Frequently Asked Questions

A Court authorized this Settlement Website because you have a right to know about the settlement and all of your options before the Court decides whether to give final approval to the settlement. This Settlement Website explains the nature of the Action that is the subject of the settlement, the general terms of the settlement, and your legal rights and options.
 

Judge Diane J. Humetewa of the United States District Court for the District of Arizona is overseeing this case captioned as Hulewat et al. v. Medical Management Resource Group, L.L.C. d/b/a American Vision Partners, et al., Case No. 2:24-cv-00377-DJH. The people who brought the lawsuit are called the “Plaintiffs.” The companies being sued, Medical Management Resource Group LLC, Barnet Dulaney Perkins Eye Center, PC, and Southwestern Eye Center, Ltd., are called the Defendants.
 

The Action arises from a cyberattack which Defendant discovered on or about November 14, 2023, wherein an unauthorized third party gained access to Defendant’s computer network and the sensitive information of approximately 1,600,000 individuals or the Data Incident. Specifically, Plaintiffs allege that as a result of the Data Incident, the cybercriminals gained access to Plaintiffs’ and the Settlement Class Members’ information including names, dates of birth, Social Security Numbers and contact information, personally identifying information or PII and medical treatment and health insurance information, which is protected health information, or PHI or Private Information, as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Defendant denies any wrongdoing whatsoever. No court or other judicial body has made any judgment or other determination that Defendant has done anything wrong.

In a class action, one or more people called Plaintiffs sue on behalf of all people who have similar claims. Together, all of these people are called a Settlement Class, and the individuals are called Settlement Class Members. One court resolves the issues for all Settlement Class Members, except for those who exclude themselves from the Settlement Class.

The Court has not decided in favor of the Plaintiffs or Defendants. Instead, both sides agreed to the settlement. The settlement avoids the cost and risk of a trial and related appeals, while providing benefits to Settlement Class Members. The Plaintiffs appointed to represent the Settlement Class, and the attorneys for the Settlement Class, Class Counsel, think the settlement is best for all Settlement Class Members.

You are affected by the settlement and potentially a Settlement Class Member if you are a Person who is a member of the Injunctive Relief Class and/or the Damages Settlement Class.

There are two (2) settlement subclasses in this settlement:

Damages Settlement Class Member: Approximately 258,070 U.S. residents whose Social Security Numbers and other Private Information were compromised in the Data Incident.

If you are not sure whether you are included in the settlement, you may call (833) 630-5366 with questions. You may also write with questions to:

American Vision Settlement

c/o Kroll Settlement Administration LLC

PO Box 225391

New York, NY 10150-5391

The settlement provides the Damages Settlement Class Members the opportunity to submit a Claim for Damages Class Benefits on or before the Claims Deadline. The Damages Class Benefits include: (1) Pro-Rata Cash Payments; OR (2) Out-of-Pocket Expense Claims. These benefits shall be paid from the $1,750,000 non-reversionary Settlement Fund.

Damages Settlement Class Members that submit a valid and timely Claim Form may select one of the following Damages Class Benefits:

1. Pro-Rata Cash Payment: Damages Settlement Class Members may submit a Claim for a pro rata cash payment. The Settlement Administrator will make pro rata settlement payments, which may increase or decrease the pro rata cash payment, subject to the Settlement Fund cap.
   
   OR
    

2. Out-of-Pocket Expense Claims: Damages Settlement Class Members may submit a Claim for reimbursement of documented out-of-pocket losses reasonably and fairly traceable to the Data Incident, subject to a $3,000 cap per claimant.

• Out-of-Pocket Expense Claims will include, without limitation, unreimbursed losses relating to fraud or identity theft; professional fees including attorneys’ fees, accountants’ fees, and fees for credit repair services; costs associated with freezing or unfreezing credit with any credit reporting agency; credit monitoring costs that were incurred on or after November 2023 that the claimant attests were caused or otherwise incurred as a result of the Data Incident, through the date of Claim submission; and miscellaneous expenses such as notary, data charges (if charged based on the amount of data used), fax, postage, copying, mileage, cell phone charges (only if charged by the minute), and long-distance telephone charges.
   
• Damages Settlement Class Members with Out-of-Pocket Expense Claims must submit documentation and attestation supporting their Claims. This may include receipts or other documentation, not “self-prepared” by the claimant, that documents the costs incurred.
   
  •  “Self-prepared” documents such as handwritten receipts are, by themselves, insufficient to receive reimbursement, but may be considered to add clarity or support to other submitted documentation.

• Out-of-Pocket Expense Claims must include an attestation that the monetary losses are fairly traceable to the Data Incident and were not incurred due to some other event or reason.

