Consulting Radiologists Lawsuit: $2.2M Data Breach Settlement

A Minnesota court granted final approval on February 25, 2026, to a $2.2 million class action settlement resolving claims tied to the Consulting Radiologists data breach that exposed the personal and medical information of nearly 584,000 patients in February 2024. The claims deadline was March 2, 2026, and is now closed. Payments will be distributed to eligible class members who filed on time, once all post-approval reviews are complete.¹²

Who Was Covered

The settlement class included all U.S. residents whose information was potentially accessed in the breach that Consulting Radiologists, Ltd. (CRL) detected on February 12, 2024. CRL reported to the U.S. Department of Health and Human Services that up to 583,824 people were affected.³

The information exposed varied by patient but included names, addresses, dates of birth, medical information, and health insurance details. For 19,346 individuals, Social Security numbers were also compromised. A smaller subset had driver’s license numbers, face sheets, and imaging reports exposed.³

Notification letters went out to affected individuals on or around August 27, 2024. If you received one of those letters, you were in the class. CRL’s current and former officers and directors, the presiding judge and his immediate family, and anyone who opted out by January 30, 2026, were excluded.⁴²

What the Settlement Pays

The $2.2 million fund covers class member payments along with attorneys’ fees (capped at $660,000), service awards for the 19 named plaintiffs, and administration costs. Class members who filed claims could choose from three types of benefits.⁵

Documented out-of-pocket losses tied to the breach, such as identity theft costs, bank fees, or credit monitoring purchases, could be reimbursed up to $5,000 with supporting proof.⁶

Flat cash payments were available without documentation: up to $125 if a Social Security number was compromised, or up to $50 if it was not. Both figures were subject to pro rata reduction depending on how many valid claims came in.⁶

All class members were also eligible for two years of single-bureau credit monitoring through CyEx Identity Defense Complete at no cost. That expanded on the twelve months of Cyberscout monitoring CRL had offered initially after the breach.⁶⁷

Current Status of the Case

Hennepin County District Court Judge Thomas Conley granted preliminary approval on October 30, 2025, and final approval on February 25, 2026, finding the settlement “fair, reasonable, and adequate.” No one filed a timely objection. Twenty-six individuals opted out. The case, In re Consulting Radiologists Data Incident Litigation, Case No. 27-CV-24-9850, was dismissed with prejudice, though the court retained jurisdiction to enforce the settlement terms.¹

Payments will be issued to class members with approved claims after all appeals and reviews are completed. Late claims are not accepted; the March 2, 2026, deadline has passed.²

How the Breach Happened

CRL detected suspicious activity on its network on February 12, 2024, and a third-party cybersecurity firm confirmed that an unauthorized party had accessed a server holding patient information. The investigation identified affected individuals by April 17, 2024. CRL reported the breach to the HHS Office for Civil Rights and to the attorneys general of California and Maine on June 14, 2024.⁸⁴

CRL’s own notice did not describe the attack, but two ransomware groups, LockBit and Qilin, publicly claimed responsibility on April 27, 2024. Qilin said it had taken more than 94,000 files totaling roughly 70 gigabytes. Whether a ransom was demanded or paid has not been publicly disclosed.⁹¹⁰

The first lawsuit, Johnson v. Consulting Radiologists, Ltd., was filed on June 28, 2024, alleging negligence, breach of implied contract, breach of fiduciary duty, unjust enrichment, and violations of the Minnesota Consumer Fraud Act and the Minnesota Health Records Act. Eighteen more complaints followed and were consolidated in Hennepin County District Court in August 2024. After the court allowed several claims to proceed, the parties mediated and settled.¹¹³

Questions About Your Claim

Class members with questions about a filed claim or an expected payment can reach the settlement administrator by phone at 1-844-484-4231 or by email at Info@CRDataSettlement.com.²

1
Angeion Group. Order for Final Approval – In Re Consulting Radiologists Data Incident Litigation
2
CRDataSettlement.com. Settlement FAQs
3
HIPAA Journal. Consulting Radiologists Data Breach Settlement
4
Minnesota Lawyer. Consulting Radiologists Data Breach Settlement
5
Angeion Group. Long Form Notice – In Re Consulting Radiologists Data Incident Litigation
6
ClassAction.org. $2.2M Consulting Radiologists Settlement Ends Litigation Over February 2024 Data Breach
7
Montana Department of Justice. Consumer Notification Letter – Consulting Radiologists
8
HIPAA Journal. Consulting Radiologists Data Breach
9
Comparitech. Minnesota X-Ray Company Notifies Half a Million People of Data Breach
10
SC World. LockBit, Qilin Claimed Consulting Radiologists Hack Affects Over 500K
11
ClassAction.org. Data Breach Lawsuit Says Consulting Radiologists Failed to Protect Patient Info From Hackers