Individuals who received notice of the Charleston Area Medical Center data breach may be eligible to claim up to $6,080 plus four years of identity monitoring from a class action settlement. The claim deadline is June 10, 2026.
If you received a letter from Charleston Area Medical Center about a data breach that compromised your personal and medical information in October 2024, there’s a settlement with your name on it. CAMC agreed to resolve a class action lawsuit stemming from an email phishing attack that exposed sensitive data belonging to more than 67,000 people.
The company denies any wrongdoing but chose to settle rather than face a drawn-out trial. The result: real money and free identity monitoring available to people who were affected – and you don’t need a lawyer to get it.
Who can file a claim?
Individuals must meet all of the following criteria:
- They received a notice letter from Charleston Area Medical Center regarding the October 2024 data incident.
- Their personal information – including names, dates of birth, Social Security numbers, email addresses, phone numbers, driver’s license numbers, health information, or health insurance information – was potentially compromised.
- They are members of the Settlement Class as defined in the court-approved notice.
Were you affected by the CAMC data breach? You may be eligible for up to $6,080 plus free identity monitoring.
Check My EligibilityHow much can class members receive?
Class members can claim several types of awards, depending on their circumstances and the documentation they provide:
- Documented monetary losses: Up to $6,000 for out-of-pocket expenses related to the data breach – fraud charges, identity theft costs, credit monitoring fees, and other documented losses. Requires supporting documentation such as receipts, bank or credit card statements, or invoices.
- Attested time: Up to four hours at $20 per hour (maximum $80) for time spent responding to the breach. Must describe the activities and hours spent dealing with the incident.
- Alternative cash benefit: A pro rata share of the remaining settlement fund for class members who do not claim documented losses or attested time. No documentation required.
- Identity monitoring: Four years of free identity theft and fraud monitoring services. Available to all class members without submitting a claim.
How to claim a data breach payment
Class members can submit the online claim form or download, complete, and mail a printed claim form to the settlement administrator. The claim deadline is June 10, 2026.
CAMC Data Breach Settlement, c/o ILYM Group, Inc., PO Box 2031, Tustin, CA 92781
What proof or documentation is necessary to submit a claim?
- All claimants must provide their identifying information as specified in the notice letter they received.
- Claimants filing for documented monetary losses must provide supporting documentation such as receipts, bank or credit card statements, or invoices showing out-of-pocket expenses related to the data breach.
- Claimants filing for attested time must provide a description of the activities and hours spent responding to the breach.
- Claimants filing for the alternative cash benefit do not need to provide documentation.
- Identity monitoring is available to all class members automatically – no claim required.
Payout options
- Virtual Mastercard
- Venmo
- Zelle
- Paper check
Settlement fund breakdown
The settlement fund covers:
When is the CAMC settlement payout date?
The settlement administrator will issue payments after the court grants final approval of the settlement and resolves any appeals. The final approval hearing is scheduled for June 23, 2026, in the Circuit Court of Kanawha County, West Virginia.
No specific payout date has been announced – this is standard at this stage of the process. Payments are typically distributed within 60 days after final approval, assuming no appeals are filed.
Why did this class action settlement happen?
The class action lawsuit alleged that Charleston Area Medical Center experienced an email phishing attack in October 2024 that compromised the personal and medical information of more than 67,000 individuals. The plaintiffs claimed CAMC failed to implement adequate security measures to protect sensitive patient data.
CAMC denies any wrongdoing but agreed to settle to avoid the uncertainty and expense of litigation.
Is the CAMC data breach settlement legitimate?
Yes – this is a fully court-supervised settlement. Here’s what confirms it:
- Case number: CC-20-2025-C-272, filed in the Circuit Court of Kanawha County, West Virginia
- Judge: Honorable Richard Lindsay
- Administrator: ILYM Group, Inc., an established settlement administration firm
- Official site: camcdatabreachsettlement.com
The settlement is pending final court approval at the June 23, 2026 hearing. Claims must be filed before June 10, 2026 – no payments will be issued before final approval.
How much will I actually receive from the CAMC settlement?
It depends on two things: what you claim and how many people file. The $1,000,000 fund is split among all valid claimants.
- Up to $6,000 (documented losses) – requires receipts, bank statements, or invoices showing out-of-pocket expenses from the breach.
- Up to $80 (attested time) – 4 hours at $20 per hour for time spent responding to the incident.
- Alternative cash benefit (no docs needed) – a pro rata share of the remaining fund for those who don’t claim losses or time.
- Identity monitoring – four years of free monitoring, available to everyone automatically.
The $6,080 headline figure is the theoretical maximum for documented claims. Most people will file for the alternative cash benefit plus the free identity monitoring – both of which are still worth claiming.
What actually happened in the CAMC data breach?
In October 2024, Charleston Area Medical Center – a major healthcare system based in Charleston, West Virginia – was hit by an email phishing attack that compromised sensitive patient and employee data.
What was exposed: First and last names, dates of birth, Social Security numbers, email addresses, phone numbers, driver’s license numbers, health information, and health insurance information.
What the lawsuit claims: That CAMC failed to implement adequate cybersecurity protections, leaving patient data vulnerable to a phishing attack that could have been prevented.
What CAMC says: They deny any wrongdoing – but agreed to a $1,000,000 settlement rather than face trial.
Why do companies settle data breach lawsuits even when they deny wrongdoing?
Settlement does not mean admission of guilt. Companies settle for practical reasons:
- Litigation is expensive – legal fees alone can exceed the settlement amount
- Trials are unpredictable – a verdict could result in a far larger payout
- Settling ends years of ongoing litigation and negative press
- For plaintiffs, it guarantees a payout rather than risking nothing at trial
Courts still review every class action settlement to confirm it’s fair and reasonable – that’s what the June 23, 2026 hearing is for. Denying wrongdoing while settling is standard practice and has no effect on your right to file a claim.