DEFENDANT AGREES TO IMPLEMENT AND MAINTAIN CYBERSECURITY MEASURES FOR A MINIMUM PERIOD OF TIME FOR INJUNCTIVE RELIEF CLASS MEMBERS DESCRIBED BELOW:

3. Injunctive Relief: As additional consideration for the dismissal and release of injunctive claims by the Injunctive Relief Class, Defendants agree to implement and maintain the following cybersecurity measures for a minimum period of time to be addressed in a long-form settlement agreement. The value of these cybersecurity measures is approximately $2,787,630. These business practice commitments shall constitute contractually enforceable obligations of the Settlement Agreement, with all costs of implementation and maintenance to be borne solely by Defendants, separate and apart from the Damages Class Settlement Fund:

• Chief Information Officer. Creation and maintenance of a Chief Information Officer (CIO) role, responsible for managing AVP's information technology environment and mitigating cybersecurity risks, working in coordination with AVP's Security Officer.
   

• Director of Information Security and Information Security Training Specialist. Retention of a dedicated Information Security Training Specialist, specifically responsible for managing cybersecurity training across the enterprise in consultation with the Security Officer.
   
• Cybersecurity Steering Committee. Operation of a cross-functional Cybersecurity Steering Committee, consisting of the company's Security Officer, CIO, CEO, General Counsel, and other senior management personnel, tasked with overseeing AVP's cybersecurity program and meeting periodically to manage and coordinate cybersecurity governance and risk management issues.
   
• Enhanced Cybersecurity Training. Implementation and maintenance of an enterprise-wide cybersecurity training program, including a supplemental Security Awareness Policy and course for all employees.
   
• Penetration Testing. In addition to weekly vulnerability scanning, engagement of an independent third-party vendor to conduct periodic penetration testing of AVP's systems, leveraging the Common Vulnerability Scoring System (CVSS) framework to classify the severity of identified risks.
   
• Enhanced Data Classification Policies. Implementation and maintenance of enhanced data classification policies and backend data classification solutions to streamline management of, and access to, electronic protected health information (ePHI), including additional access controls to reduce AVP's potential attack surface.
   
• Third-party Management of SIEM, SOC, and Firewall. Implementation of additional cybersecurity measures run by an external security provider, including SIEM, SOC, and management of the corporate firewall.

• Email Security. Implementation of an improved email security gateway.
  
   
• Disaster Recovery Solution. Implementation of an improved disaster recovery solution.
   
• Security Risk Assessments. Performance of regular security risk assessments with external vendors to evaluate the effectiveness of AVP’s cybersecurity program and remediate identified vulnerabilities. 
   
• Amended Security Policies. Adoption, implementation, and ongoing maintenance of amended security policies, including an updated incident response policy and related protocols to govern detection, response, and remediation of future security incidents.

To receive a Damages Class Benefit, you must complete and submit a Claim Form online here or by mail to Settlement Administrator – 83312, c/o Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY 10150-5391. Read the Claim Form instructions carefully, fill out the Claim Form, provide the required documentation, and submit online by November 12, 2026 or by mail postmarked by November 12, 2026. 
 

TO RECEIVE AN ELECTRONIC OR ACH PAYMENT FOR YOUR VALID CLAIM, YOU MUST FILE A CLAIM FORM ONLINE AT HERE.

The Court will hold a Final Fairness Hearing on December 10, 2026 at 10:00 a.m. MT to decide whether to approve the settlement. If the Court approves the settlement, there may be appeals from that decision and resolving them can take time. It also takes time for all of the Claim Forms to be processed. Please be patient. Damages Class Benefits will begin after the settlement has obtained Court approval and the time for all appeals has expired.

Defendant and its affiliates will receive a Release from all claims that could have been or that were brought against Defendant relating to the Data Incident. Thus, if the Settlement becomes final and you do not exclude yourself from the Settlement, you will be a Settlement Class Member and you will give up your right to sue Defendant, Defendant’s past or present parents, subsidiaries, divisions, and related or affiliated entities, and each of their respective predecessors, successors, directors, officers, principals, agents, attorneys, insurers, and reinsurers, and includes, without limitation, any Person related to any such entity who is, was or could have been named as a defendant in any of the actions in the Action, other than any Person who is found by a court of competent jurisdiction to be guilty under criminal law of initiating, causing, aiding or abetting the criminal activity occurrence of the Data Incident or who pleads nolo contendere to any such charge, in its capacity as such and assigns of each of them as well as covered entities associated with the Data Incident. These Releases are described in Section 7 of the Settlement Agreement, which is available here. If you have any questions, you can talk to Class Counsel listed in Question 17 for free or you can talk to your own lawyer.

No. If you exclude yourself, you will not be entitled to receive any benefits from the settlement.

No. Unless you exclude yourself, you give up any right to sue Defendant and any other Related Entities for any claim that could have been or was brought relating to the Data Incident. You must exclude yourself from the settlement to start your own lawsuit or to be part of any different lawsuit relating to the claims in this case. 

