FOLLOW US

A Tennessee medical provider has agreed to resolve sweeping class action litigation tied to a cyberattack that exposed the sensitive health information of more than half a million patients, closing a legal chapter born from a digital break-in that rippled across the state.

Murfreesboro Medical Clinic & SurgiCenter confirmed it has reached a settlement over a data breach discovered in April 2023 that involved unauthorized access to the protected health information of roughly 559,000 individuals. The agreement has received preliminary court approval.

A Cyber Intrusion With Far-Reaching Impact

According to court filings, the clinic determined that a “well-known cyber extortion operation” infiltrated its network on or about April 22, 2023, and siphoned off patient and employee data. Affected information ran deep and wide, including names, birth dates, home addresses, phone numbers and copies of driver’s licenses, as well as full or partial Social Security numbers.

The breach also exposed dependent details, dates of service, diagnostic and medical information connected to those visits, test results, procedure notes, prescription data, medical record numbers, and insurance and enrollment information. Patients were notified of the incident in May 2023. The BianLian ransomware group later claimed responsibility, according to the filings.

Like a vault left briefly unguarded, the network intrusion unlocked years of personal records in a matter of moments.

Lawsuits Consolidated, Liability Denied

Six class action lawsuits followed the breach. On Sept. 7, 2023, the cases were consolidated into a single action — Krenk et al. v. Murfreesboro Medical Clinic and SurgiCenter and Murfreesboro Medical Clinic — in the 16th Judicial Circuit Court of Rutherford County, Tennessee.

The consolidated complaint alleged the cyberattack stemmed from negligence and failures to meet statutory and common law duties to protect sensitive information. The clinic and its affiliated entities have denied all allegations of wrongdoing and liability.

Why the Parties Chose to Settle

After extensive exchanges of information and mediation, all sides agreed a settlement offered the most practical path forward, citing the costs, delays and uncertainty of prolonged litigation. The agreement was endorsed by all parties and granted preliminary approval by the court.

Under the terms, the settlement provides for attorneys’ fees and expenses of up to $350,000, along with service awards of $3,000 for each class representative, totaling $24,000.

Compensation, Monitoring and Caps

Class members may seek reimbursement of up to $500 for documented, unreimbursed out-of-pocket expenses linked to the breach. This includes compensation for up to two hours of lost time, calculated at $25 per hour. Claims for lost time are subject to an aggregate cap of $200,000 and will be distributed on a pro rata basis if claims exceed that amount.

In addition, eligible individuals may claim two years of credit monitoring and identity theft protection services, which include an identity theft insurance policy valued at $1 million.

Security Changes Beyond the Settlement

Separate from monetary relief, Murfreesboro Medical Clinic & SurgiCenter has agreed to strengthen its cybersecurity posture. The clinic committed to maintaining a comprehensive information security program for at least three years, training staff on data protection and how to spot suspicious emails, enhancing firewall and data segregation protocols, and enforcing record deletion procedures.

The agreement also requires the clinic to maintain a formal policy for responding to future data security incidents.

Key Dates Ahead

A final fairness hearing is scheduled for Jan. 16, 2026. Class members must submit claims by April 14, 2026.

As the case moves toward closure, the Murfreesboro 559K Data Breach settlement stands as both a reckoning for a massive cyber incident and a reminder of the stakes when digital defenses fail.