ApolloMD agrees to multi-million-dollar settlement over 2025 data breach

Atlanta, Georgia-based ApolloMD has agreed to resolve a class action lawsuit related to a data security incident it experienced in 2025.

Earlier this year, ApolloMD disclosed to the Office for Civil Rights of the U.S. Department of Health and Human Services that a cyber attack in May 2025 affected the personal information of at least 626,540 individuals. The incident involved unauthorised third parties gaining access to ApolloMD’s network between May 22 and May 23, 2025, and removing files containing sensitive patient information.

ApolloMD said that while the unauthorised party was in its IT environment, it may have accessed or obtained files containing information related to patients treated by its affiliated physicians and practices. The exposed information included names, dates of birth, addresses, diagnosis information, provider names, dates of service, treatment information, and health insurance information. For some affected individuals, Social Security numbers may have also been involved. 

ApolloMD said it takes the incident seriously, regrets any concern caused, and has implemented enhanced security protocols and additional measures to help prevent similar incidents in the future.

A class action lawsuit was filed in the U.S. District Court for the Northern District of Georgia, Atlanta Division, following the cyberattack. Plaintiffs alleged that ApolloMD failed to implement adequate security measures to protect patients’ personal and health information, resulting in potential exposure of sensitive data and risks of identity theft and fraud. The lawsuit also claimed the company breached its obligations to safeguard patient information and violated consumer protection laws.

Although ApolloMD has denied the allegations and stated that it did not commit any wrongdoing, the company has agreed to a proposed $4.02 million class action settlement. The agreement is pending final approval by the U.S. District Court for the Northern District of Georgia, Atlanta Division, which is expected to review and decide on the settlement at a hearing scheduled for October 5, 2026.

If approved, the settlement fund will provide eligible class members with cash payments, one year of medical data monitoring, settlement administration costs, and court-approved attorneys’ fees and expenses. Claimants can choose between up to $5,000 in reimbursement for documented fraud or identity theft losses related to the incident, or an estimated $75 alternative cash payment.