Fortra File Transfer Software Breach Website

1. Why was a notice provided?

   A court authorized the Notice because Settlement Class members have the right to know about the Settlement of this class action lawsuit and about all of their rights and options before the Court decides whether to grant Final Approval of the Settlement. The Notice explains the lawsuit, the Settlement, Settlement Class members’ legal rights, what benefits are available, who is eligible for the benefits, and how to get them.

   The Honorable Rodolfo A. Ruiz, II of the United States District Court for the Southern District of Florida is overseeing this class action. The lawsuit is known as In re Fortra File Transfer Software Data Security Breach Litigation, Case No. 24-md-03090-RAR (“lawsuit”). The individuals who filed this lawsuit are called the “Plaintiffs” and/or “Class Representatives” and the companies sued are Aetna, Inc. and Aetna Life Insurance Company (collectively “Aetna”), Brightline, Inc. (“Brightline”), Community Health Systems and CHSPSC, LLC (collectively “Community Health”), Elevance Health, Inc. and Anthem Insurance Companies (collectively “Elevance Health”), Fortra, LLC (“Fortra”), Imagine360, LLC (“Imagine360”), Intellihartx, Inc. (“Intellihartx”), NationsBenefits LLC and NationsBenefits Holdings, LLC (collectively “NationsBenefits”), and Santa Clara Family Health Plan (“Santa Clara”) ( “Defendants”).

   Back To Top
2. What is this lawsuit about?

   The Plaintiffs filed this lawsuit against Defendants in connection with the unauthorized access to or acquisition of over approximately five million individuals’ Private Information, which includes some combination of: names, addresses, dates of birth, member identification numbers, telephone numbers, employer names, Social Security numbers, start and end dates of health plan coverage, and health insurance information that were being stored within the Defendants’ respective instances of the Fortra GoAnywhere MFT at the time of the Data Incident. The Plaintiffs allege Fortra reported to its customers – Aetna, Community Health, Elevance Health, Hatch Bank, Imagine360, Intellihartx, NationsBenefits, and Santa Clara – that in January of 2023, as a result of the Data Incident, there was or may have been unauthorized access to or acquisition of Settlement Class members’ Private Information as a result of unauthorized access to Defendants’ respective instances of the Fortra GoAnywhere MFT (which each of the Defendants used directly or indirectly). The Plaintiffs brought this lawsuit against Defendants.

   Plaintiffs also allege negligence, negligence per se, breach of fiduciary duty, breach of implied contract, breach of contract third party beneficiary, unjust enrichment, and violations of various states’ consumer protection statutes by Defendants.

   Defendants deny the legal claims and deny any wrongdoing or liability. The Court has not made any determination of any wrongdoing by Defendants or that any law has been violated. Instead, the Plaintiffs and Defendants have agreed to a settlement to avoid the risk, cost, and time of continuing the lawsuit.

   Back To Top
3. Why is there a settlement?

   In a class action, one or more people (called class representatives) sue on behalf of all people who have similar legal claims. Together, all these people are called a class or class members. One court resolves the issues for all class members, except for those class members who timely exclude themselves (opt-out) from the class.

   Back To Top
4. Why is this lawsuit a class action?

   The Plaintiffs and Defendants do not agree about the legal claims made in this lawsuit. The lawsuit has not gone to trial, and the Court has not decided in favor of the Plaintiffs or Defendants. Instead, the Plaintiffs and Defendants have agreed to settle the lawsuit. The Class Representatives, Defendants, and their lawyers believe the Settlement is best for the Settlement Class because of the Settlement Class Member Benefits available and the risks and uncertainty associated with continuing the lawsuit.

   Back To Top

WHO IS INCLUDED IN THE SETTLEMENT?

5. How do I know if I am part of the Settlement?

   You are included in the Settlement Class if you are a living individual residing in the United States and were sent notice of the Data Incident indicating your Private Information may have been impacted in the Data Incident. You may have received notice of the Data Incident around May 2023.

