Physicians Primary Care of Southwest Florida has agreed to a proposed settlement to resolve litigation related to a September 2024 cyberattack that exposed patient data, while denying wrongdoing and liability.
Data Breach and Allegations
Physicians Primary Care of Southwest Florida identified unauthorized access to its network on or around September 17, 2024. The unauthorized access occurred between September 15, 2024, and September 17, 2024. Patient information that was potentially viewed or obtained included names, medical information, and Social Security numbers.
The data breach report submitted to the U.S. Department of Health and Human Services’ Office for Civil Rights as required by HIPAA states that it affected 170,653 individuals.
A class action lawsuit alleged that the data breach could have been prevented and claimed that Physicians Primary Care of Southwest Florida failed to implement reasonable and appropriate security measures to prevent unauthorized access to patient data in its possession.
Physicians Primary Care of Southwest Florida operates medical offices in Cape Coral, Fort Myers, Lehigh Acres, and Estero, Florida. The healthcare organization provides services in obstetrics, gynecology, internal medicine, pediatrics and family practice.
Litigation History
On December 3, 2024, the first lawsuit related to the data breach was filed in the Circuit Court of the Twentieth Judicial Circuit. An amended complaint was filed on March 7, 2025, in the Circuit Court for Lee County, Florida. The amended complaint named two alternative plaintiffs after the plaintiff who filed the original complaint was determined not to be a putative class member.
The case, Cirillo et al. v. Physicians Primary Care of Southwest Florida, P.L., asserted claims for negligence, breach of fiduciary duty, breach of implied contract, declaratory judgment, and violation of the Florida Deceptive and Unfair Trade Practices Act.
Physicians Primary Care of Southwest Florida denies wrongdoing and liability and disputes the claims and contentions asserted in the lawsuit.
Settlement Terms
The parties began exploring an early resolution shortly after the amended complaint was filed. Mediation did not result in an agreement. After additional negotiations over several months, the parties reached settlement terms that were acceptable to all parties.
The settlement class consists of all living adults in the United States who received notification that their information was involved in the September 2024 data breach.
Under the proposed settlement, eligible class members may submit claims for reimbursement of documented and unreimbursed out-of-pocket expenses that are associated with the data breach. Reimbursement is available up to a maximum of $5,000 per class member.
The settlement does not provide an alternative cash payment.
All eligible individuals may enroll in two years of medical monitoring services. The medical monitoring services include identity theft insurance with a coverage limit of $1 million.
Court Approval Process
The proposed settlement has received preliminary approval from the court. A final fairness hearing is scheduled for September 14, 2026. Individuals who wish to object to the settlement or exclude themselves from the settlement class must do so by August 30, 2026. The deadline for submitting claims is September 29, 2026.
Image credit: Andrey Popov 1502396390 AdobeStock / logo© PhysiciansPrimaryCare
