Great Expressions Dental Centers agrees to $2.7M settlement over 2023 data breach

Great Expressions Dental Centers, a Michigan-based dental practice with 250 centers across nine states, has reached a preliminary settlement of $2.7 million in a class action lawsuit stemming from a 2023 data breach that exposed the personal information of over 1.9 million patients and employees. The breach involved the unauthorized access of sensitive data, including Social Security numbers and health records, following a hacking incident earlier this year.

The settlement, which awaits final approval at a fairness hearing set for December 12 in a Michigan federal court, provides financial compensation to two subclasses of affected individuals. Those whose Social Security numbers were compromised will be eligible for payments of up to $500 for out-of-pocket expenses and up to $5,000 for unreimbursed extraordinary losses traceable to the breach. They will also be compensated for up to $40 for time spent addressing the incident. For individuals whose Social Security numbers were not accessed, claims of up to two hours of response time will be compensated at $20 per hour.

In addition to the monetary settlement, Great Expressions has committed to strengthening its data security practices. Planned enhancements include implementing multifactor authentication, updating centralized security protocols for data retention and destruction, using a vulnerability management tool for patching, and ensuring all workstations are encrypted. These measures aim to prevent future incidents of this nature.

The breach was first reported by Great Expressions to the U.S. Department of Health and Human Services on May 12, 2023. The incident, which occurred between February 17 and 22, 2023, compromised a wide range of personal information. For patients, this included names, birth dates, Social Security numbers, financial details, medical and dental records, and insurance information. For employees, the breach exposed Social Security numbers, driver’s licenses and passport numbers, and bank account details.

In response to the breach, plaintiffs filed an amended consolidated complaint in May 2023, alleging that Great Expressions was negligent in protecting the sensitive information stored in an unencrypted, internet-accessible environment. The lawsuit also claims that the company failed to adequately respond to the data security incident.

As part of the proposed settlement, five plaintiffs will each receive $2,500 in service awards, while attorneys representing the plaintiffs and class members will be paid $900,000 in fees, plus $25,000 in expenses. Great Expressions has denied any wrongdoing as part of the agreement.

Great Expressions, which operates dental centers in states including Connecticut, Florida, Georgia, Michigan, and Texas, has yet to provide additional details about the breach or comment on the settlement.