Greater Rochester Independent Practice Association (GRIPA) has agreed to pay $2,150,000 to settle claims arising from the May 2023 MOVEit data breach, while denying wrongdoing and without resolving the separate litigation against Progress Software.
Settlement Agreement
The proposed settlement resolves claims filed against GRIPA following the May 2023 data breach associated with Progress Software’s MOVEit Transfer file transfer solution. The claims against Progress Software remain pending and are not resolved by this agreement.
The settlement was reached after mediation conducted on June 10, 2025. The parties agreed to the material settlement terms following that mediation. GRIPA stated that it denies any wrongdoing and disputes the allegations raised in the litigation. The settlement was reached after the parties considered the cost, expense, duration, and uncertainty associated with continued litigation and related appeals.
The court has granted preliminary approval of the settlement.
Background of the Litigation
The litigation arose after the May 2023 exploitation of a zero-day vulnerability in the MOVEit Transfer file transfer solution owned by Progress Software.
The incident affected organizations that used the MOVEit platform. CL0p, the Russian-speaking hacking group, exploited the vulnerability to obtain sensitive information from organizations using the software.
GRIPA became the subject of four class action lawsuits related to the incident. The first action, Clarke, et al. v. Progress Software Corp., et al., was transferred and coordinated with the multidistrict litigation titled In re: MOVEit Customer Data Security Breach Litigation in the U.S. District Court for the District of Massachusetts.
The plaintiffs alleged the data breach could have been prevented through cybersecurity measures, including HIPAA encryption and protocols identified in the complaints. GRIPA filed a motion to dismiss the litigation. On December 12, 2024, the court granted the motion in part and denied it in part.
Progress Software filed multiple motions seeking dismissal of the multidistrict litigation. In July 2025, the court largely denied those motions while allowing certain rulings on specific claims identified in the litigation.
Information Alleged to Have Been Compromised
According to the litigation, information associated with GRIPA patients included:
- Names
- Dates of birth
- Social Security numbers
- Health and treatment information
- Medical insurance information
- Pharmacy prescription information
- Prescriber information
The lawsuits alleged that disclosure of this information resulted in legally recognizable injuries and asserted claims that included unjust enrichment, negligence, negligence per se, breach of implied contract, breach of third-party beneficiary contract, and requests for declaratory and injunctive relief.
Settlement Benefits
The settlement establishes a $2,150,000 fund to pay eligible claims submitted by settlement class members. Payments from the settlement fund will be made after deductions for settlement administration and notification costs, attorneys’ fees and expenditures, and service awards for the class representatives.
Eligible class members may submit claims for reimbursement of:
- Up to $2,500 for ordinary losses
- Up to $10,000 for extraordinary losses
Class members who do not submit claims for reimbursement of losses may instead elect a one-time cash payment estimated at approximately $100 per eligible class member. The final amount may increase or decrease on a pro rata basis depending on the number of valid claims submitted.
The settlement also provides two years of complimentary credit monitoring and identity theft protection services for all settlement class members who submit a claim for those benefits.
Settlement Deadlines
The deadline to submit a claim is September 3, 2026. Individuals who wish to exclude themselves from the settlement or submit an objection must do so by August 4, 2026. The final fairness hearing is scheduled for September 3, 2026.
Image credit: ronstik – 304453347, AdobeStock / logo©GRIPA
