CPAP Medical Supplies settles class action following 2024 data breach

Medical device company CPAP Medical Supplies and Services has reached an agreement to resolve a class-action lawsuit arising from a 2024 data breach that affected the personal information of more than 90,000 people.

 

In August 2025, CPAP revealed that it had experienced a cybersecurity incident in which threat actors obtained unauthorised access to its internal network between December 13, 2024, and December 21, 2024, and exfiltrated sensitive data. The subsequent investigation found that the incident impacted over 90,000 individuals, with exposed information including names, contact details, dates of birth, Social Security numbers, and more.

 

Following the cyber attack, a class-action lawsuit was filed against CPAP in the Circuit Court for Broward County, Florida. The complaint alleges that the medical device manufacturer failed to implement sufficient data security safeguards and adequately protect the personal information it held.

 

While CPAP denied any wrongdoing or negligence, the parties agreed to settle the lawsuit to avoid the costs and uncertainties associated with continued litigation and to provide Class members with compensation and other benefits outlined in the settlement agreement.

 

Under the proposed settlement, CPAP will provide eligible class members with two years of CyEx Medical Shield Complete, including medical identity theft insurance and monitoring for exposed healthcare insurance IDs, Medical Record Numbers, and unauthorised HSA activity.

 

Eligible class members may also claim reimbursement of up to $5,000 for documented out-of-pocket losses reasonably linked to the Data Incident, including identity theft or fraud, credit monitoring, credit report fees, ID replacement, and postage. Claims must include supporting documentation, and expenses reimbursed by another source are not eligible. Total payments for this benefit are capped at $500,000 and may be reduced pro rata if valid claims exceed the cap.

 

The proposed settlement has been granted preliminary approval by the court but has not yet become final. A final approval hearing is scheduled for December 1, when the court will decide whether to approve the settlement.