DCHBX Data Incident Settlement

The Court authorized the Notice to inform you about a proposed Settlement with Defendant. The case is called Lawless v. District of Columbia Health Benefit Exchange Authority, d/b/a DC Health Link, Case No. 2023-CAB-001569. You have legal rights and options that you may act on before the Court decides whether to approve the proposed Settlement. The Notice explains the lawsuit, the Settlement, and your legal rights. A SUPPLEMENTAL NOTICE HAS BEEN ORDERED BY THE COURT TO PROVIDE CLASS MEMBERS ADDITIONAL TIME TO TAKE ACTION IN RESPONSE TO THE SETTLEMENT. NO OTHER TERMS OF THE SETTLEMENT HAVE BEEN ALTERED.

A class action is a lawsuit in which one or more plaintiffs—in this case, including related cases in federal court, Plaintiff and Class Representatives Rory Lawless, Jenni Suhr, Pretial Caston, Austin Dressman, John Eborall, Keven Hammond, Taylor Heath, Shirley Huang, Kathleen McAteer, Angelo Merenda, Matthew Oginsky, and Catherine Sanders—sue on behalf of a group of people who have similar claims. Together, this group is called a “Class” and consists of “Class Members.” In a class action, the court resolves the issues for all class members, except those who exclude themselves from the class.

Plaintiff claims that Defendant failed to implement and maintain reasonable security measures to adequately protect the Private Information in its possession and to prevent the Data Incident from occurring.

Defendant denies that it is liable for the claims made in the lawsuit and denies all allegations of wrongdoing.

The Court has not decided whether the Plaintiff or Defendant should win this case. Instead, both sides agreed to this Settlement. That way, they can avoid the uncertainty, risks, and expense of ongoing litigation, and Settlement Class Members will be eligible to get compensation now rather than years later—if ever. The Class Representatives and attorneys for the Settlement Class Members, called Class Counsel, agree the Settlement is in the best interests of the Settlement Class Members. The Settlement is not an admission of wrongdoing by the Defendant.

You are part of the Settlement as a Settlement Class Member if you received a notification letter from Defendant stating that your Private Information was or may have been compromised in the Data Incident.

Settlement Class Members will have been mailed notice of their eligibility.

This Settlement Class does not include (1) the Judge presiding over this Action, and members of their direct families; (2) Defendant, and its current and former officers and directors; and (3) Settlement Class Members who submit a valid Request for Exclusion prior to the Opt-Out Deadline.

Under the proposed Settlement, Defendant will pay (or cause to be paid) $1,450,000.00 into a Settlement Fund. The Settlement Fund, plus interest accrued thereon, will pay notice and administration costs, Court-approved attorneys’ fees and costs, Court-approved service awards for class representatives, and certain Settlement Fund taxes and tax expenses (the “Net Settlement Fund”). The Net Settlement Fund will be used to provide eligible Settlement Class Members with payments and benefits described below.

Group 1 and Group 2 Settlement Class Members may claim reimbursement of actual documented monetary losses. Alternatively, Group 1 and Group 2 Settlement Class Members may elect to collect an “Alternative Cash Payment”, which (if selected) is offered in lieu of all other monetary relief and credit monitoring benefits. The Alternative Cash Payments will be differently calculated depending on whether the claimant is a Group 1 or Group 2 Settlement Class Member. Group 1 and Group 2 Settlement Class Members may also claim Credit Monitoring and Identity Restoration Services, if they have not previously accepted DCHBX’s credit monitoring offer.

Reimbursement of Documented Monetary Losses: Settlement Class Members may claim reimbursement for associated monetary loss by submitting a claim along with supportive documentation (“Documented Monetary Loss”).

Group 1 Settlement Class Members may claim Documented Ordinary Losses and Documented Extraordinary Losses, as defined below, which loss must be fairly traceable to the Data Incident, and combined will be capped at $10,000 per Group 1 Settlement Class Member.

Group 2 Settlement Class Members may claim Documented Ordinary Losses, which loss must be fairly traceable to the Data Incident and will be capped at $2,500 per Group 2 Settlement Class Member.

1. Documented Ordinary Losses: Group 1 and Group 2 Settlement Class Members may submit a claim for documented out-of-pocket expenses fairly traceable to the Data Incident, up to $2,500 per individual. Documented Ordinary Losses may include various types of out-of-pocket losses that were incurred on or after March 5, 2023, through the date of claim submission: credit monitoring costs, unreimbursed bank fees, long distance phone charges, postage, or gasoline for local travel. This list of reimbursable documented out-of-pocket expenses is not meant to be exhaustive, rather it is exemplary. Settlement Class Members may make claims for any documented unreimbursed out-of-pocket losses reasonably related to the Data Incident or to mitigating the effects of the Data Incident. The Settlement Administrator shall have discretion to determine whether any claimed loss is reasonably related to the Data Incident.
2. Documented Extraordinary Losses: Group 1 Settlement Class Members are eligible for compensation for extraordinary losses resulting from the Data Incident, up to a maximum of $10,000 in combination with any claimed Documented Ordinary Loss per individual. The Claim Form and supporting documentation must demonstrate that: (i) the loss is an actual, documented, and unreimbursed monetary loss; (ii) the loss was more likely than not caused by the Data Incident; (iii) the loss occurred between March 5, 2023, and the date of claim submission; (iv) the loss is not already covered by one or more of the normal reimbursement categories; (v) the claimant made reasonable efforts to avoid the loss or seek reimbursement for the loss, including, but not limited to, exhaustion of all available credit monitoring insurance and identity theft insurance. Extraordinary Losses may include, without limitation, the unreimbursed costs, expenses, losses or charges incurred as a result of identity theft or identity fraud, falsified tax returns, or other possible misuse of private information. To receive reimbursement for any Documented Extraordinary Loss, Group 1 Settlement Class Members must submit supporting documentation of the loss and a description of how the loss is fairly traceable to the Data Incident, if not readily apparent from the documentation.

