There is no $50 check in this settlement. Nearly every data breach settlement offers two cash routes — a flat payment you can claim on a signature, or a documented-losses tier that needs receipts. The CPAP Medical Supplies settlement has only the second one. If you kept no paper, there is no cash for you here at all. What there is, and what almost nobody claims, is two years of medical identity monitoring that costs nothing to request.
Status: Claims open | Claim deadline November 26, 2026 | Opt out or object by October 30, 2026 | $500,000 aggregate cap on cash
First: This Is Not the Philips CPAP Recall
The name collision sends a lot of people to the wrong page, so it is worth clearing before anything else.
The Philips Respironics settlement was about the machines themselves — recalled CPAP and BiPAP devices whose sound abatement foam could degrade — and it paid device owners for recall-related losses. Its claim window has closed.
This case is against CPAP Medical Supplies and Services, Inc., a separate company in the business of selling CPAP supplies, and it is about a cyberattack on that company’s computer systems in December 2024. No device is at issue. The condition of your machine is irrelevant. The test is simple: this class is defined by having been sent a data incident notice by CPAP Medical Supplies and Services. Owning a Philips machine does not put you in it, and having filed in the Philips settlement neither helps nor hurts a claim here.
What Happened
The lawsuit alleges that during a December 2024 targeted cyberattack on CPAP’s computer systems, certain files containing private information were accessed. The notice says those files may have contained names, physical addresses, email addresses, telephone numbers, Social Security numbers, driver’s license numbers, health insurance information, medical histories, treatment plans and financial information.
That is the full range — identity documents, payment data and clinical records in the same file — which is why the settlement’s monitoring benefit is a medical product rather than a credit one.
The case is Brett Conner v. CPAP Medical Supplies and Services, Inc., Case No. CACE-26-011830, in the Circuit Court for Broward County, Florida. CPAP denies that it did anything wrong, and the court has not decided who is right. The notice states that the parties agreed to settle to avoid the costs and risks, disruptions and uncertainties of continuing the litigation, and that the court did not decide whether the plaintiffs or the defendant are right. No finding of liability has been made against the company.
Who Is In the Class
The court defined the class as all living individuals residing in the United States who were sent notice by the defendant that their private information may have been impacted in the data incident. The class is nationwide even though the case sits in a Broward County courtroom — what matters is having been sent a notice, not where you live now.
Two parts of that definition do real work. The first is sent notice: the administrator built the class list from CPAP’s records, and the LoginID and PIN needed to file online are printed on that mailing, so the notice is the working signal of membership. Class members may also have received an earlier notice directly from CPAP, separate from the court-authorized one.
The second is living, which the notice does not explain. Nothing in it says how the definition applies to someone who received a notice and has since died, or whether an estate may file. For a class drawn from a home medical equipment customer list that is a real question, and it is one for the settlement administrator through the official settlement website rather than one to guess at.
Excluded are the directors, officers and agents of the defendant; governmental entities; the judge assigned to the case, that judge’s immediate family and court staff; and anyone who timely and properly opts out.
Two Benefits, and They Stack
| Documented out-of-pocket losses — up to $5,000 | Actual, documented, unreimbursed losses caused by the incident and incurred between December 13, 2024 and November 26, 2026, supported by proof such as bank statements or receipts. |
| Medical data monitoring — two years | CyEx Medical Shield Complete, with $1 million of medical identity theft insurance. No documentation is required to claim it. |
There is no alternate cash payment, no flat amount and no pro rata share of a common fund payable on a sworn statement alone. That shape changes the arithmetic of whether to bother filing. On a settlement with a $50 or $75 no-proof tier, the flat payment is the floor and the documented route is the upside. Here the floor is the monitoring, and the cash is available only to the subset of the class who kept paper.
You Probably Have a Documented Loss and Do Not Know It
The covered expense list is broader than people assume, and it is worth reading before concluding there is nothing to claim. The notice lists losses because of identity theft or fraud; fees for credit reports, credit monitoring, or freezing and unfreezing your credit; the cost to replace your IDs; and postage to contact banks by mail.
Anyone who bought their own monitoring subscription after the notice arrived, or paid a bureau to freeze their credit, already has a documented loss. Expenses already reimbursed by a third party cannot be claimed.
The $5,000 is a ceiling, not an estimate, and it sits under a second ceiling that matters more: the notice sets a maximum of $500,000 payable by CPAP for the documented-loss benefit, and says that if the total dollar amount of all valid claims exceeds that amount, distribution amounts are reduced pro rata. Treat the cap as the real number to plan around and the $5,000 as the per-person limit.
The Monitoring Is the Benefit Most Likely to Go Unclaimed
CyEx Medical Shield Complete is not ordinary credit monitoring. It watches for healthcare insurance ID exposure, Medical Record Number exposure and unauthorized Health Savings Account spending, and puts a fraud resolution agent on the line if something surfaces.
