CPAP Medical Data Breach Settlement: Claims Due November 26

People who received notice from CPAP Medical Supplies and Services Inc. that their private information may have been involved in a December 2024 cyberattack can now file claims in a proposed class action settlement. The settlement offers two years of CyEx Medical Shield Complete monitoring and, for people with qualifying proof, reimbursement of up to $5,000 in documented out-of-pocket losses.

Claims must be received, submitted, emailed, or postmarked by November 26, 2026. The deadline to opt out or object is earlier: October 30, 2026. The court has not granted final approval, CPAP denies wrongdoing, and filing a claim does not guarantee payment.

Key facts

Case: Brett Conner v. CPAP Medical Supplies and Services, Inc., Case No. CACE-26-011830
Court: Circuit Court for Broward County, Florida
Who is included: Living U.S. residents who were sent notice by CPAP that their private information may have been affected in the data incident
Benefits: Two years of medical-data monitoring and up to $5,000 for actual, documented, unreimbursed losses caused by the incident
Incident period: CPAP says an unauthorized actor accessed affected systems from December 13 through December 21, 2024
Opt-out and objection deadline: October 30, 2026
Claim deadline: November 26, 2026
Final approval hearing: December 1, 2026, at 8:30 a.m. Eastern Time
Current status: Proposed settlement awaiting final approval

What happened

CPAP Medical's own incident notice says an unauthorized actor gained access to its network environment. The company says it contained the threat, secured its environment, and worked with outside cybersecurity professionals to investigate whether personal or sensitive data had been compromised.

According to that notice, the affected systems were accessed between December 13 and December 21, 2024. After a forensic investigation and document review, CPAP determined on June 27, 2025, that the systems contained identifiable protected health information and personal information. The company began notifying potentially affected individuals on August 15, 2025, where contact information was available.

The court-authorized settlement notice says files accessed during the incident may have contained names, physical and email addresses, telephone numbers, Social Security numbers, driver's license numbers, health-insurance information, medical histories, treatment plans, and financial information. That list describes the types of information that may have been present; it does not establish that every listed data element was affected for every class member.

What changed A court-authorized claim process is now open. Class members must file a valid claim to receive either settlement benefit, but the settlement still requires final court approval.

What CPAP Medical does

CPAP Medical describes itself in its incident notice as a healthcare services company that provides sleep-apnea equipment to patients. Continuous positive airway pressure, commonly shortened to CPAP, is a form of sleep therapy that uses equipment to keep a person's airway open while sleeping. This case concerns information held by the supplier, not an allegation that a CPAP device was defective.

That distinction matters because the company name can be confused with separate litigation involving recalled Philips Respironics sleep-apnea machines. The settlement covered here is against CPAP Medical Supplies and Services Inc. and concerns a December 2024 cyberattack on its systems. Eligibility turns on CPAP Medical's notice records, not on ownership of any particular machine brand.

The information described in the settlement notice helps explain why the benefit includes medical-data monitoring rather than only ordinary credit monitoring. Health-insurance identifiers, medical record numbers, treatment information, and financial data can create different risks if used without authorization.

Who may be included

The court defined the settlement class as all living individuals residing in the United States who were sent notice by CPAP that their private information may have been impacted in the data incident.

The strongest practical indicator of class membership is therefore receipt of a notice from CPAP or the settlement administrator. The online claim form uses a Login ID and PIN from the notice. People who are uncertain whether they are included can contact the administrator through the official settlement website or by calling (833) 285-3011.

Excluded are CPAP's directors, officers, and agents; governmental entities; the assigned judge, the judge's immediate family, and court staff; and people who properly opt out by the deadline.

An opt-out, also called exclusion, removes a person from the settlement. Someone who validly opts out receives no settlement benefit but preserves the ability to pursue a separate case about the released claims, subject to applicable law and deadlines. A class member who remains in the settlement will be bound by the court's orders and the settlement release if the deal becomes final.

Notice-based eligibility The class is not every person who has used sleep-apnea equipment. It is limited to living U.S. residents whom CPAP sent notice that their information may have been affected.

What benefits are available

The official notice and claim form describe two benefits that may be requested together.

Two years of medical-data monitoring

All class members may claim two years of CyEx Medical Shield Complete. The court-authorized materials say the service includes $1 million in medical identity-theft insurance and monitoring for healthcare-insurance ID exposure, medical record number exposure, and unauthorized Health Savings Account spending. The service also includes access to a fraud-resolution agent if suspicious activity is detected.

No loss documentation is required to request the monitoring benefit. A class member must still submit a valid claim form and select the monitoring option.

Up to $5,000 for documented losses

Class members who incurred actual, documented, out-of-pocket losses because of the data incident may request reimbursement of up to $5,000. Covered losses must have occurred from December 13, 2024, through November 26, 2026.

The claim form lists examples such as losses from identity theft or fraud; fees for credit reports, credit monitoring, or freezing and unfreezing credit; costs to replace identification; and postage used to contact banks. Expenses already reimbursed by another party cannot be claimed again.

