Bell Ambulance Data Breach Settlement $2 Million for Up to $5,000 Claims

In February 2025, Bell Ambulance reported a targeted cyberattack that may have exposed sensitive personal information, including Social Security numbers, dates of birth, driver’s license details, financial data, and—importantly for patients—medical records and health insurance information. If you were a U.S. resident and your data may have been affected, a class action settlement now offers a pathway to reimbursement or protective services. Bell Ambulance has agreed to resolve the lawsuit by creating a $2 million fund, which can provide up to $5,000 for documented out-of-pocket losses, a smaller one-time cash option, and up to two years of specialized credit and medical-identity monitoring for eligible claimants. The lawsuit was filed because the plaintiffs alleged Bell Ambulance did not take adequate steps to safeguard protected information before or during the breach. While Bell Ambulance denies wrongdoing, settlement is meant to avoid the time, expense, and uncertainty of continuing litigation—an approach common in data-breach cases even when companies dispute liability. In this settlement, eligibility extends to affected individuals whether or not they received direct notice, and claims can be submitted online or by mail by June 29, 2026, with an opt-out deadline of June 15, 2026. The case is significant because it reflects growing legal and consumer-pressure expectations that organizations handling medical and identity data must meet strong cybersecurity and privacy standards under U.S. regulations such as HIPAA (for health data) and breach-notification obligations enforced through frameworks that include state privacy laws, plus broader consumer-protection principles. More broadly, settlements like this are increasingly common as healthcare-adjacent businesses and other data custodians face lawsuits tied to unauthorized access, identity theft risk, and medical record exposure. Similar cases often hinge on what safeguards were in place, how promptly systems were updated or monitored, and whether the company’s security practices were “reasonable” given the type of data involved—especially information that can fuel fraud or disrupt healthcare access. Here, the inclusion of medical-identity monitoring and insurance underscores the industry reality that breaches involving health data can be more damaging than typical financial-only incidents, and that regulators and courts have heightened attention on how organizations protect and respond to cyber threats.