To exclude yourself, send a request to opt-out or written notice of intent to opt-out that says you want to be excluded from the settlement. The request to opt-out must be individually signed and timely submitted to the Settlement Administrator at the address below. The written notice must clearly manifest the Settlement Class Member’s intent to opt-out of the Settlement Class. All Persons who do not opt-out of the Settlement Class shall be bound by the terms of the Settlement Agreement and Judgment entered. You must mail your request to opt-out to the Settlement Administrator postmarked by October 13, 2026, to:

 

c/o Kroll Settlement Administration LLC

PO Box 225391

New York, NY 10150-5391

You can tell the Court that you do not agree with the settlement, or some part of it by objecting to the settlement. Objections must be sent to the Settlement Administrator at the address listed below, postmarked by no later than October 13, 2026. The objector or his or her counsel may also file their objection with the Court through the Court’s ECF system, with service on Class Counsel and Defendant’s Counsel, to be made through the ECF system.

 

The objection must include all of the following: 

1. the objector’s full name and address; 

2. the case name and docket number: Hulewat et al. v. Medical Management Resource Group LLC d/b/a American Vision Partners, et al., Case No. 2:24-cv-00377-DJH; 

3. a written statement of all grounds for the objection, including whether the objection applies only to the objector, to a subset of the Settlement Class, or to the entire Settlement Class, accompanied by any legal support for the objection the objector believes applicable; 

4. the identity of any and all counsel representing the objector in connection with the objection; 

5. a statement whether the objector and/or his or her counsel will appear at the Final Fairness Hearing; and 

6. the objector’s signature or the signature of the objector’s duly authorized attorney or other duly authorized representative (if any) representing him or her in connection with the objection.

Objecting is telling the Court that you do not like the settlement or parts of it and why you do not think it should be approved. You can object only if you are a Settlement Class Member. Excluding yourself is telling the Court that you do not want to be part of the Settlement Class and do not want to receive any benefit from the settlement.

Yes. The Court appointed Gary M. Klinger of Milberg PLLC, Raina C. Borrelli of Strauss Borrelli PLLC, Terence Coates of Markovits, Stock & DeMarco, LLC, and J. Austin Moore of Stueve Siegel Hanson LLP as Class Counsel to represent the Settlement Class in settlement negotiations. If you want to be represented by your own lawyer, you may hire one at your own expense.

Class Counsel shall submit a motion to the Court requesting attorneys’ fees, in the amount of 33.33% of the value of the settlement, and reasonable litigation costs to be paid from the Settlement Fund. Any such award would compensate Class Counsel for investigating the facts, litigating the case, and negotiating the settlement and will be the only payment to them for their efforts in achieving this settlement and for their risk in undertaking this representation on a wholly contingent basis.

Class Counsel shall apply to the Court for Service Awards for the Plaintiffs of up to $2,500 each. The Service Awards approved by the Court shall be paid by the Settlement Administrator out of the Settlement Fund directly to the Plaintiffs.

Any attorneys’ fees, costs, and/or Service Awards awarded by the Court shall be paid by Defendant from the Settlement Fund and must be approved by the Court. The Court may award less than the amounts requested. 
 

The Court will hold a Final Fairness Hearing on December 14, 2026 at 10:00 a.m. MT, at the Sandra Day O’Connor U.S. Courthouse, Courtroom 605, 401 W. Washington St., Phoenix, AZ 85003-2161 as ordered by the Court. At this hearing, the Court will consider whether the settlement is fair, reasonable, and adequate. If there are timely and valid objections, the Court will consider them and will listen to people who have asked to speak at the hearing if such a request has been properly made. The Court will also rule on the attorneys’ fees and costs and Service Awards payments. After the hearing, the Court will decide whether to approve the settlement. We do not know how long these decisions will take. The hearing may be moved to a different date or time without additional notice, so Class Counsel recommends checking the Settlement Website, or calling (833) 630-5366.

No. Class Counsel will present the Settlement Class to the Court. You or your own lawyer are welcome to attend at your expense, but you are not required to do so. If you send an objection, you do not have to visit the Court to talk about it. As long as you filed your written objection on time with the Court and mailed it according to the instructions provided in Question 15, the Court will consider it.

You may ask the Court for permission to speak at the Final Fairness Hearing. To do so, you must file an objection according to the instructions in Question 15, including all the information required. Your objection must be mailed to the Settlement Administrator, at the mailing address listed above, postmarked by no later than October 13, 2026.

If you do nothing, you will not receive any benefits from this settlement. If the settlement is granted final approval and becomes Final, you will not be able to start a lawsuit, continue with a lawsuit, or be part of any other lawsuit against Defendant or the other Related Entities based on any claim that could have been or that was brought relating to the Data Incident.

This Notice summarizes the settlement. More details are in the Settlement Agreement itself. A copy of the Settlement Agreement is available on the Important Documents page of this website. You may also call the Settlement Administrator with questions or to receive a Claim Form at (833) 630-5366.

It is your responsibility to inform the Settlement Administrator of your updated information. You may do so at the address below, calling toll-free (833) 630-5366 or at the Contact Us page of the Settlement Website:

 

Settlement Administrator - 83312

c/o Kroll Settlement Administration

PO Box 225391

New York, NY 10150-5391
 

PLEASE DO NOT CONTACT THE COURT, CLERK OF THE COURT OR CLASS COUNSEL FOR INFORMATION ABOUT THE CLASS ACTION SETTLEMENT