informing them their private information was or may have been compromised in a data breach around March 2023.

The settlement class is split into two groups based on how individuals’ information was compromised. Group 1 class members include those whose information is known to have been compromised during the data breach. Group 2 class members include those whose information is not known to have been compromised but was potentially accessed during the data breach.

The data breach reportedly compromised the personal information, including Social Security numbers and contact information, of 170,000 individuals. The data breach class action lawsuit claims the District of Columbia Health Benefit Exchange Authority failed to implement reasonable cybersecurity measures that could have prevented the breach.

The District of Columbia Health Benefit Exchange Authority is an agency that operates health programs such as DC Health Link, the District of Columbia’s health insurance marketplace.

The District of Columbia Health Benefit Exchange Authority hasn’t admitted any wrongdoing but agreed to the $1.45 million settlement to resolve the data breach class action lawsuit.

Under the terms of the District of Columbia Health Benefit Exchange Authority settlement, class members can receive a cash payment or alternative cash payment based on their group.

Group 1 class members can receive up to $10,000 for extraordinary losses, such as identity theft, fraud, false tax returns and other misuse of personal information. Under the $10,000 reimbursement cap, Group 1 class members can also claim ordinary losses, such as credit monitoring costs, bank fees, communication charges and travel expenses.

Group 1 and Group 2 class members can receive up to $2,500 in ordinary losses. This reimbursement covers only documented ordinary losses, such as credit monitoring costs, bank fees, communication charges and travel expenses.

In lieu of receiving documented losses, class members can choose to receive an alternative cash payment. Group 1 alternative cash payments will be three times larger than Group 2 payments.

All class members are eligible for one year of free credit monitoring and identity restoration services. This includes three-bureau credit monitoring and $1 million in identity theft insurance.

The deadline for exclusion and objection is Feb. 22, 2025.

The final approval hearing for the DC Health Link data breach settlement is scheduled for Feb. 21, 2025.

To receive settlement benefits, class members must submit a valid claim form by March 28, 2025.

Who’s Eligible

Individuals who received a notification letter from the District of Columbia Health Benefit Exchange Authority d/b/a DC Health Link stating their private information was or may have been compromised in a March 2023 data breach

Potential Award

Up to $10,000

Proof of Purchase

Account statements, receipts, invoices, bills, tax documents, financial documents, legal letters, tax returns and more

Claim Form

NOTE: If you do not qualify for this settlement do NOT file a claim.

Remember: you are submitting your claim under penalty of perjury. You are also harming other eligible Class Members by submitting a fraudulent claim. If you’re unsure if you qualify, please read the FAQ section of the Settlement Administrator’s website to ensure you meet all standards (Top Class Actions is not a Settlement Administrator). If you don’t qualify for this settlement, check out our database of other open class action settlements you may be eligible for.

Claim Form Deadline

03/28/2025

Case Name

Lawless, et al. v. District of Columbia Health Benefit Exchange Authority d/b/a DC Health Link, Case No. 2023-CAB-001569, in the U.S. District Court for the District of Columbia

Final Hearing

02/21/2025

Settlement Website

DCHBXSettlement.com

Claims Administrator

DCHBX Data Incident Settlement Administrator
c/o Epiq
P.O. Box 4710
Portland, OR 97208-4710
[email protected]
888-897-4085

Class Counsel

Gary E Mason
MASON LLP

Joseph M Lyon
THE LYON FIRM

Defense Counsel

Judith A Archer
NORTON ROSE FULBRIGHT US LLP