Settlement With Revenue Cycle Vendor Stems From Qilin Gang Attack Affecting 627,000 Patients
In a significant development within the realm of data privacy and cybersecurity, ApolloMD Business Services, a prominent revenue cycle management firm, has agreed to a settlement of over $4 million. This decision is a direct consequence of proposed class action litigation arising from a data breach incident attributed to the Qilin ransomware group, which resulted in the exposure of sensitive data affecting nearly a dozen physician practices and a staggering 627,000 patients.
The breach, which occurred in May 2025, has prompted concerns about the robustness of cybersecurity measures adopted by third-party vendors, particularly in the healthcare industry. The Qilin gang asserted responsibility for the attack, declaring it had successfully exfiltrated 238 gigabytes of ApolloMD’s data, emphasizing the significant risk posed by such cybercriminal actors in today’s digital landscape.
Under the conditions of the proposed settlement, which awaits final approval from the court on October 5, ApolloMD has outlined a framework for compensating affected individuals. Those who can document instances of fraud or identity theft that directly stemmed from the breach could receive compensation of up to $5,000 per claim. Alternatively, individuals without documentation of losses will have the opportunity to receive a pro-rated cash payment of $75. Additionally, the settlement provision includes one year of medical data monitoring for class members, a gesture aimed at mitigating potential repercussions stemming from the breach.
The consolidated lawsuit, filed in a federal court in Georgia in February, accused ApolloMD of negligence for failing to adequately protect sensitive personal information against unauthorized access by cybercriminals. Such allegations have become increasingly pertinent as organizations grapple with the efficacy of their cybersecurity frameworks.
The data accessed during the breach included a range of personal and medical information. This potentially compromised data consisted of names, birthdates, addresses, diagnostic information, provider names, service dates, treatment details, and health insurance information. Alarmingly, for some individuals, Social Security numbers were also found in the compromised information.
ApolloMD notified federal regulators of the breach in February as a business associate, divulging that the cyber incident involved the protected health information of approximately 626,540 people. To inform those impacted, the company dispatched two waves of notifications: the first initiated in September 2025 and the second in March 2026. This proactive communication highlights the importance of transparency in the management of such sensitive issues, especially with widespread public concern over personal data security.
In the aftermath of the settlement announcement, legal representatives for the plaintiffs in the class-action lawsuit have requested $1.34 million in attorney fees, alongside reimbursement of associated litigation costs. This amount would be deducted from the total $4.02 million settlement fund, reflecting the complexities and financial implications of litigation in the field of cybersecurity.
ApolloMD, based in Atlanta, and specializing in multifaceted practice management services for healthcare professionals, is not alone in facing challenges related to data security and breaches. This incident highlights the growing trend of healthcare vendors serving as prime targets for cybercriminals. Notably, the breaches are not isolated to ApolloMD; other major players in the healthcare sector have reported similar security incidents. For example, Trizetto Provider Solutions, part of Cognizant, disclosed a 2024 breach affecting 3.4 million individuals earlier this year. Additionally, electronic health records provider Veradigm, formerly known as Allscripts, reported a significant breach last September that impacted nearly 2.7 million people, culminating in a $10.5 million settlement to address the fallout from that incident.
These incidents illustrate the ongoing vulnerabilities that prevail within the healthcare infrastructure, underscoring a pressing need for enhanced cybersecurity measures. As organizations increasingly rely on digital methods to store and manage sensitive information, the urgency for robust third-party risk management strategies continues to escalate.
The settlement with ApolloMD serves as a cautionary tale for other entities within the industry, reinforcing the critical importance of safeguarding patient information from ever-evolving cyber threats. As proposed regulations and standards governing data privacy tighten in the coming years, healthcare organizations may find themselves under increased scrutiny regarding their data protection tactics.
This settlement not only reveals the operational risks inherent in data management but also stresses the need for continuous improvement in cybersecurity practices throughout the healthcare ecosystem. As the digital landscape evolves, so too must the strategies employed by healthcare organizations to safeguard the sensitive information of their patients.