GRIPA MOVEit Settlement: Claim Window Closed, Hearing Nov 12, 2026

At a glance

Status

Pending final approval

Defendant

Greater Rochester Independent Practice Association (GRIPA)

Settlement fund

$2,150,000

Claim deadline

September 3, 2026

No-proof cash option

Yes — 100, or up to 10000

Max documented payout

$10,000

Administrator

Settlement Administrator (moveitsettlementgripa.com)

Official site

www.moveitsettlementgripa.com

Court

U.S. District Court, District of Massachusetts (Judge Allison D. Burroughs)

Case number

23-cv-13231-ADB (consol. with 23-cv-12922-ADB)

Last verified September 9, 2026

Key dates

Milestone	Date	What it means
Claim deadline	September 3, 2026(passed)	Last day to file for a payment
Opt-out (exclusion) deadline	August 4, 2026(passed)	Last day to leave the settlement and keep the right to sue
Objection deadline	August 4, 2026(passed)	Last day to object to the terms
Final approval hearing	November 12, 2026	When the judge decides whether to approve the settlement
Expected payout	Not yet scheduled	Payments are not sent until after final approval and any appeals

Where to file

GRIPA MOVEit Data Breach Settlement is administered by Settlement Administrator (moveitsettlementgripa.com). The only place to file is the official settlement website:

Verify on the official site

www.moveitsettlementgripa.com

Filing is free. No legitimate settlement charges a fee to file a claim.

You cannot file on RecordingLaw.com. We are an independent publisher, not the settlement administrator, and we are not affiliated with any court, agency, or defendant.

What Happened in the GRIPA MOVEit Data Breach

Greater Rochester Independent Practice Association, known as GRIPA, is a physician network that coordinates care and data among independently practicing doctors in the Rochester, New York area. GRIPA itself was not directly hacked in the sense of an attacker breaking into its own network. Instead, GRIPA was one of hundreds of organizations worldwide caught up in the MOVEit breach, a mass exploitation of a vulnerability in Progress Software's MOVEit file-transfer product that unfolded in May and June of 2023.

MOVEit is software many businesses, insurers, healthcare organizations, and government agencies used to move sensitive files between systems. Attackers who exploited the flaw could pull data from any organization using it during the exposure window, all at once, which is why so many unrelated companies and healthcare networks sent breach notices around the same time in 2023, GRIPA among them.

Because the exposure ran through shared software rather than GRIPA's own network, it reached people who had no direct relationship with GRIPA. If you received a notice referencing GRIPA and do not recognize the name, this is likely why: your information passed through a connected system as part of routine data handling, not because you were ever a GRIPA-affiliated patient.

Where the Settlement Stands, As of July 2026

The claim window has closed. The fund totals $2,150,000, meant to cover cash payments, two years of identity protection services, attorneys' fees, and administrative costs, all subject to court approval.

The claim deadline was September 3, 2026, and it has passed. The final approval hearing was originally set for that same date, but the official settlement site now carries a banner saying it has been rescheduled to 1:00 p.m. on November 12, 2026, in Boston, where Judge Allison D. Burroughs will decide whether to approve the settlement as fair, reasonable, and adequate. A hearing date can move again, so confirm the current schedule on the official site rather than assuming this one is fixed.

The deadline to exclude yourself from the class, known as opting out, and the deadline to object to the settlement's terms were both August 4, 2026, a full month before the claim deadline, and both have passed. The official site was explicit that these were separate choices: a class member could opt out, or object, but not both. Opting out removes you from the class entirely, so there is nothing left to object to; objecting only makes sense if you are staying in.

Who Is in the Class

The class is defined as individuals whose information was affected by GRIPA's May 2023 MOVEit data breach. If you received a notice referencing this breach, you are likely part of the class. Membership is not limited to former GRIPA patients; because the exposure ran through the MOVEit software rather than GRIPA's own systems, it can include anyone whose data GRIPA or a partner handled during that period.

If you are unsure whether your information was involved, the official settlement site is the place to check, not a third-party lookup tool or an unsolicited text claiming to confirm eligibility for you.

How Much You Can Realistically Get

The settlement offers two payment paths. The first is a flat cash payment with no proof required, currently set at $100. That amount is not fixed; it is subject to pro-rata adjustment, meaning it could shrink if a large number of people file, or rise somewhat if relatively few do, once the court approves the fund's fees and costs. Most people who file will use this option, since it needs no paperwork.

The second path is reimbursement for documented losses: up to $2,500 for ordinary, unreimbursed losses and up to $10,000 for extraordinary losses tied directly to the breach. That $10,000 figure is a ceiling for people with significant, provable losses, not a typical or expected payout. Treat it as a cap and gather supporting records before filing rather than assuming the maximum applies.

Separate from either cash option, the settlement provides two years of identity protection services at no additional cost. Every eligible class member can use that benefit regardless of which cash option they choose, or even if they file no cash claim at all.

What Proof You Need

No proof is required for the flat $100 cash option. For the documented-loss option, claimants need records that connect their losses to the breach, such as bank or credit card statements showing fraudulent charges, receipts for costs like credit-monitoring services purchased because of the breach, or other paperwork supporting the amount claimed, up to the $2,500 ordinary-loss cap and $10,000 extraordinary-loss cap.

How to File

Claims were submitted through the official settlement website, moveitsettlementgripa.com, by the September 3, 2026 deadline, which has now passed. The site is run by a settlement administrator on behalf of the court; no administrator company name is listed on the site, so verify against the official site before responding to anyone claiming to represent "the GRIPA settlement" by phone or text. Filing required no lawyer and cost nothing, and that same site is where the November 12, 2026 hearing and any payment news will be posted.

What to Do Right Now

Whether or not you filed a cash claim, activate the two years of free identity protection the settlement provides. That benefit costs nothing and does not require choosing the documented-loss path.

Beyond that, a free credit freeze at all three major credit bureaus, Equifax, Experian, and TransUnion, is the strongest immediate step you can take on your own, and it is free by law regardless of whether you file here. IdentityTheft.gov, run by the Federal Trade Commission, walks through freezing your credit and building a recovery plan if your information has already been misused. Because this breach involves a physician network, the U.S. Department of Health and Human Services also publishes guidance on protecting yourself after a health-related data breach.

As with any settlement payment, whether a portion is taxable depends on what it replaces; this page is not tax advice, so consult a tax professional.