Hospital Auxilio Mutuo in Puerto Rico has agreed to create a $500,000 fund to compensate about 41,000 patients affected by a September 2023 cybersecurity incident, under a settlement of a class-action lawsuit that still needs final court approval. José A. Morales Rosario filed the suit on May 1, 2025, in the U.S. District Court for the District of Puerto Rico, after the hospital disclosed that the attack may have compromised data of patients who visited between August 2022 and September 2023.
Attorney Jorge Vélez Gutiérrez said in 2025 that the data at risk included medical information, insurance details, Social Security numbers, insurance claims, driver’s licenses and passports. After mediation led by Bruce A. Friedman of JAMS, U.S. District Judge María Antongiorgi Jordán granted preliminary approval on August 24, 2026. Class members may claim up to $2,500 per person for documented out-of-pocket losses that more likely than not resulted from the breach, such as losses from identity theft or fraud.
Alternatively, they may claim a one-time $25 payment with no documentation. The settlement also gives two years of free credit and medical monitoring, including up to $1 million in identity theft and fraud insurance per patient who activates it. The hospital must invest more than $1.1 million in strengthening its digital infrastructure.
Claims are due by December 21, 2026, through www.hospitalespanolauxiliosettlement.com. The hospital confirmed the notifications are authentic and denied any wrongdoing, violation or liability. A final fairness hearing is set for January 20, 2027, at 1:30 PM.