Upstream Rehabilitation, a major physical therapy company operating more than 1,200 locations across the United States, has agreed to a $4.3 million settlement in a class-action lawsuit stemming from a data breach in 2023. The breach, which spanned two separate periods in late January and early February 2023, allegedly compromised sensitive patient data including names, birth dates, demographic and diagnosis information, and health insurance data. The lawsuit was filed by plaintiffs who argued that the breach could have been prevented with adequate cybersecurity measures, and that Upstream Rehabilitation failed to adequately safeguard their personal information. The settlement, though not an admission of wrongdoing on the part of Upstream Rehabilitation, offers compensation to those whose data was affected. Class members are eligible to receive up to three years of credit monitoring and up to $5,000 for documented losses related to the breach, such as fraudulent charges, identity theft damages, and certain professional fees. Those who did not suffer measurable losses may also be entitled to a share of the net settlement fund, estimated to be at least $50 per claimant.