That is aimed squarely at the risk in a file that held health insurance details and treatment plans: medical identity theft, where someone else’s care gets billed to your policy and lands in your records. Three-bureau credit monitoring does not watch for that. And critically — unlike some breach settlements where monitoring arrives automatically with an enrollment code — you have to file a claim to get it. Nothing in the notice describes a separate enrollment route.
Nothing Is Deducted From What You Receive
There is no common settlement fund. The notice discloses no total settlement amount, and the $500,000 documented-loss cap is the only aggregate figure in it.
Class counsel will ask the court to approve $400,000 as reasonable attorneys’ fees and reimbursement of litigation costs, plus service award payments of $1,000 for each class representative, and the notice states that both amounts will be paid by CPAP. The court appointed Jeff Ostrow of Kopelowitz Ostrow P.A. and Mariya Weekes of Milberg PLLC as class counsel.
On a common-fund settlement, fees and service awards come off the top of a fixed pot before any claimant is paid, which is why so many advertised flat payments shrink later. Nothing here is deducted from what a class member gets. The one thing that can still reduce a payment is the $500,000 cap.
Filing Online Needs a LoginID and PIN
The claim form login screen requires the LoginID and PIN printed on the notice mailed to you, which is why this settlement is proof-required even though the monitoring benefit asks for no documentation at all.
The paper route is looser: the same site hosts a downloadable claim form that can be printed, completed and returned by email or by mail with supporting documentation. That is a real path for someone whose notice went astray, but it is an envelope rather than an open online door. Anyone missing their credentials can request them through the official settlement website by giving a full name and mailing address.
Past that credential, the documentation burden splits by benefit. The monitoring needs nothing beyond the claim form. The documented tier needs third-party proof, and carries a limit worth reading twice: notes or papers you made yourself are not enough on their own. The notice says they can explain or support other proof but cannot carry a claim by themselves.
The Four-Week Trap in the Calendar
| October 30, 2026 | Opt out. A written Request for Exclusion must be postmarked by this date, carrying the case name and number, your full name, mailing address, telephone number and email address, your personal signature, and the words “Request for Exclusion” or a clear equivalent. You may exclude only yourself. |
| October 30, 2026 | Object. A complete objection must be filed with the Clerk of Court by this date, with copies to the settlement administrator, class counsel and counsel for the defendant. |
| November 26, 2026 | Submit a claim — online, by email, or postmarked. |
| December 1, 2026, 8:30 a.m. ET | Final approval hearing, held by Zoom. |
The four-week gap between the exclusion deadline and the claim deadline is the trap. Someone who reads the notice in mid-November can still file, but the decision to leave the class and keep the right to sue on their own has already been made for them by the calendar. Objecting does not cost you the money — an objector stays in the class and can still file a claim — while opting out means no settlement benefits at all.
Objecting demands considerably more than an opinion. Beyond the case details and your own contact information, the notice requires all grounds for the objection with any legal support; the identity of every lawyer representing you, including any who may be paid in connection with the objection; a count of how many times you have objected to a class action settlement in the preceding five years, with the caption of each case and copies of any orders ruling on them; the same five-year history for your counsel and their firm; whether you or your counsel will appear or testify; a list of witnesses; your own physical signature, which an attorney’s signature cannot substitute for; and one requirement newer than most settlement notices — a statement confirming whether you or your counsel used any form of artificial intelligence in preparing the objection.
What the Release Covers
Staying in the class means you cannot sue CPAP over the claims this settlement resolves. The settlement agreement’s releases section defines released claims broadly: every claim, known or unknown, accrued or unaccrued, fixed or contingent, under any federal, state, local, statutory or common law, arising out of or relating to the facts, events, acts, disclosures, statements, omissions or failures to act relating to the data incident. The released parties reach past the company to its affiliates, divisions, employees, members, providers, partners, principals, directors, officers and owners, and their attorneys, insurers, predecessors, successors, agents and assigns.
A release written that way covers harm you have not found yet. A fraudulent medical bill that surfaces in 2029 and traces back to this incident is released now, before anyone knows about it.
Doing nothing does not avoid the release. A class member who never files still gives up those claims and is still bound by the court’s orders — they simply receive nothing in exchange. The only way to keep the right to sue CPAP individually is to opt out by October 30, 2026, which forfeits the cash and the monitoring alike. Given that the monitoring requires no documentation at all, doing nothing is the one option with no upside.
What Happens Next
At the December 1, 2026 hearing the court will decide whether to approve the settlement, will rule on how class counsel should be paid and on the service award payments, and will consider any timely objections. Nobody is required to attend. The notice warns that the date and time may change without further notice, with any change posted on the settlement website.
