INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation

| 2026-10-22 14:13 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
In February 2024, Innovative Renal Care's network was accessed by an unauthorized third party between February 21 and March 1, resulting in the theft of patient data containing names, contact information, birth dates, Social Security numbers, driver’s license numbers, financial account information, health insurance information, billing and claims information, medical information, and more. The affected individuals were notified almost a year later on February 14, 2025, with at least 501 reported to be impacted initially, but the total increased to 59,400 living individuals after notification. A $900,000 settlement was proposed to resolve multiple lawsuits stemming from the data breach, which involved the unauthorized copying of files containing personal and protected health information. The forensic investigation determined that the attack worked by exploiting vulnerabilities in Innovative Renal Care's network security measures. As of now, a mediation process led to a successful settlement agreement, with the $900,000 fund allocated towards paying attorneys' fees, expenses, service awards for class representatives, and benefits to affected individuals.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope healthhealth
Incident Timeline
‎February 21, 2024
Innovative Renal Care agreed to pay $900,000 to settle a data breach litigation.
industry Health
General Document Context
‎February 2024
Threat actors successfully stole patient data from Innovative Renal Care in February 2024, leading to a $900,000 settlement.
tactic Data Breach
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation Posted By Steve Alder on Oct 22, 2026 American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data.
financial $900,000 Care
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation Posted By Steve Alder on Oct 22, 2026 American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data.
A $900,000 settlement has recently been proposed to resolve the litigation.
organisation Settle Data Breach Litigation Posted
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation Posted By Steve Alder on Oct 22, 2026 American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data.
organisation American Renal Management LLC
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation Posted By Steve Alder on Oct 22, 2026 American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data.
organisation Innovative Renal Care
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation Posted By Steve Alder on Oct 22, 2026 American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data.
general_metric 200 locations
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation Posted By Steve Alder on Oct 22, 2026 American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data.
general_metric 28 U.S. states
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation Posted By Steve Alder on Oct 22, 2026 American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data.
organisation District Court
In re American Renal Management LLC Data Breach Litigati on – in the U.S. District Court for the Middle District of Tennessee.
‎February 29, 2024
Threat actors exploited a vulnerability in the company's systems to initiate the data breach that led to litigation.
industry Health
General Document Context
tactic Data Breach
The data breach that sparked the litigation was identified on February 29, 2024.
‎March 1, 2024
Threat actors exploited vulnerabilities in the system to steal a large quantity of sensitive personal and protected health information from Innovative Renal Care.
industry Health
General Document Context
organisation Social Security
The files contained a wide range of personal and protected health information, including names, contact information, birth dates, Social Security numbers, driver’s license numbers, financial account information, health insurance information, billing and claims information, medical information, and more.
‎April 29, 2024
Innovative Renal Care agreed to a $900,000 settlement with the U.S. Department of Health and Human Services following a data breach lawsuit filed by affected individuals.
industry Health
General Document Context
organisation HHS
The HHS was notified on April 29, 2024, using a placeholder figure of at least 501 affected individuals.
general_metric 501 affected individuals
The HHS was notified on April 29, 2024, using a placeholder figure of at least 501 affected individuals.
financial $100 payment
Class members may submit a claim for reimbursement of up to $5,000 for documented, unreimbursed losses due to the data breach and/or claim a pro rata cash payment, estimated to be $100 per class member but may be higher or lower depending on the number of claims submitted.
financial $900,000 Care
The $900,000 settlement fund will be used to pay attorneys’ fees and expenses, settlement administration costs, service awards for the class representatives, and the remainder will be used to pay benefits to the class members.
organisation the California Consumer Privacy Act
The lawsuit asserted claims for negligence, negligence per se , breach of implied contract, invasion of privacy, unjust enrichment, and violations of the California Consumer Privacy Act and California Unfair Competition Law.
organisation California Unfair Competition Law
The lawsuit asserted claims for negligence, negligence per se , breach of implied contract, invasion of privacy, unjust enrichment, and violations of the California Consumer Privacy Act and California Unfair Competition Law.
organisation HIPAA Journal
Get The FREE HIPAA Compliance Checklist Immediate Delivery of Checklist Link To Your Email Address Please Enter Correct Email Address Your Privacy Respected HIPAA Journal Privacy Policy Innovative Renal Care denies all claims and contentions in the lawsuit, including wrongdoing and liability; however, mediation was successful, and a settlement was agreed.
‎February 14, 2025
The affected individuals were notified on February 14, 2025, nearly a year after an intrusion was first identified in the Innovative Renal Care system.
industry Health
General Document Context
‎Oct 22, 2026
Innovative Renal Care, a kidney care specialist with 200 locations in 28 U.S. states, paid $900,000 to settle data breach litigation following the theft of patient data in February 2024.
industry Health
General Document Context
tactic Data Breach
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation Posted By Steve Alder on Oct 22, 2026 American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data.
financial $900,000 Care
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation Posted By Steve Alder on Oct 22, 2026 American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data.
organisation Settle Data Breach Litigation Posted
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation Posted By Steve Alder on Oct 22, 2026 American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data.
organisation American Renal Management LLC
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation Posted By Steve Alder on Oct 22, 2026 American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data.
organisation Innovative Renal Care
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation Posted By Steve Alder on Oct 22, 2026 American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data.
general_metric 200 locations
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation Posted By Steve Alder on Oct 22, 2026 American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data.
general_metric 28 U.S. states
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation Posted By Steve Alder on Oct 22, 2026 American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data.
‎2026/10/22
Innovative Renal Care agreed to pay $900,000 to settle a data breach litigation.
organisation Innovative Renal Care Pays
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation.
organisation Settle Data Breach Litigation
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation.
financial $900,000 Care
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation.
‎November 20, 2026
The company, Health, will allow eligible individuals to opt out of the settlement and file an objection until November 20, 2026.
industry Health
General Document Context
‎December 21, 2026
Health pays $900,000 to settle data breach litigation.
industry Health
General Document Context
‎February 1, 2027
The company, Health, agreed to pay $900,000 as part of a settlement in data breach litigation.
industry Health
General Document Context
Tactical Metrics
Metrics
financial
900,000
Financial Impact / Stolen Funds
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation.
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation Posted By Steve Alder on Oct 22, 2026 American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in 28 U.S. states, identified a cyberattack in February 2024 involving the theft of patient data.
A $900,000 settlement has recently been proposed to resolve the litigation.
The $900,000 settlement fund will be used to pay attorneys’ fees and expenses, settlement administration costs, service awards for the class representatives, and the remainder will be used to pay benefits to the class members.
Metrics
financial
100
Financial Impact / Stolen Funds
Class members may submit a claim for reimbursement of up to $5,000 for documented, unreimbursed losses due to the data breach and/or claim a pro rata cash payment, estimated to be $100 per class member but may be higher or lower depending on the number of claims submitted.
Intelligence Sources
HIPAA Journal 2026-10-22