OR

Alternative Cash Payment: In lieu of claiming reimbursement of Documented Monetary Losses, Group 1 and Group 2 Settlement Class Members may make a claim for an Alternative Cash Payment that will be calculated pro rata according to whether the claimant is a Group 1 or Group 2 Settlement Class Member. Group 1 Alternative Cash Payments shall be three times (3x) the amount of Group 2 Alternative Cash Payments. The payments shall be calculated by dividing remaining funds in the Settlement Fund, after payment of Settlement Administration Fees, Attorneys’ Fees Costs and Expenses, Credit Monitoring and Identity Restoration Services, and Documented Monetary Losses, by the number of eligible claims. In making this calculation, each Group 1 Alternative Cash Payment claim will be counted as three claims, while each Group 2 Alternative Cash Payment claim will be counted as one claim.

AND

Credit Monitoring and Identity Restoration Services: The Settlement Administrator, from the Settlement Fund, will purchase/provide credit monitoring codes for one year of three-bureau monitoring, including $1 million of identity theft insurance, to valid claimants, provided they have not enrolled in the credit monitoring services previously offered by DCHBX.

To qualify for a cash benefit under the Settlement, or to request credit monitoring services, you must complete and submit a Claim Form.

The Claim Filing Deadline was May 13, 2025. Claim Forms are no longer accepted.

Settlement payments were issued on September 2, 2025.

Yes, the Court has appointed Mason LLP and The Lyon Firm as “Class Counsel” to represent you and all Settlement Class Members. You will not be charged for these lawyers. You can ask your own lawyer to appear in Court for you at your own expense if you want someone other than Class Counsel to represent you. If you have questions about the suit or settlement, you can reach Class Counsel below:

Class Counsel applied to the Court for an award of attorneys’ fees and costs to compensate them for their legal services and expenses incurred in this matter as well as $2,500 Service Awards to each of the twelve Class Representatives. The Court approved the fee award of $494,529.43, inclusive of expenses and costs, which was paid out of the Settlement Fund by the Settlement Administrator.

If you do not exclude yourself from the Settlement, you will not be able to sue Defendant about the Data Incident and you will be bound by all decisions made by the Court in this case, the Settlement, and its included Release. This is true regardless of whether you submit a Claim Form. However, you may exclude yourself from the Settlement (see below). If you exclude yourself from the Settlement, you will not be bound by any of the Released Claims, which are described in the Settlement Agreement available here.

If you do nothing, you will receive no benefits under the Settlement. You will be in the Settlement Class, and if the Court approves the Settlement, you will also be bound by all orders and judgments of the Court, the Settlement, and its included Release. You will be deemed to have participated in the Settlement and will be subject to the provisions of the Settlement Agreement. Unless you exclude yourself, you won’t be able to file a lawsuit or be part of any other lawsuit against Defendant for the claims or legal issues released in this Settlement.

If you exclude yourself from the Settlement, you will receive no benefits under the Settlement. However, you will not be in the Settlement Class and will not be legally bound by the Court’s judgments related to the Settlement Class and Defendant in this class action.

The deadline to exclude yourself from the Settlement was May 13, 2025. Requests for Exclusions are no longer accepted.

No. Unless you exclude yourself, you give up any right to sue Defendant for the claims or legal issues released in this Settlement, even if you do nothing.

No. If you exclude yourself, do not submit a Claim Form to ask for any benefits.

The deadline to object to the Settlement was May 13, 2025. Objections are no longer accepted.

Objecting simply means telling the Court that you don’t like something about the Settlement. You can object only if you stay in the Settlement Class. Excluding yourself from the Settlement Class is telling the Court that you don’t want to be part of the Settlement Class. If you exclude yourself, you have no basis to object because the case no longer affects you.

The Court held the Final Approval Hearing on June 26, 2025.

At this hearing, the Court considered the Settlement fair, reasonable, and adequate and decided to approve the Settlement as well as attorneys’ fees and expenses and the Class Representative Service Awards.

The Court issued the Final Approval Order, which can be found in the Documents section of this website, on June 30, 2025.

The amount of your Settlement payment is final and represents the amount to which you were entitled under the terms of the Settlement Agreement.

For more details, please visit the Documents page of this website.

To get more information about the Settlement, you may

• call 1-888-897-40851-888-897-4085;
• email Info@DCHBXSettlement.com; or
• write to DCHBX Data Incident Settlement Administrator, c/o Epiq, P.O. Box 4710, Portland, OR 97208-4710.

PLEASE DO NOT CALL THE COURT, THE CLERK OF THE COURT, THE JUDGE, OR THE DEFENDANT WITH QUESTIONS ABOUT THE SETTLEMENT OR CLAIMS PROCESS.