Healthcare Services Group has agreed to establish a $3,000,000 settlement to resolve litigation arising from a September 2024 cybersecurity incident involving unauthorized access to systems that contained the personal data and protected health information (PHI) of 624,496 individuals.
Cybersecurity Incident
Healthcare Services Group is a Bensalem, Pennsylvania-based provider of environmental, dining, and nutritional support services that works with more than 3,000 HIPAA-covered healthcare facilities across 48 U.S. states. Suspicious network activity was identified on or around October 7, 2024. A forensic investigation determined that an unauthorized third party first breached the company’s network on September 27, 2024.
The company took action to prevent additional unauthorized access after the suspicious activity was identified. Files containing PHI had already been exfiltrated from the network before those actions were completed.
The exposed files contained names, driver’s license numbers, Social Security numbers, state ID numbers, financial account details, account access information, health data and medical insurance details.
Litigation
Notification letters to affected individuals began to be mailed on August 25, 2025. The first class action lawsuit was filed on August 27, 2025. Additional lawsuits asserting similar claims were later filed, and the actions were consolidated into a single complaint titled Williamson, et al. v. Healthcare Services Group, Inc. in the United States District Court for the Eastern District of Pennsylvania.
The consolidated complaint asserted claims for negligence, breach of implied contract, breach of fiduciary duty, breach of contracts for which the plaintiffs and class members were intended third-party beneficiaries, unjust enrichment, violations of the Washington Consumer Protection Act and the New Jersey Consumer Fraud Act, and requests for declaratory and injunctive relief.
Healthcare Services Group denies wrongdoing and disputes the claims and allegations asserted in the litigation. Nevertheles, the parties decided to settle after determining that continuing the litigation would likely be costly and protracted. The settlement also avoids the uncertainty and risks associated with a trial.
Settlement Terms
Healthcare Services Group has agreed to establish a settlement fund of $3,000,000. Attorneys’ fees and expenses, settlement administration costs, and service awards for class members will be deducted from the settlement fund. The remaining funds will be used to provide benefits to eligible class members.
Eligible class members may claim three years of single-bureau credit monitoring services. Those services include identity theft insurance and identity theft recovery services.
Class members may also submit claims for reimbursement of documented, unreimbursed losses attributed to the data breach up to a maximum of $5,000 per person. A separate claim for a one-time pro rata cash payment may be submitted. The value of the cash payment will depend on the number of valid claims received because the payments will exhaust the remaining settlement fund.
Settlement Deadlines
Requests for exclusion from the settlement and objections must be submitted by September 4, 2026. The deadline for submitting a claim is October 1, 2026. The final fairness hearing is scheduled for September 24, 2026.
Image credit: 1931528367 – Toowongsa, AdobeStock / logo©HealthcareServicesGroup
