Asheville Arthritis Data Breach

A proposed $500,000 settlement has been reached in a class action lawsuit known as Stiwinter et al. v. Asheville Arthritis and Osteoporosis Center, P.A., Case No. 24 CVS 208570-100 (“Action”), filed in Buncombe County, North Carolina and transferred to the North Carolina Business Court.

This Action arises out of a Data Incident and alleges that in or around May 2024, Defendant became aware of a Data Incident impacting certain company systems.

The Data Incident was found to have compromised the private and personally identifying information stored in Defendant’s files, including patients’ names, addresses, dates of birth, telephone numbers, Social Security numbers, and certain medical information such as medical notes, lab results, diagnoses, and health insurance information.

Roughly 58,000 people were impacted as a result of this Data Incident. Defendant disputes Plaintiffs’ claims and denies any wrongdoing.

Your Legal Rights and Options in This Settlement

Submit a Claim Form	The deadline to submit a Claim Form was January 26, 2026. Claim Forms are no longer being accepted.
Do Nothing	You give up your rights to sue and you will not get any cash compensation or reimbursement as a Class Member.
Exclude Yourself	The deadline to exclude yourself from the Settlement was January 26, 2026. Requests for Exclusion are no longer being accepted.
File an Objection	The deadline to object to the Settlement was January 26, 2026. Objections are no longer being accepted.
Go to a Hearing	You can ask to speak in Court about the fairness of the Settlement, at your own expense. See FAQ 18 for more details. The Final Approval Hearing is scheduled for February 9, 2026, at 10 a.m. ET.