Rebound Orthopedics agrees to $2.5 million settlement in class action lawsuit over data breach
Rebound Orthopedics & Neurosurgery will settle a class action lawsuit brought by former patients alleging that during a February 2024 cyberattack on Rebound's computer systems, files that contained private information may have been accessed.
Clark County Superior Court Judge Gregory Gonzales approved the $2.5 million settlement Friday, noting it's the highest compensation he's approved in a class action lawsuit this year.
Attorney Kaleigh Boyd, representing plaintiffs in the settlement class, said she was proud of the final approval.
"The overwhelming response of the class has been positive," Boyd said. "This is among the highest claims rate I have ever seen in a class action. It supports the court's findings that the settlement is fair, reasonable and adequate."
Rebound CEO Doug Klucevek said cybersecurity attacks against healthcare organizations are unfortunately a reality across the country. Since the incident, the organization has continued to strengthen safeguards, improve monitoring and response capabilities, and invest in the resilience of its systems.
"We responded quickly, brought in experienced cybersecurity and legal professionals, cooperated with appropriate authorities, and completed a thorough review and remediation process," Klucevek said. "Our priority remains the same: protecting our patients, our team and the community we serve."
On Feb. 3, 2024, Rebound detected unusual activity in its computer systems and determined a third party had accessed its network and obtained certain files, according to the lawsuit filed last year.
As a result of the cyberattack, personal information such as full names, dates of birth, Social Security numbers, driver's license numbers, medical information, health insurance information and financial account data was compromised, court records state.
That lawsuit said Rebound didn't notify patients of the data breach until a year after it happened, failing to say whether it was contained or ended. It also did not identify how it occurred, according to the lawsuit.
In December, both parties agreed to settle the case for $2.5 million. Plaintiffs could enroll in two years of credit and medical data monitoring services in addition to cash payment.
Rebound has operated several medical and physical therapy clinics across Southwest Washington and Oregon for the past 40 years, including locations in Vancouver, Camas, Salmon Creek, Battle Ground and Ridgefield.
Each clinic specializes in a variety of services, including orthopedics, neurosurgery, physical medicine and rehabilitation, physical therapy, and hand therapy. The company also provides physicians for the Portland Trail Blazers and the Portland Winterhawks. Rebound was recently designated as a medical provider for the United States Olympic and Paralympic Committee.
In October 2018, Rebound announced it experienced a data breach five months earlier that may have revealed personal health information. About 2,800 patients were potentially affected by the breach.
Klucevek recently told The Columbian the organization had "invested millions" in shoring up security and improving cybersecurity protections since the two incidents.
This story was made possible by Community Funded Journalism, a project from The Columbian and the Local Media Foundation. Top donors include the Ed and Dollie Lynch Fund, Patricia, David and Jacob Nierenberg, Connie and Lee Kearney, Steve and Jan Oliva, The Cowlitz Tribal Foundation and the Mason E. Nolan Charitable Fund. The Columbian controls all content. For more information, visit columbian.com/cfj.
Unlock all stories. Stay informed.
Starting at just $1.99/week
Become a subscriber and get unlimited access to every story, plus our ePaper and app for seamless reading anywhere. Stay informed, support local journalism, and stay connected to your community.
Subscribe today
Copyright 2026 Tribune Content Agency. All Rights Reserved.