GRIPA MOVEit Data Breach Settlement: Claim by Sept 3, 2026
At a glance
- Status
- Open
- Defendant
- Greater Rochester Independent Practice Association (GRIPA)
- Settlement fund
- $2,150,000
- Claim deadline
- September 3, 2026
- No-proof cash option
- Yes — 100, or up to 10000
- Max documented payout
- $10,000
- Administrator
- Settlement Administrator (moveitsettlementgripa.com)
- Official site
- www.moveitsettlementgripa.com
- Court
- U.S. District Court, District of Massachusetts (Judge Allison D. Burroughs)
- Case number
- 23-cv-13231-ADB (consol. with 23-cv-12922-ADB)
Last verified July 16, 2026
Key dates
| Milestone | Date | What it means |
|---|---|---|
| Claim deadline | September 3, 2026 | Last day to file for a payment |
| Opt-out (exclusion) deadline | August 4, 2026 | Last day to leave the settlement and keep the right to sue |
| Objection deadline | August 4, 2026 | Last day to object to the terms |
| Final approval hearing | September 3, 2026 | When the judge decides whether to approve the settlement |
| Expected payout | Not yet scheduled | Payments are not sent until after final approval and any appeals |
Where to file
GRIPA MOVEit Data Breach Settlement is administered by Settlement Administrator (moveitsettlementgripa.com). The only place to file is the official settlement website:
File at the official sitewww.moveitsettlementgripa.com
Filing is free. No legitimate settlement charges a fee to file a claim.
You cannot file on RecordingLaw.com. We are an independent publisher, not the settlement administrator, and we are not affiliated with any court, agency, or defendant.
What Happened in the GRIPA MOVEit Data Breach
Greater Rochester Independent Practice Association, known as GRIPA, is a physician network that coordinates care and data among independently practicing doctors in the Rochester, New York area. GRIPA itself was not directly hacked in the sense of an attacker breaking into its own network. Instead, GRIPA was one of hundreds of organizations worldwide caught up in the MOVEit breach, a mass exploitation of a vulnerability in Progress Software's MOVEit file-transfer product that unfolded in May and June of 2023.
MOVEit is software many businesses, insurers, healthcare organizations, and government agencies used to move sensitive files between systems. Attackers who exploited the flaw could pull data from any organization using it during the exposure window, all at once, which is why so many unrelated companies and healthcare networks sent breach notices around the same time in 2023, GRIPA among them.
Because the exposure ran through shared software rather than GRIPA's own network, it reached people who had no direct relationship with GRIPA. If you received a notice referencing GRIPA and do not recognize the name, this is likely why: your information passed through a connected system as part of routine data handling, not because you were ever a GRIPA-affiliated patient.
Where the Settlement Stands, As of July 2026
The settlement is open and accepting claims. The fund totals $2,150,000, meant to cover cash payments, two years of identity protection services, attorneys' fees, and administrative costs, all subject to court approval.
The claim deadline is September 3, 2026, the same date as the final approval hearing, where Judge Allison D. Burroughs will decide whether to approve the settlement as fair, reasonable, and adequate. A hearing date can move, so anyone tracking the case closely should confirm the current schedule on the official site rather than assume this one is fixed.
The deadline to exclude yourself from the class, known as opting out, and the deadline to object to the settlement's terms are both August 4, 2026, a full month before the claim deadline. The official site is explicit that these are separate choices: you can opt out, or you can object, but not both. Opting out removes you from the class entirely, so there is nothing left to object to; objecting only makes sense if you are staying in.
Who Is in the Class
The class is defined as individuals whose information was affected by GRIPA's May 2023 MOVEit data breach. If you received a notice referencing this breach, you are likely part of the class. Membership is not limited to former GRIPA patients; because the exposure ran through the MOVEit software rather than GRIPA's own systems, it can include anyone whose data GRIPA or a partner handled during that period.
If you are unsure whether your information was involved, the official settlement site is the place to check, not a third-party lookup tool or an unsolicited text claiming to confirm eligibility for you.
How Much You Can Realistically Get
The settlement offers two payment paths. The first is a flat cash payment with no proof required, currently set at $100. That amount is not fixed; it is subject to pro-rata adjustment, meaning it could shrink if a large number of people file, or rise somewhat if relatively few do, once the court approves the fund's fees and costs. Most people who file will use this option, since it needs no paperwork.
The second path is reimbursement for documented losses: up to $2,500 for ordinary, unreimbursed losses and up to $10,000 for extraordinary losses tied directly to the breach. That $10,000 figure is a ceiling for people with significant, provable losses, not a typical or expected payout. Treat it as a cap and gather supporting records before filing rather than assuming the maximum applies.
Separate from either cash option, the settlement provides two years of identity protection services at no additional cost. Every eligible class member can use that benefit regardless of which cash option they choose, or even if they file no cash claim at all.
What Proof You Need
No proof is required for the flat $100 cash option. For the documented-loss option, claimants need records that connect their losses to the breach, such as bank or credit card statements showing fraudulent charges, receipts for costs like credit-monitoring services purchased because of the breach, or other paperwork supporting the amount claimed, up to the $2,500 ordinary-loss cap and $10,000 extraordinary-loss cap.