   You were/are a customer of or do/did business with Aetna, Brightline, Community Health, Elevance Health, Hatch Bank, Imagine360, Intellihartx and/or Santa Clara, and at one time gave your Private Information to one of those Defendants. Community Health, Imagine360, Intellihartx, and NationsBenefits all did business directly with Fortra, while Aetna, Elevance Health, and Santa Clara did business directly with NationsBenefits. If you were/are a customer of or do/did business with Aetna, Community Health, Elevance Health, Hatch Bank, Imagine360, Intellihartx, and/or Santa Clara, your Private information may have been impacted in the Data Incident and you may be a Settlement Class member and a member of that Defendant’s Settlement Subclass defined hereinbelow. Hatch Bank is not a Defendant in the lawsuit; however, Hatch Bank’s customers’ Private Information was impacted in the Data Incident and therefore if you were/are a customer of Hatch Bank your Private Information may also have been impacted in the Data Incident and you too may be a Settlement Class member. The Settlement subclass you are in will impact the releases you will be giving if you remain a Settlement Class Member.

   Aetna Settlement Subclass includes all living individuals residing in the United States who were sent a notice of the Data Incident from, or on behalf of, Defendant Aetna indicating their Private Information may have been impacted in the Data Incident.

   Brightline Settlement Subclass includes all living individuals residing in the United States who were sent a notice of the Data incident from, or on behalf of, Defendant Brightline indicating their Private Information may have been impacted in the Data Incident.

   Community Health Settlement Subclass includes all living individuals residing in the United States who were sent a notice of the Data Incident from, or on behalf of, Defendant Community Health indicating their Private Information may have been impacted in the Data Incident.

   Elevance Health Settlement Subclass includes all living individuals residing in the United States who were sent a notice of the Data Incident from, or on behalf of, Defendant Elevance Health indicating their Private Information may have been impacted in the Data Incident.

   Fortra Settlement Subclass includes all living individuals residing in the United States who were sent a notice of the Data Incident indicating their Private Information may have been impacted in the Data Incident. The Fortra Settlement Subclass is comprised of all members of the Settlement Class, including the NationsBenefits Settlement Subclass, the Aetna Settlement Subclass, Brightline Settlement Subclass, Community Health Settlement Subclass, Elevance Health Settlement Subclass, Imagine360 Settlement Subclass, Intellihartx Settlement Subclass, the Santa Clara Settlement Subclass, and Hatch Bank Settlement Subclass.

   Hatch Settlement Subclass includes all living individuals residing in the United States who were sent a notice of the Data Incident from, or on behalf of, Hatch Bank indicating their Private Information may have been impacted in the Data Incident.

   Imagine360 Settlement Subclass includes all living individuals residing in the United States who were sent a notice of the Data Incident from, or on behalf of, Defendant Imagine360 indicating their Private Information may have been impacted in the Data Incident.

   Intellihartx Settlement Subclass includes all living individuals residing in the United States who were sent a notice of the Data Incident from, or on behalf of, Defendant Intellihartx indicating their Private Information may have been impacted in the Data Incident.

   NationsBenefits Settlement Subclass includes all living individuals residing in the United States who were sent a notice of the Data Incident from, or on behalf of, Defendant NationsBenefits indicating their Private Information may been impacted in the Data Incident.

   Santa Clara Settlement Subclass includes all living individuals residing in the United States who were sent a notice of the Data Incident from, or on behalf of, Defendant Santa Clara indicating their Private Information may have been impacted in the Data Incident.

   Back To Top
6. Are there exceptions to being included in the Settlement?

   Yes. Excluded from the Settlement Class are: (1) all persons who are directors and officers of Defendants, or their respective subsidiaries and affiliated companies; (2) governmental entities; (3) the Judge assigned to the lawsuit, the Judge’s immediate family, and Court staff; and (4) all Settlement Class members who submit a valid Request for Exclusion prior to the opt-out Deadline.

   Back To Top
7. What if I am still not sure whether I am part of the Settlement?

   If you are still not sure whether you are a Settlement Class member, you may review the Documents page for more information or call toll-free 1-888-820-3075.

   Back To Top

Who Is Included In The Settlement?

8. What does the Settlement provide?

   ALL SETTLEMENT CLASS MEMBERS EXCEPT BRIGHTLINE SETTLEMENT SUBCLASS MEMBERS

   If you are a Settlement Class Member (other than a Brightline Settlement Subclass Member) and you submit a timely and valid Claim Form, you may be eligible to receive the following Settlement Class Member Benefits:

   Cash Payment A – Documented Losses:

   You may submit a Claim Form with reasonable documentation for losses related to the Data Incident for up to $5,000 per Settlement Class Member.

   Examples of expenses incurred as a result of the Data Incident, include (without limitation) bank fees, long distance phone charges, cell phone charges (only charged by the minute), data charges (only if charged based on the amount of data used), postage, gasoline for local travel and fees for credit reports, credit monitoring, or other identity theft insurance products purchased between January 30, 2023, and the date of the Claim Form Deadline.

