Managed Care of North America (MCNA), Inc., MCNA Insurance Company, also known as MCNA Dental, and Healthplex, Inc., agreed to a settlement of a consolidated class action litigation following a 2023 data breach that impacted 8,923,662 individuals.
MCNA Dental discovered a security breach of its network on March 2023. The attackers first gained access to the network on February 22, 2023, and maintained access until March 7, 2023, when ransomware was deployed to encrypt files. Before the encryption event, the attackers exfiltrated sensitive information from the network, including personal information and protected health information (PHI) covered by HIPAA laws.
The breached data included names, contact information, Social Security numbers, driver’s license numbers, government-issued ID numbers, health data, and medical insurance data. Non-payment of the ransom demand resulted in the exposure of the stolen information by the ransomware group.
MCNA Dental provides government-sponsored dental benefits to children through state Medicaid and Children’s Health Insurance Programs and maintains PHI for a substantial number of individuals. The attackers potentially accessed or exfiltrated the PHI of 8,923,662 individuals. Notification letters were sent to affected individuals in late May 2023 .
The data breach resulted in multiple class action lawsuits. The first lawsuit was filed on June 5, 2023. MCNA Dental faced a total of 25 putative class action lawsuits. Because the lawsuits contained materially similar allegations and overlapping claims, they were consolidated on July 13, 2023, into a single action titled Crowe et al. v. Managed Care of North America Inc. d/b/a MCNA Dental, MCNA Insurance Company dba MCNA Dental, and Healthplex, Inc. in the United States District Court for the Southern District of Florida.
The consolidated complaint asserted claims for breach of implied contract, negligence, negligence per se, unjust enrichment, violations of state consumer protection statutes, and seeks declaratory and injunctive relief.
Court-appointed mediation did not initially produce a settlement agreement. The defendants sought dismissal of the litigation, but the case continued. Discovery proceedings and additional litigation followed, together with another unsuccessful mediation attempt.
Eventually, the defendants agreed to a settlement without admitting liability or wrongdoing. Under the agreement, the defendants will establish a multi-million-dollar settlement fund to provide benefits to eligible class members and to pay settlement administration costs of up to $2,000,000, attorneys’ fees of up to $6,400,000, and attorneys’ expenses of up to $1,313,000. The total value of the settlement fund has not been disclosed.
Eligible class members may submit claims for reimbursement of documented losses resulting from the data breach up to $2,500 per claimant. Reimbursement for all documented losses is limited to $250,000.
Eligible class members also receive medical data monitoring services for two years that include an identity theft reimbursement policy with coverage of up to $1 million. The stated retail value of the monitoring services is $179.40 per year for each enrolled class member.
In addition to providing monetary and non-monetary settlement benefits, MCNA has agreed to implement security improvements and update business practices intended to reduce the risk of similar incidents.
The settlement has not yet received preliminary court approval. Deadlines for objections, requests for exclusion, and claim submissions will be established upon preliminary approval by the court. Class members will begin receiving settlement notifications within 30 days after the court issues a preliminary approval order. Those notices will include claim submission instructions and a code for activating the medical data monitoring services.