If approval is granted, there may be appeals. The notice says plainly that it is not known whether appeals will be filed or how long they would take, and that settlement payments are distributed only if the court grants final approval and after any appeals are resolved. No payment date has been announced, and a hearing being held is not the same as approval being granted.
How to File
Claims go through the official settlement website, CPAPDataIncidentSettlement.com, administered by Simpluris, Inc. Log in with the LoginID and PIN from your notice, claim the two years of medical data monitoring, and if you have documented losses, itemize them and attach the supporting paper. Both benefits are claimed on the same form; claiming the monitoring does not cost you the cash or the other way round. Keep a copy of whatever you submit. Filing is free.
Frequently Asked Questions
Is there a flat cash payment I can claim without receipts?
No, and that is the main thing separating this settlement from most data breach settlements. The notice describes exactly two benefits: two years of medical data monitoring, and a cash payment for documented losses of up to $5,000. There is no alternate cash payment, no flat amount and no pro rata share of a fund available on a sworn statement alone. A class member with no documented out-of-pocket losses can still claim the monitoring, but there is no cash route that does not require proof.
Is this the same as the Philips Respironics CPAP recall settlement?
No. Different company, different case, different kind of claim. The Philips Respironics settlement was about recalled CPAP and BiPAP machines whose sound abatement foam could degrade, and its claim window has closed. This case is against CPAP Medical Supplies and Services, Inc., a separate company that sells CPAP supplies, and it is about a December 2024 cyberattack on its computer systems. This class is defined by having been sent a data incident notice by CPAP Medical Supplies and Services.
Do I have to file a claim to get the two years of medical monitoring?
Yes. The settlement website and the notice both state that the only way to receive benefits or payments from this settlement is by submitting a valid and timely claim form, and the notice’s answer on doing nothing says a class member who does nothing will not receive a benefit. Nothing in the notice describes a separate enrollment code mailed for the monitoring, so the claim form is the route to both benefits. Claiming the monitoring requires no documentation.
What counts as documentation for a claim up to $5,000?
Third-party paper showing what you spent or lost, such as bank statements or receipts, and showing that the expense was because of the data incident. The notice says notes or papers you made yourself can explain or support other proof but are not enough on their own to make a valid claim. Expenses already reimbursed by a third party cannot be claimed, and the losses must have been incurred between December 13, 2024 and November 26, 2026.
What happens if the documented-loss claims add up to more than $500,000?
Everyone’s payment is cut proportionally. The notice sets a maximum of $500,000 payable by CPAP for the documented-loss benefit and states that if the total dollar amount of all valid claims exceeds that amount, class members’ distribution amounts are reduced pro rata. The $5,000 figure is a per-person ceiling rather than a promise. The medical monitoring is not described as subject to that cap.
How is CyEx Medical Shield Complete different from credit monitoring?
It is medical identity monitoring rather than credit monitoring. The notice says it comes with $1 million of medical identity theft insurance and monitors for healthcare insurance ID exposure, Medical Record Number exposure, and unauthorized Health Savings Account spending, with a fraud resolution agent available if something surfaces. That is aimed at the specific risk in a file holding health insurance details and medical histories: someone else’s care being billed to your policy and ending up in your records, which ordinary credit monitoring does not watch for.
The class is defined as living individuals. Can an estate file for someone who has died?
The notice does not say. The court defined the class as all living individuals residing in the United States who were sent notice that their private information may have been impacted, and neither the notice nor the settlement website explains how that applies to someone who received a notice and has since died, or whether an estate or personal representative may file. That is a question to put to the settlement administrator directly through the official settlement website.
Sources
- Official settlement website — CPAPDataIncidentSettlement.com, including its home, FAQ, important documents, important dates and claim form login pages. Administered by Simpluris, Inc.
- Notice of Proposed Class Action Settlement, Brett Conner v. CPAP Medical Supplies and Services, Inc., Case No. CACE-26-011830 (Fla. Cir. Ct., Broward Cnty.).
- Settlement Agreement and Release, Section X (Releases), same case.
- Federal Trade Commission — IdentityTheft.gov recovery steps.
- U.S. Department of Health and Human Services — health information privacy for individuals.
- OpenClassActions.com — CPAP Medical Data Breach Settlement.
Source and credit: the settlement terms, deadlines and benefit tiers described above are drawn from our sister site’s reporting — OpenClassActions.com: CPAP Medical Data Breach Settlement — Up to $5,000 — which tracks this case against the court-approved notice and the official settlement website and is updated as the court rules.
Legal Disclaimer
This article is for informational purposes only and is not legal advice. OpenClassActions.org is a consumer news site, not a law firm and not the settlement administrator, and is not affiliated with any party to the case described. The allegations are allegations; the defendants deny wrongdoing and no court has decided the merits. Deadlines, benefit amounts and payment timing can change as the court and the administrator act, so confirm current status on the official settlement website. You never need to pay anyone to file a claim or to receive a settlement payment.