
On November 25, 2025, Jefferson-Blount-St. Clair Mental Health Authority found that someone had broken into its computer network. The authority is an Alabama non-profit that plans and coordinates public mental health services for the state's Region M-5, and it kept records on current and former patients and employees. According to the settlement agreement, those records included names, Social Security numbers, dates of birth, health insurance and Medicare or Medicaid information, medical record numbers, diagnoses, prescriptions, treatment details, billing records and the names of patients' doctors. The authority posted a notice on its website on January 23, 2026, and began mailing letters to the people affected around March 9, 2026.
Several lawsuits followed and were combined in the Circuit Court of Jefferson County, Alabama, Birmingham Division (Meyer, et al. v. Jefferson-Blount-St. Clair Mental Health Authority, No. 01-CV-2026-901158.00), before Judge Chuck Price. Eight people brought the case, led by Mykel Meyer, including two parents suing for their children. The lawsuit says the authority was negligent and did not do enough to keep the information it collected safe.
The authority denies all of it, and the court never decided who was right. The two sides met with a mediator, Phillip McCallum, on June 5, 2026, and agreed to settle that day. Judge Price granted preliminary approval on August 25, 2026. The lawyer for the class is Jonathan S. Mann of Pittman, Dutton, Hellums, Bradley & Mann in Birmingham.
Jefferson-Blount-St. Clair Mental Health Authority will pay $700,000 into a settlement fund, and none of it goes back to the authority. The fund pays everything: cash payments to people who file valid claims, the credit monitoring people sign up for, the settlement administrator's costs, and whatever the court awards the lawyers and the people who brought the case.
Class counsel can ask for attorneys' fees of up to 33.33% of the fund, about $233,310, plus their costs. They will also ask for a service award of up to $2,500 for each of the eight people who brought the case, $20,000 in all. The court decides both and can award less. Whatever is left after the first round of payments goes out in a second round to claimants who cashed their first payment, if that round would average at least $5 each. Otherwise, and for checks nobody cashes within 90 days, the money goes to a court-approved charity, called a cy pres recipient.
Staying in the settlement means giving up the right to sue the authority over the incident. File with Chimo by December 16, 2026. The court's own claim deadline is December 23, 2026, and the deadline to opt out or object is November 23, 2026. The final approval hearing is set for February 16, 2027, at 10:30 a.m. at the Jefferson County courthouse in Birmingham.
The flat cash payment is $100 per approved claim, and it needs no documents. It is adjusted pro rata, which means every payment moves up or down by the same share depending on how many people file. If few people claim, each payment can grow; if many do, each one shrinks. As a rough check (our estimate, not a published figure), taking the most the lawyers can ask for and the service awards off the $700,000 fund leaves about $446,690 before administration, litigation costs and credit monitoring. That covers $100 for roughly 4,400 claims, about one in seven of the 29,486 people in the class, and the real figure is lower once those costs come out.
People with real losses caused by the incident can instead claim up to $5,000 with third-party proof such as bank or card statements, invoices or receipts. A note or statement you wrote yourself does not count as proof on its own. A documented-loss claim without enough proof is treated as a claim for the $100 payment instead. Each person can choose one cash payment, not both.
Everyone in the class can also claim three years of one-bureau credit monitoring with $1,000,000 in identity theft insurance, on top of either cash payment. A claim mailed on the paper form is paid by check. Eligible payments are sent within 75 days after the settlement takes effect, which comes after final approval and any appeals.
Logo credits: Labcorp / Wikimedia Commons, CC BY-SA 4.0
You are in the class if you live in the United States and your information was found to be potentially involved in the Jefferson-Blount-St. Clair Mental Health Authority cyberattack of November 25, 2025. In practice, that means the roughly 29,486 people the authority wrote to about the incident starting in March 2026. If you received one of those letters, or a settlement notice from CPT Group, the settlement administrator, you are very likely in the class. If you are unsure, the administrator answers at 1-888-716-0970.
Some people are left out: the authority's governing board members, government entities, the judge on the case, the judge's immediate family and court staff, and anyone who opts out by November 23, 2026. Someone who opts out cannot also file a claim.
The claim form asks for your name, mailing address, phone number and email address, and the CPT ID printed on your notice. To claim the flat cash payment, you tick one box, and you can tick a second for credit monitoring. You sign the form under penalty of perjury, a legal promise that what you wrote is true and that you are eligible. The administrator checks claims against the authority's records and can reject a claim it finds fraudulent, and filing false claims on a large scale can be prosecuted. Only claim if it is true.
It settles a lawsuit over a cyberattack on Jefferson-Blount-St. Clair Mental Health Authority, an Alabama mental health non-profit, discovered on November 25, 2025. The authority denies wrongdoing and agreed to a $700,000 fund.
People in the United States whose information was potentially involved in the incident, which in practice means the roughly 29,486 people the authority wrote to starting in March 2026. Board members, the judge and court staff, and anyone who opted out are left out.
The flat cash payment is $100, with no documents needed. It moves up or down pro rata depending on how many people claim. People with documented losses caused by the incident can claim up to $5,000 instead.
Not for the $100 flat cash payment. You only need third-party proof, such as statements, invoices or receipts, if you claim documented losses of up to $5,000, and a statement you wrote yourself does not count on its own.
According to the settlement agreement, the records included names, Social Security numbers, dates of birth, insurance and Medicare or Medicaid details, diagnoses, prescriptions, treatment information and the names of patients' doctors.
File with Chimo by December 16, 2026, so there is time to mail your claim. The court's deadline for claims is December 23, 2026. The deadline to opt out of the settlement or object to it is November 23, 2026.
Yes. Everyone in the class can claim three years of one-bureau credit monitoring with $1,000,000 in identity theft insurance, in addition to a cash payment. Unlike some settlements, you have to claim it on the form to get it.
Eligible payments are sent within 75 days after the settlement takes effect. That happens after the court grants final approval, at a hearing set for February 16, 2027, and after any appeals are resolved.
Yes, because everything is paid from the same $700,000 fund. Class counsel can ask for up to 33.33% of it, about $233,310, plus costs, and the court decides how much to award. Fees, costs and administration come out before cash payments are set.
You get no cash payment and no credit monitoring, because both have to be claimed. You also give up the right to sue the authority over the incident, because everyone who stays in the class is bound by the settlement.