How to File
Claims are submitted through the official settlement website, moveitsettlementgripa.com, ahead of the September 3, 2026 deadline. The site is run by a settlement administrator on behalf of the court; no administrator company name is listed on the site as of this writing, so verify against the official site before responding to anyone claiming to represent "the GRIPA settlement" by phone or text. Filing does not require a lawyer and costs nothing. If your notice included a claimant ID, keep it on hand.
What to Do Right Now
Whether or not you file a cash claim, activate the two years of free identity protection the settlement provides. That benefit costs nothing and does not require choosing the documented-loss path.
Beyond that, a free credit freeze at all three major credit bureaus, Equifax, Experian, and TransUnion, is the strongest immediate step you can take on your own, and it is free by law regardless of whether you file here. IdentityTheft.gov, run by the Federal Trade Commission, walks through freezing your credit and building a recovery plan if your information has already been misused. Because this breach involves a physician network, the U.S. Department of Health and Human Services also publishes guidance on protecting yourself after a health-related data breach.
As with any settlement payment, whether a portion is taxable depends on what it replaces; this page is not tax advice, so consult a tax professional.
Frequently Asked Questions
What is the GRIPA MOVEit data breach settlement?
It is a $2,150,000 settlement resolving claims that Greater Rochester Independent Practice Association (GRIPA) failed to protect personal information exposed in the May 2023 MOVEit data breach. The case is before Judge Allison D. Burroughs in the U.S. District Court for the District of Massachusetts, case 23-cv-13231-ADB, consolidated with 23-cv-12922-ADB.
Why am I getting a notice from GRIPA if I have never heard of them?
GRIPA is a Rochester, New York physician network that used MOVEit file-transfer software, and a vulnerability in that software was exploited in a mass 2023 hacking campaign that hit hundreds of unrelated organizations. Your information could have passed through a GRIPA-connected system even if you were never a GRIPA patient.
How much money will I actually get?
As of July 2026, you can choose a flat cash payment currently estimated at $100 with no proof needed, subject to pro-rata adjustment, or claim documented losses up to $2,500 for ordinary losses and up to $10,000 for extraordinary losses with records. Most claimants without documented losses receive the smaller no-proof amount, and no specific payout is guaranteed.
What is the deadline to file a claim in the GRIPA settlement?
The claim deadline is September 3, 2026, the same date as the final approval hearing. The deadline to opt out and the deadline to object are both earlier, August 4, 2026.
What is the difference between opting out and objecting?
Opting out removes you from the class; you keep the right to sue GRIPA on your own but give up any payment from this fund. Objecting keeps you in the class and eligible for payment while you tell the court in writing that some part of the deal is unfair. The official site is explicit that you cannot do both: if you opt out, you cannot also object. Both the opt-out deadline and the objection deadline are August 4, 2026.
Does the GRIPA settlement include identity protection?
Yes. Alongside the cash options, the settlement provides two years of identity protection services at no cost to every eligible class member.
Where do I file a claim in the GRIPA MOVEit settlement?
Claims are filed only at the official site, moveitsettlementgripa.com, and filing is free. RecordingLaw.com is an independent publisher, not the settlement administrator, and cannot process claims.
How to tell a settlement notice is real
Check the case name, case number, and court against the official settlement site. Go to that site directly instead of clicking a link in an email or text. Nobody legitimate will call, text, or email out of the blue asking for your Social Security number, bank account, or card details, and nobody will charge you to file. Report anyone who does at ReportFraud.ftc.gov.
Informational only. Not legal, tax, or financial advice, and not affiliated with any settlement.
RecordingLaw.com is an independent legal-information publisher. We are not a law firm, not a settlement administrator, and not affiliated with, endorsed by, or acting on behalf of any court, government agency, defendant, or claims administrator described on this page. Reading this page does not create an attorney-client relationship.
We do not process claims and we never collect your claim information. You cannot file a claim on RecordingLaw.com. To file, opt out, object, or check your status, use only the official settlement administrator identified above. We link to it for your convenience.
Filing a legitimate claim is free. No legitimate settlement or administrator will charge you a fee to file, or ask for your Social Security number, bank, or card details by unsolicited call, text, or email. If someone does, it is likely a scam. Report it at ReportFraud.ftc.gov.
Deadlines, amounts, and approval status change and are set by the court. We verify against the official administrator and court records, but confirm the current details on the official site before acting. Nothing here guarantees eligibility, a payment, or any amount. Settlement payments may be taxable. See IRS Publication 4345. and consult a tax professional. For advice about your specific situation, consult a licensed attorney in your state. Affiliate disclosure.
Sources and References
- IdentityTheft.gov: report identity theft and get a recovery plan (FTC)(identitytheft.gov).gov
- Credit Freezes and Fraud Alerts (Federal Trade Commission)(consumer.ftc.gov).gov
- Tips for consumers after a health data breach (U.S. Dept. of Health and Human Services)(hhs.gov).gov
- GRIPA MOVEit Data Breach Settlement, official settlement website(moveitsettlementgripa.com)