The $5,000 amount is a per-person ceiling, not a promised payment. The administrator will review each submission and may request additional information before treating a claim as complete and valid.

No flat cash option The court-authorized materials do not offer a no-proof alternative cash payment. A class member without documented losses may still claim the two-year monitoring benefit.

What proof is required

A claimant requesting reimbursement must provide documentation showing both the amount and its connection to the data incident. The official form identifies bank statements and receipts as examples. A claimant may add self-prepared notes to explain other evidence, but the form says those notes alone are not enough to establish a valid loss claim.

The form also requires the claimant to attest under penalty of perjury that the information and supporting documents are true and correct to the best of the claimant's knowledge. Claims remain subject to verification.

Medical-data monitoring does not require receipts or proof of a financial loss. The claimant selects that benefit on the same form.

How to file a claim

The official site is CPAPDataIncidentSettlement.com, administered by Simpluris. Online filing requires the Login ID and PIN printed on the settlement notice.

A paper claim form can be downloaded from the official site. Completed forms may be mailed to the settlement administrator, and the court-authorized form also says an electronic image of a completed form can be emailed to info@CPAPDataIncidentSettlement.com. Claimants seeking documented-loss reimbursement should include the supporting evidence required by the form.

Claims must be received or postmarked by November 26, 2026. The paper form instructs claimants to submit only one form per person.

The form offers several payment methods for an approved cash claim: PayPal, Venmo, Zelle, a virtual prepaid card, or a physical check. Selecting a delivery method does not mean the claim has been approved.

Two different deadlines October 30 controls opt-outs and objections. November 26 controls claims. Waiting until the claim deadline may be too late for someone who wanted to leave the settlement.

What the lawsuit alleges

The lawsuit alleges that a targeted cyberattack on CPAP's computer systems allowed access to files containing private information. The public settlement materials describe the allegations at a high level and do not amount to a finding that CPAP violated a particular legal duty.

A proposed class action settlement is a negotiated resolution that still requires court approval. It is not a verdict. CPAP denies wrongdoing, and the court has not decided whether the plaintiffs or CPAP are right.

The named class representatives listed in the official FAQ are Brett Conner, Juwan Overshown, Diane Edwards, Stephen Follett, Roderic Woods, John Crist, Chris Harriman, and Tyrone Woods. They act on behalf of the proposed class for settlement purposes.

Timeline and current status

December 13–21, 2024: CPAP says an unauthorized actor accessed affected network systems.
June 27, 2025: CPAP says its investigation and document review identified affected systems containing identifiable protected health and personal information.
August 15, 2025: CPAP says it began notifying potentially affected individuals where contact information was available.
August 28, 2026: The settlement website lists the notification mailing date.
October 30, 2026: Deadline to opt out or object.
November 26, 2026: Claim deadline.
December 1, 2026: Scheduled final approval hearing at 8:30 a.m. Eastern Time.

At the final approval hearing, the court will consider whether the settlement is fair and whether to approve it. The date or time may change, so class members should check the official settlement website for updates.

What remains disputed

CPAP has not admitted wrongdoing. The court has not decided whether the company is legally responsible for the incident or for any claimed loss. The company's 2025 incident notice also said it had no evidence at that time that personal information had been or would be misused as a direct result of the incident.

The notice does not mean every class member experienced identity theft, financial fraud, or medical identity theft. Likewise, the availability of reimbursement does not mean every submitted expense will qualify. The administrator must determine whether a claim is valid and adequately documented under the settlement terms.

No settlement benefit will be issued unless the court grants final approval and any appeals are resolved. The official materials do not promise an individual payment date.

What happens next

Class members who want benefits must submit a claim by November 26. People considering exclusion or an objection must act by October 30.

After the December 1 hearing, the court may approve, reject, or require changes to the proposed settlement. Even if the court approves it, an appeal could delay the effective date and the distribution of benefits.

Readers should use the court-authorized website for claim forms, deadlines, and updates. This article provides legal news and general information, not legal advice or a determination that any individual qualifies.

Frequently asked questions

Who qualifies for the CPAP Medical data incident settlement?

The class covers living U.S. residents who were sent notice by CPAP that their private information may have been impacted in the December 2024 incident. Receipt of notice is the central eligibility criterion in the court-authorized definition.

How much can I claim?

A class member may request up to $5,000 for actual, documented, unreimbursed out-of-pocket losses caused by the incident and incurred from December 13, 2024, through November 26, 2026. The amount approved depends on the evidence and settlement review. This is not a guaranteed $5,000 payment.

Can I receive money without receipts?

The official materials do not list a flat or alternative cash payment. A cash claim requires supporting proof, although a class member may request two years of medical-data monitoring without loss documentation.

What is the claim deadline?

Claims must be received, submitted, emailed, or postmarked by November 26, 2026. Opt-outs and objections are due earlier, on October 30, 2026.

Has the settlement received final approval?

No. A final approval hearing is scheduled for December 1, 2026, at 8:30 a.m. Eastern Time. Benefits will not be issued unless approval becomes final and any appeals are resolved.