People whose personal information may have been taken in the 2023 data breach at Hospital Español Auxilio Mutuo de Puerto Rico have until December 21, 2026, to file a claim. The settlement sets aside up to $500,000 for members, and the choice is between repayment of documented losses and a flat $25. Every class member can also get two years of credit and medical monitoring.
What happened at the Puerto Rico hospital
The U.S. Department of Homeland Security told the hospital on September 23, 2023, that a cybercriminal group had likely targeted it, HIPAA Journal reported. Evidence of unauthorized network access turned up on November 21, 2023, and signs that data had been copied followed on May 15, 2024.
Outside experts concluded in September 2024 that the breach was limited to patients who visited between August 2022 and September 2023. The hospital mailed breach notices on April 21, 2025. It reported the incident to the federal health privacy office in July 2025.
The data at risk was broad: names, Social Security numbers, driver’s license and passport numbers, financial and bank account details, payment card information, billing codes, and medical and health insurance records. The hospital told regulators it could not determine exactly which items were taken for each patient.
How many people are in the class is not clear. A federal breach report used a placeholder figure of 500 individuals because the true number was unknown, HIPAA Journal said, and the total had not been updated. A fund of up to $500,000 split among a larger group would shrink each payment.
That uncertainty is why the settlement class is defined by exposure risk, not by proof of theft. It covers individuals living in the United States whose personal information may have been accessed or acquired in the September 2023 incident. A patient who received a breach letter is the obvious candidate.
Retirement deadlines, in your inbox: Miss an enrollment or claim deadline and the money can be gone. Join the Retirement Money Brief and we’ll send you our Open Settlements & Refund Tracker as a welcome gift.
Get the Brief + the settlements tracker →
We may earn a commission from links on this page.
The two payment choices
The settlement website offers claimants a choice. One option is reimbursement of documented out-of-pocket losses of up to $2,500 per person. The other is a $25 alternative cash payment that needs no receipts.
The larger option has a proof requirement. According to the claim listing at ClaimDepot, losses need third-party documentation showing they were likely caused by the breach, and handwritten or self-prepared records alone are not enough. Bank statements, card charges and bills from outside companies are the kind of paper that counts.
Paper claims go to Hospital Español Auxilio Mutuo De Puerto Rico, Inc. Data Incident, c/o Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY 10150-5391, postmarked by December 21. Online claims can be paid electronically, while mailed claims get a check. The online form asks for the class member ID printed on the settlement notice. People who lost or never received a notice can call the administrator, Kroll Settlement Administration, at (833) 453-0919.
The $500,000 is a ceiling for member benefits. If valid claims add up to more, ClaimDepot’s listing says each payment is cut back in proportion. The defendant pays service awards, notice and administration costs, and attorney fees and costs separately, according to the settlement website.
Monitoring comes without a claim
Every class member is entitled to two years of credit and medical monitoring, even without filing a claim, unless that person opts out. Signing up needs the code from the settlement notice. The listing says the coverage includes at least $1 million in fraud protection.
For a patient whose Social Security number and insurance details were both in the file, monitoring may be worth more than the $25. Credit monitoring watches for new accounts, and medical monitoring watches for misuse of health insurance. Anyone who wants both the cash and the monitoring can take both.
Dates and court details beyond December 21
The claim deadline, the opt-out deadline and the objection deadline are all December 21, 2026. Paper claim forms must be postmarked by then. Choosing to opt out means giving up the settlement benefits but keeping the right to sue the hospital separately.
The case is Morales Rosario v. Hospital Español Auxilio Mutuo de Puerto Rico Inc., No. 3:25-cv-01244-RAM, in the U.S. District Court for the District of Puerto Rico. The hospital denies wrongdoing, according to the listing. The final approval hearing is January 20, 2027, at 9:30 a.m. Atlantic time, and the date can change.
Payments start only after the judge grants final approval and any appeals end. That puts checks and electronic transfers well after the new year. The claim must still be in by December 21, and the listing says it can be filed online or by mail to Kroll’s post office box in New York.
The question for a patient is which payment fits the paper on hand. Someone with bank statements showing a fraud loss has a route to $2,500, and someone with nothing in writing still has the $25 and the monitoring.
Do the breach letter and the loss records line up?
A patient with a fraud charge, a new account opened in their name or a medical bill they never ran up has a $2,500 route, but only with outside paperwork behind it. Without that proof, the claim falls back to $25, and a December 21 deadline leaves little time to rebuild a paper trail.
The Settlement & Refund Recovery System includes a section on claiming when the receipts are gone, a step-by-step filing walkthrough and a claim log and payment tracker for dates and amounts. It also lays out the four-date rule for reading a settlement notice. It is a paid RetireShield guide, not the settlement site, and it does not file or decide anything.
Organize breach-claim receipts and the December 21 date in a recovery tracker →
More Financial Reading
- 21 Ways to Stretch a $2,087 Social Security Check
- 15 Places to Find Your Share of the $4.25 Billion States Give Back
- 15 Steps to Stop the Scams That Took $7.7 Billion From Seniors
This article was produced with AI assistance and edited for accuracy against the sources linked above.
