Asheville Eye Associates 1.25M Settlement for November 2024 Patient Data Breach

Asheville Eye Associates, an ophthalmology practice, reported a patient data breach tied to a cybersecurity incident in November 2024 that allegedly exposed sensitive personal information. Healthcare providers are frequent targets for cyberattacks because they store a mix of high-value identifiers and medical data, and when those systems are disrupted or accessed, affected patients can face risks such as identity theft, fraud, phishing, and long-term privacy concerns. The settlement website indicates a proposed class action resolution with a total settlement fund of $1.25 million, potential payments up to $1,250, a claims deadline of 4/6/26, and a requirement that claimants provide proof. The lawsuit was filed on behalf of patients who allege the practice failed to implement reasonable data-security safeguards, detect the incident promptly, or adequately protect information entrusted to a healthcare provider, causing financial losses and time spent monitoring accounts as well as increased risk of future misuse. Settlements like this are significant because they can compensate individuals for documented out-of-pocket costs (and sometimes time spent responding) while also pressuring organizations to strengthen security practices through agreed-upon remedial measures. More broadly, the case fits a well-established pattern of healthcare data-breach class actions against hospitals, clinics, and insurers, and it operates alongside regulatory expectations such as HIPAA’s Privacy and Security Rules (which require administrative, physical, and technical safeguards) and state privacy and breach-notification laws—frameworks that shape what “reasonable” protection means even when a breach results from criminal hacking rather than intentional disclosure.