   Examples of reasonable documentation include (but are not limited to): telephone records, correspondence including emails, or receipts. Personal certifications, declarations, or affidavits from the Settlement Class Member do not constitute reasonable documentation but may be included to provide clarification, context, or support for other submitted reasonable documentation. You will not be reimbursed for expenses if you have been reimbursed for the same expenses by another source.

   If you do not submit reasonable documentation supporting a loss, or if your Claim Form is invalid as determined by the Settlement Administrator, and you do not cure your Claim Form, your Claim Form will be denied and your Claim Form for Cash Payment A will instead be processed as if you elected Cash Payment B.

   Cash Payment B – Alternative Cash Payment:

   Instead of selecting Cash Payment A, without providing documentation, you may submit a Claim Form to receive a cash payment in the estimated amount of $85.

   Dark Web Monitoring:

   In addition to Cash Payment A or Cash Payment B, you may also submit a Claim Form to receive the CyEx Identity Defense Plus Dark Web Monitoring product. The Dark Web Monitoring product includes one year of: (i) real time authentication alerts; (ii) dark web scanning; (iii) high risk transaction monitoring; (iv) wallet protection; (v) victim assistance; and (vi) customer support.

   Pro Rata Adjustments to Cash Payments:

   Cash B – Alternative Cash Payments may be subject to a pro rata (a legal term meaning equal share) adjustment increase from the Settlement Fund if the amount of timely and valid Claim Forms does not use the entire Net Settlement Fund. Alternatively, if the amount of timely and valid Claim Forms exceeds the amount of the Net Settlement Fund, your Cash B – Alternative Cash Payments may be subject to a pro rata reduction. The adjustment will be based upon the number and amount of Valid Claims received by the Settlement Administrator. Payments will first go to pay the cost of Dark Web Monitoring, then to Cash Payment A – Documented Losses, and then to Cash Payment B – Alternative Cash Payments.

   BRIGHTLINE SETTLEMENT SUBLCASS MEMBERS

   • If you are a Brightline Settlement Subclass member, you may file a Claim Form for the above Settlement Class Member Benefits only if you did not submit a claim and receive benefits in the Brightline Settlement, or you were not fully compensated by the Brightline Settlement. The Brightline Settlement was a settlement involving some of the claims in this case arising out of the Data Incident. The Brightline Settlement was approved by the Court, and you were previously given an opportunity to submit a claim for benefits.
   • If you are a Brightline Subclass Settlement member who submitted a claim in the Brightline Settlement, and you received benefits from that settlement, you may only Claim benefits from this Settlement to the extent you were not fully compensated for your damages in the Brightline Settlement. This means that you either selected Cash Payment A in the Brightline Settlement and your documented losses exceeded the compensation received from the Settlement, or you elected to receive Cash Payment B (flat payment) under the Brightline Settlement, but you have incurred Documented Losses after the date your claim was filed in the Brightline Settlement.
   • If you submitted a claim in the Brightline Settlement for Cash Payment A, but have incurred additional losses since the date you filed the claim, you are entitled to make a claim for Cash Payment A – Documented Losses Cash Payment up to a maximum of $5,000, upon presentment of Documented Losses related to the Data Incident that are in excess of the amounts received under Cash Payment A from the Brightline Settlement. If you submitted a claim for Cash Payment B (flat cash) in the Brightline Settlement, you may only submit a Claim for Cash Payment A – Documented Losses in this Settlement for Documented Losses incurred after the date of the Brightline Settlement claim was filed.
   • All Brightline Settlement Subclass Member Cash Payments shall be subject to the same pro rata adjustments as above.
   • Brightline Settlement Subclass members who did not make a claim for Credit Monitoring (as defined in the Brightline Settlement) may make a claim for Dark Web Monitoring in this Settlement.

   Injunctive Relief:

   Defendants have implemented or are implementing additional security measures following the Data Incident.

   Back To Top
9. What am I giving up to receive settlement benefits or stay in the Settlement Class?

   If you are a member of the Settlement Class, unless you opted-out of the Settlement you are bound by the Final Approval Order. As a result you have released the claims enumerated in Section XIV of the Settlement Agreement. The Agreement can be found on the Documents page.

   Back To Top
10. What are the Released Claims?

    Section XIV of the Settlement Agreement describes the Released Defendants and the Released Parties from the Released Claims, in necessary legal terminology. As these definitions and terms vary for each Defendant and associated Settlement Subclass, as well as for non-defendant Hatch, please read this section in the Settlement Agreement carefully. The Settlement Agreement is available on the Documents page.

