Gramercy Surgery Center reaches $400K settlement in wake of 2024 data breach

Gramercy Surgery Center in New York has agreed to a $400,000 class action settlement following a ransomware attack that compromised sensitive patient data in June 2024. The agreement, which has received preliminary court approval, provides financial relief and credit monitoring services to over 52,000 affected individuals.

The breach was identified on June 18, 2024. Although Gramercy did not officially label it a ransomware incident, the Everest ransomware group claimed responsibility and listed the center on its data leak site. Investigations revealed the attackers had accessed the network as early as June 14, 2024, and exfiltrated a range of personal and health information, including names, addresses, Social Security numbers, medical records, treatment details, and insurance information. The breach was reported to the U.S. Department of Health and Human Services’ Office for Civil Rights as affecting 52,544 individuals.

In response, a class action lawsuit, Horvath v. Gramercy Surgery Center, Inc., was filed in the U.S. District Court for the Southern District of New York. The suit alleged that Gramercy failed to implement reasonable data security measures as required under the Health Insurance Portability and Accountability Act (HIPAA), the Federal Trade Commission Act, and other applicable standards. It also claimed the center neglected to delete data no longer needed and delayed in providing adequate breach notifications. Additional claims included breach of implied contract and unjust enrichment.

Gramercy Surgery Center has denied all allegations, asserting that no legal wrongdoing occurred. However, it agreed to the settlement to avoid the cost and uncertainty of protracted litigation.

The settlement covers the 52,372 individuals who were formally notified of the breach and offers two monetary relief options: reimbursement for documented out-of-pocket expenses up to $2,500, including compensation for up to three hours of lost time, or a $50 cash payment. If total claims exceed the $400,000 cap, payments will be distributed on a proportional basis. Importantly, this fund excludes attorneys’ fees and court costs, which will be paid separately by Gramercy.

In addition to financial compensation, all class members are entitled to three years of credit monitoring and identity theft protection services, regardless of whether they pursue a monetary claim. The deadline to object to or opt out of the settlement is August 29, 2025. Claims must be submitted by September 29, 2025. A final approval hearing is scheduled for October 21, 2025, at 9:30 a.m. in the Southern District of New York.