
On June 3, 2024, Wayne Memorial Hospital in Jesup, Georgia, found that a cybercriminal had been inside its computer network since about May 30. The hospital, which also runs facilities in Blackshear and Ludowici, later determined that files holding information on about 163,440 people may have been reached. According to the settlement agreement, that information included names, dates of birth, Social Security numbers, patient account and medical record numbers, Medicare, Medicaid and health insurance member numbers, diagnoses and treatment details, admission dates, treatment locations and the names of patients' doctors. The hospital began mailing letters to the people affected around August 27, 2025, more than a year after it found the intrusion.
Patients filed several lawsuits in Wayne County soon after the letters went out. The cases were combined in the Superior Court of Wayne County (Bates, et al. v. Wayne Memorial Hospital Auxiliary, Inc. d/b/a Wayne Memorial Hospital, No. SUCV2025000239), and seven patients, led by Larkie Bates, filed a consolidated complaint on January 23, 2026. The lawsuit says the hospital did not do enough to protect the data it collected, and it brings claims for negligence, breach of implied contract and unjust enrichment, which means keeping a benefit it would be unfair to keep.
Wayne Memorial Hospital denies all of it, and the court never decided who was right. The two sides went to mediation with Bruce Friedman of JAMS on May 12, 2026, and agreed to settle there. The court granted preliminary approval on August 19, 2026. The lawyers for the class are Leanna A. Loginov of Shamis & Gentile, Laura Van Note of Cole & Van Note, Casondra Turner of Milberg and Daniel Srourian of Srourian Law Firm.
This settlement does not set up one pot of money that everything is paid from. Instead, Wayne Memorial Hospital pays each benefit directly: cash payments to people who file valid claims, two years of credit monitoring for everyone in the class, the settlement administrator's costs, and whatever the court awards the lawyers. Because the lawyers and the administrator are paid separately, their fees do not come out of claimants' payments.
The alternate cash payments have their own cap: the hospital pays at most $300,000 for them in total. At $25 each, that covers 12,000 claims. Class counsel will ask the court for up to $525,000 in attorneys' fees and costs, and for a service award of up to $2,500 for each of the seven patients who brought the case, $17,500 in all. Checks that nobody cashes within 120 days go back to the hospital. If more than 3% of the class opts out, the agreement lets the hospital cancel the settlement.
Staying in the settlement means giving up the right to sue Wayne Memorial Hospital over the data incident and the facts in the complaint. File with Chimo by November 30, 2026. The court's own claim deadline is December 7, 2026, and the deadline to opt out or object is November 7, 2026. The final approval hearing is set for January 27, 2027, at 1:30 p.m. in the Wayne County courthouse in Jesup.
The alternate cash payment is $25 per approved claim, and it needs no documents. It is cut down only if more than 12,000 people claim it, because the hospital's $300,000 cap for these payments covers 12,000 claims at $25. Past that point, every alternate cash payment shrinks by the same share, which the notice calls pro rata. With about 163,440 people in the class, 12,000 claims would mean about one in fourteen of them filing.
People with real losses from fraud or identity theft caused by the incident can instead claim up to $5,000 with receipts, bank or card statements or invoices. A note or statement you wrote yourself does not count as proof on its own, and a documented-loss claim that the administrator rejects gets nothing, rather than falling back to $25. Each person can choose one cash payment, not both.
Everyone in the class can also enroll in two years of single-bureau credit monitoring through CyEx with $1,000,000 in identity theft insurance, whether or not they file. The enrollment code comes with the settlement notice and works after final approval. A claim mailed on the paper form is paid by check, and eligible payments are sent within 45 days after the settlement takes effect, which comes after final approval and any appeals.
Logo credits: Labcorp / Wikimedia Commons, CC BY-SA 4.0
You are in the class if your information was reachable through the Wayne Memorial Hospital cyberattack, which ran from about May 30 to June 3, 2024. In practice, that means the people the hospital wrote to about the incident starting in August 2025. If you received one of those letters, or a settlement notice from CPT Group, the settlement administrator, you are very likely in the class. If you are unsure, the administrator answers at 1-888-716-0934.
Some people are left out: the hospital's directors and officers, government entities, the judge on the case, the judge's immediate family and court staff, and anyone who opts out by November 7, 2026. Someone who opts out cannot also file a claim.
The claim form asks for your name, mailing address, phone number and email address, and the CPT ID printed on your notice. To claim the alternate cash payment, you tick one box and send nothing else. You sign the form under penalty of perjury, a legal promise that what you wrote is true and that you are eligible. The administrator checks claims against the hospital's records and can ask follow-up questions, including about your signature. A false claim can be rejected, and filing false claims on a large scale can be prosecuted. Only claim if it is true.
It settles a lawsuit over a cyberattack on Wayne Memorial Hospital in Jesup, Georgia, that the hospital discovered on June 3, 2024. The hospital denies wrongdoing and agreed to pay cash and credit monitoring to people whose information was involved.
People whose information was reachable in the incident, which in practice means the roughly 163,440 people the hospital wrote to starting in August 2025. Hospital directors and officers, the judge and court staff, and anyone who opted out are left out.
The alternate cash payment is $25, with no documents needed. It is reduced only if more than 12,000 people claim it. People with documented losses from fraud or identity theft can claim up to $5,000 instead.
Not for the $25 alternate cash payment. You only need receipts, statements or invoices if you claim documented losses of up to $5,000, and a statement you wrote yourself does not count as proof on its own.
According to the settlement agreement, it included names, dates of birth, Social Security numbers, medical record and patient account numbers, insurance numbers, diagnoses, treatment details and the names of patients' doctors.
File with Chimo by November 30, 2026, so there is time to mail your claim. The court's deadline for claims is December 7, 2026. The deadline to opt out of the settlement or object to it is November 7, 2026.
Yes. Everyone in the class can enroll in two years of single-bureau credit monitoring with $1,000,000 in identity theft insurance. The code comes with the settlement notice and starts working after final approval.
Eligible payments are sent within 45 days after the settlement takes effect. That happens after the court grants final approval, at a hearing set for January 27, 2027, and after any appeals are resolved.
No. Wayne Memorial Hospital pays the attorneys' fees, the service awards and the administrator's costs separately, so they do not come out of the $25 payments. Class counsel will ask for up to $525,000 in fees and costs.
You get no cash payment, though you can still enroll in credit monitoring. You also give up the right to sue Wayne Memorial Hospital over the data incident, because everyone who stays in the class is bound by the settlement.