    • The Aetna Settlement Subclass releases the Aetna Released Parties, the NationsBenefits Released Parties, and the Fortra Released Parties.
    • The Brightline Settlement Subclass releases the Fortra Released Parties.
    • The Elevance Health Settlement Subclass releases the Elevance Health Released Parties, the NationsBenefits Released Parties, and the Fortra Released Parties.
    • The Community Health Settlement Subclass releases the Community Health Released Parties and the Fortra Released Parties.
    • The Hatch Bank Settlement Subclass releases the Fortra Released Parties.
    • The Imagine360 Settlement Subclass releases the Imagine360 Released Parties and the Fortra Released Parties.
    • The Intellihartx Settlement Subclass releases the Intellihartx Released Parties and the Fortra Released Parties.
    • The NationsBenefits Settlement Subclass releases the NationsBenefits Released Parties and the Fortra Released Parties.
    • The Santa Clara Settlement Subclass releases the Santa Clara Released Parties, the NationsBenefits Released Parties, and the Fortra Released Parties.

    For questions regarding the Releases or Released Claims and what the language in the Settlement Agreement means, you can also contact Class Counsel listed below for free, or you can talk to your own lawyer at your own expense.

    Back To Top

How To Get Benefits From The Settlement

11. How do I submit a Claim Form to receive settlement benefits?

    The claim filing deadline has passed and the Settlement is final. It is no longer possible to file a claim.

    Back To Top
12. What happens if my contact information changes after I submit a Claim Form?

    If you change your mailing address or email address after you submit a Claim Form, it is your responsibility to inform the Settlement Administrator of your updated information. You may notify the Settlement Administrator of any changes by writing to:

    In re Fortra Data Breach Litigation
    Settlement Administrator
    P.O. Box 5569
    Portland, OR 97228-5569

    Back To Top
13. When will I receive my settlement benefits?

    Claimants whose digital payment failed or selected a check from their digital payment email were sent checks on May 29, 2026.

    Back To Top

Exclude Yourself Or Opt-Out Of The Settlement

If you are a Settlement Class Member and want to keep any right you may have to sue or continue to sue the Released Defendants and the Released Parties about the Released Claims in this lawsuit on your own, then you must take steps to get out of the Settlement. This is called excluding yourself from—or “opting-out” of—the Settlement.

14. How do I opt out of the Settlement?

    The opt-out deadline has passed and the Settlement is final. It is no longer possible to opt-out.

    Back To Top

Objecting To The Settlement

15. How do I tell the Court that I do not like the Settlement?

    The objection deadline has passed and the Settlement is final. It is no longer possible to object.

    Back To Top

The Lawyers Representing You

16. Do I have a lawyer in the lawsuit?

    Yes. The Court has appointed Jeff Ostrow, John Yanchunis, and James E. Cecchi as Lead Counsel and Class Counsel and Bryan Bleichner, Brian Gudmundson, Ben Barnow, Sabita Soneji, Stuart Davidson, Ian Sloss Maureen Brady, Benjamin Johns, Mason Barney, William Federman, and Nicholas Colella as Class Counsel to represent you and the Settlement Class and the Settlement Subclasses for the purposes of this Settlement. You may hire your own lawyer at your own cost and expense if you want someone other than Class Counsel to represent you in this lawsuit.

    Back To Top
17. How will Class Counsel be paid?

    The Settlement is final. Details of the fees and costs awarded to Class Counsel can be found in the Final Approval Order on the Documents page of this website.

    Back To Top

THE FINAL APPROVAL HEARING

18. When and where will the Court decide whether to approve the Settlement?

    The Court held a final approval hearing in September, 2025. After that, it approved the Settlement and declared it to be final. Details of the Court's decision can be found in the Final Approval Order on the Documents page of this website.

    Back To Top
19. How do I get more information about the Settlement?

    This website summarizes the Settlement. Complete details about the Settlement are provided in the Settlement Agreement. The Settlement Agreement and other related documents are available on the Documents page of this website. You may get additional information by calling toll-free 1-888-820-3075, or by writing to:

    In re Fortra Data Breach Litigation
    Settlement Administrator
    P.O. Box 5569
    Portland, OR 97228-5569

    PLEASE DO NOT TELEPHONE THE COURT OR THE COURT’S CLERK OFFICE REGARDING THIS SETTLEMENT.

    Back To Top