Dental Care Alliance, LLC (DCA) agreed to settle a class action lawsuit that arose out of a 2020 cyberattack. A hearing to approve the $3 million settlement was held on September 1.

DCA, based in Sarasota, Fla., is a dental services organization that provides practice support to over 390 affiliated dental practices across the U.S. Hackers penetrated its network in September 2020 and gained access to over 200,000 patients’ information, including names, addresses, dental diagnoses and treatment information, health insurance information, bank account numbers, and Social Security numbers.

The lawsuit alleged that the breach was a direct result of DCA’s failure to implement reasonable cybersecurity procedures and protocols necessary to protect consumers’ protected health information. The complaint also alleged that DCA’s delay in identifying and reporting the breach caused additional harm, as early notification can help limit a victim’s liability.

Under the settlement, class members are entitled to $2,000 for out-of-pocket losses, including unreimbursed losses relating to fraud or identity theft; costs associated with freezing or unfreezing credit with any credit reporting agency; and professional fees, including attorneys’ fees, accountants’ fees, and fees for credit repair services. Individual class members whose Social Security, financial account, bank account, and/or driver’s license numbers may have been accessed are entitled to up to $5,000 for any losses. DCA did not admit to any wrongdoing as part of the settlement.