FMC Services LLC has received preliminary court approval for a $2.15 million settlement to resolve a class action lawsuit related to a 2022 cyberattack and data breach involving personal and protected health information (PHI).
FMC Services LLC operates a network of primary care clinics in Amarillo and Canyon, Texas. The cyberattack was detected on July 26, 2022. A forensic investigation confirmed that exposed files contained names, addresses, birth dates, Social Security numbers, and medical information.
In compliance with HIPAA laws, the data breach was reported to the HHS Office for Civil Rights as affecting the PHI of 233,948 individuals. Notification letters were mailed to 266,540 individuals.
Class Action Lawsuit
Four individuals filed class action lawsuits following the exposure of their personal data and PHI. The lawsuits presented similar allegations and were consolidated into a single case, Sharber, et al. v. FMC Services, LLC, in the District Court of Potter County, Texas.
The consolidated complaint alleged that FMC Services had a duty to maintain reasonable and appropriate cybersecurity measures and failed to meet that duty, resulting in the cyberattack and data breach. The complaint included claims of breach of implied contract, negligence, negligence per se, breach of fiduciary duty, and unjust enrichment.
FMC Services denies wrongdoing.
Settlement Process
Discussions regarding a potential settlement began during mid-2024. Mediation at that stage did not produce an agreement on settlement terms. The litigation continued through discovery. After the plaintiffs defeated the defendant’s motion for summary judgment, the parties participated in a second mediation. That mediation resulted in agreement on the material terms of a settlement. The settlement has been finalized and has received preliminary approval from the court.
Settlement Fund and Available Benefits
Under the settlement terms, FMC Services will establish a settlement fund totaling $2,150,000. The fund will cover benefits for settlement class members, attorneys’ fees and expenses, settlement administration and notification costs, and service awards for the four class representatives.
Settlement class members may submit claims for reimbursement of documented, unreimbursed losses that resulted from the data breach. Reimbursement is available for up to $5,000 per class member.
Settlement class members who do not submit a reimbursement claim may elect to receive an alternative cash payment. The estimated payment is $75 per class member. The final amount depends on the number of valid claims submitted.
All settlement class members are also eligible to receive two years of medical data monitoring services regardless of whether they submit a reimbursement claim or choose the alternative cash payment.
Court Schedule
The deadline for objections and requests for exclusion is August 17, 2026.
Claims must be submitted by August 31, 2026.
The court has scheduled the final fairness hearing for September 15, 2026.