BAKERSFIELD, September 25 — A California home care provider has closed the book on class action litigation stemming from a cyberattack that went undetected inside its network for the better part of five months, according to a report by Steve Alder in The HIPAA Journal. Vasindas’ Around the Clock Care, Inc., which provides home care services, finalised a settlement over the January 2024 intrusion, with the court approving the agreement and no admission of wrongdoing or liability by the defendant.
The company continues to deny all allegations and claims, maintaining that the plaintiffs suffered no damages as a result of the data incident. The timeline, as ever, is the detail that matters.
Suspicious activity was identified within the company’s computer systems on or around June 18, 2024. The subsequent investigation determined that an unauthorised third party had first accessed the network on January 30, 2024, and maintained access for almost five months. During that period, files were copied from the network containing the personal and protected health information of customers, employees and patients.
What the intruders took
The compromised data spanned names, Social Security numbers, driver’s licence numbers or state identification numbers, financial account information, medical information and health insurance information. The breach was reported to the HHS’ Office for Civil Rights as involving the protected health information of 3,785 individuals, and affected individuals were notified on August 16, 2024. The first class action lawsuit followed on August 27, 2024, alleging the incident was a ransomware attack that could have been prevented had appropriate cybersecurity measures been implemented.
The suit alleged that basic cybersecurity measures had not even been implemented and that there was insufficient monitoring of network activity, since the unauthorised access went undetected for almost five months. A second class action was filed, and the two actions were consolidated as Nelson et al. v.
Vasindas’ Around the Clock Care, Inc. in the Superior Court for Kern County, California.
Terms of the resolution
All parties explored an early resolution. Mediation was not successful, but an agreement was nonetheless reached, and the settlement has now been finalised and approved by the court. Under the terms, the defendant will pay attorneys’ fees and expenses, settlement administration costs, and service awards for the class representatives.
Class members are entitled to claim a two-year membership to a medical data monitoring service and may also claim one of two cash payments. A claim may be submitted for compensation for documented, unreimbursed losses due to the data breach up to a maximum of $2,500, or class members may claim an alternative one-time cash payment of $70.
The clock is now running on the administrative side. The deadline for objection and opting out is October 26, 2026. The deadline for submitting a claim is November 23, 2026, and the final fairness hearing is scheduled for December 3, 2026.
For an industry handling precisely the categories of data that make a breach expensive, the technical reality here is unremarkable and that is the point. Under the hood, the failure was one of visibility: an intruder resident in the network for months while files were copied out.
The HIPAA Journal, which reported the settlement, describes itself as the leading provider of HIPAA training, news, regulatory updates and independent compliance advice. Alder, its editor-in-chief, is responsible for editorial policy on the topics covered and has a decade of experience writing about HIPAA and related legal topics. What to watch next is procedural rather than technical.
Class members have until late November to file claims, objections and opt-outs fall due in October, and the fairness hearing in December will determine whether the resolution holds. After that, the only remaining question is whether the monitoring and payment terms prove adequate to those who were notified back in August 2024.
