Individuals affected by the Norton Healthcare data breach may be eligible to claim up to $2,580 plus three years of medical monitoring from an $11 million class action settlement.
If your personal information was compromised in the Norton Healthcare data breach, there is real money available to you. Norton Healthcare – a Kentucky-based healthcare system that employs over 14,000 people and provides services to over 1 million patients each year – agreed to an $11 million settlement to resolve a class action lawsuit stemming from a data incident on May 9, 2023.
The company denies any wrongdoing but chose to settle rather than face a drawn-out trial. The result: cash payments and free medical monitoring available to people who were affected – and you don’t need a lawyer or extensive paperwork to get it.
Who can file a claim?
Individuals must meet all of the following criteria:
- They received a letter from Norton Healthcare notifying them that their personal information may have been compromised in the data incident on or around May 9, 2023.
- Their sensitive information, including Social Security numbers, was potentially exposed.
- They are not excluded parties (judge, company officers/directors).
Were you affected by the Norton Healthcare data breach?
Check My EligibilityHow much can class members receive?
Class members can claim several types of awards, depending on their circumstances and the documentation they provide:
- Out-of-pocket losses: Up to $2,500 for documented unreimbursed expenses including bank fees, communication charges, travel expenses, credit-related costs, and fraudulent charges. Documentation required (receipts, statements).
- Lost time: Up to 4 hours at $20 per hour (maximum $80) for time spent dealing with the breach. Must describe activities and attest under penalty of perjury.
- Cash payment: At least $5 per claimant, distributed pro rata from remaining funds after other claims and fees are deducted. No documentation required.
- Medical monitoring: Three years of CyEx Medical Shield Pro medical account monitoring. No documentation required.
How to claim a data breach payment
Class members can submit the online claim form or download, print, complete and mail the PDF claim form to the settlement administrator. The claim deadline is May 18, 2026.
Norton Healthcare Data Incident Settlement, c/o Claims Administrator, PO Box 5324, New York, NY 10150-5324
What proof or documentation is necessary to submit a claim?
- All claimants must provide their name, address, and contact information to verify class membership.
- Claimants filing for out-of-pocket losses must provide documentation such as receipts, bank statements, or other records showing unreimbursed expenses tied to the breach.
- Claimants filing for lost time must provide a description of the activities and time spent, as well as an attestation under penalty of perjury.
- Claimants filing for the cash payment or medical monitoring do not need to provide documentation.
Payout options
- Physical check (for mailed claim forms)
- Electronic payment (for online claim forms)
Settlement fund breakdown
The $11,000,000 settlement fund covers:
When is the Norton Healthcare data settlement payout date?
The settlement administrator will issue payments after the court resolves any appeals and grants final approval of the settlement. The fairness hearing is scheduled for May 15, 2026. No specific payout date has been announced – this is standard at this stage of the process.
Why did this class action settlement happen?
The class action lawsuit alleged Norton Healthcare experienced a data breach on or around May 9, 2023 that potentially exposed the personal information – including Social Security numbers – of individuals in their system. The plaintiffs claimed Norton Healthcare failed to adequately protect this sensitive data.
Norton Healthcare denies any wrongdoing but agreed to an $11 million settlement to avoid the uncertainty and expense of litigation.
Is the Norton Healthcare data breach settlement legitimate?
Yes – this is a fully court-supervised settlement. Here’s what confirms it:
- Case number: 23-CI-003349, filed in Jefferson Circuit Court, Division Two, Kentucky
- Administrator: Kroll Settlement Administration LLC, an independent third party
- Official site: nortondataincidentsettlement.com
- Notice: Sent directly by the administrator – not by Norton Healthcare
The settlement is pending final court approval at the May 15, 2026 fairness hearing. Claims must be filed before May 18, 2026 – no payments will be issued before final approval.
How much will I actually receive from the Norton Healthcare settlement?
It depends on two things: what you claim and how many people file. The $11 million fund is split among all valid claimants after fees and administration costs.
- At least $5 (no docs needed) – the base cash payment. Distributed pro rata from remaining funds, so the actual amount could be higher if fewer people file.
- Up to $2,580 (out-of-pocket losses + lost time) – requires receipts, bank statements, or other records.
- Medical monitoring – three years of CyEx Medical Shield Pro, no documentation required, available to everyone.
The $2,580 headline figure is the theoretical maximum for documented losses. Most people will receive the base cash payment plus three years of medical monitoring – which is still worth filing for.
What actually happened in the Norton Healthcare data breach?
On or around May 9, 2023, Norton Healthcare – a Kentucky-based healthcare system serving over 1 million patients annually – experienced a data breach that exposed sensitive personal information in their systems.
What was exposed: Personal information including Social Security numbers, medical records, and other sensitive data belonging to patients, employees, and their dependents.
What the lawsuit claims: That Norton Healthcare failed to implement adequate security measures to protect the personal and medical information entrusted to them.
What Norton Healthcare says: They deny any wrongdoing – but agreed to an $11 million settlement rather than face trial.
Why do companies settle data breach lawsuits even when they deny wrongdoing?
Settlement does not mean admission of guilt. Companies settle for practical reasons:
- Litigation is expensive – legal fees alone can exceed the settlement amount
- Trials are unpredictable – a verdict could result in a far larger payout
- Settling ends years of ongoing litigation and negative press
- For plaintiffs, it guarantees a payout rather than risking nothing at trial
Courts still review every class action settlement to confirm it’s fair and reasonable – that’s what the May 15, 2026 fairness hearing is for. Denying wrongdoing while settling is standard practice and has no effect on your right to file a claim.