A cyberattack on Dental Group of Amarillo LLP on Oct. 26, 2023 allegedly exposed files containing patients’ sensitive personal and medical information—such as names and contact details, Social Security and driver’s license numbers, and health-related records. Data breaches like this have become a persistent risk across healthcare and dental practices because providers store a mix of financial identifiers and protected health information, which can be used for identity theft, fraudulent medical billing, or targeted scams. The class action lawsuit was filed on behalf of patients who received breach notices, claiming the practice failed to adequately safeguard the data; while the company denies wrongdoing, it agreed to a $1 million settlement to avoid the cost and uncertainty of litigation. Eligible class members can claim up to $5,000 for documented out-of-pocket losses tied to the incident, choose a flat $125 payment, or elect three years of three-bureau credit monitoring with related identity-protection features—highlighting how these cases often focus less on proving exactly who suffered fraud and more on compensating time, risk, and remediation expenses after a breach. More broadly, this settlement fits a familiar pattern in healthcare data-breach litigation, where organizations face claims under state privacy and consumer-protection theories alongside industry expectations to implement “reasonable” security controls. Providers are also shaped by HIPAA’s privacy and security rules for protected health information and the HITECH Act’s breach-notification requirements, and similar suits have pushed many medical and dental groups to strengthen vendor oversight, access controls, encryption, and incident response plans to reduce the likelihood—and legal exposure—of future intrusions.