$19M in Settlements Underscore Cybersecurity Risks for TPAs and Insurers

In two related actions, third party administrators (TPAs) and their insurance business partners agreed to substantial settlements over alleged failures to safeguard sensitive data from cyberattacks, according to data from DataBreaches[.]Net.

In the first case, settled in September 2025, a TPA serving self-funded employers and its co-defendant insurers agreed to pay $13.75 million to resolve claims tied to a 2023 data breach that allegedly compromised the PHI of more than 2.5 million individuals, including a California resident subclass, with the consolidated suits filed in the U.S. District Court for the Northern District of Texas, Dallas Division.

The second settlement, finalised in October 2025, resolved a Texas class action over a 2024 data breach affecting the personal and health information of more than 800,000 policyholders, alleging failures to implement reasonable cybersecurity measures. In both cases, the defendants did not admit liability but agreed to settlements of $6 million in the later action and $13.75 million in the earlier one, according to The National Law Review.