Numotion agrees to a $4M settlement following a data breach

The settlement follows two 2024 data breaches that impacted Numotion.

What happened

Numotion, a large provider of rehabilitation technology like wheelchairs, recently received preliminary approval for a $4 million settlement in a class action suit. The suit follows two groups of plaintiffs (noted as Numotion I Plaintiffs and Numotion II Plaintiffs), as the class action is the result of two data breaches that took place just a few months apart in 2024.

According to the preliminary approval order, the settlement class is estimated to include over a million people. A final approval hearing is scheduled for April 2nd, 2026, in the United States District Court for the Middle District of Tennessee.

The back story

The class action suit follows two breaches: a March 2024 incident and a September 2024 incident. The first incident took place between February 29th, 2024, and March 2nd 2024, resulting in 685,264 individuals having their private information accessed. After the lawsuit was filed, Numotion filed a motion to dismiss the case, but the motion was partially denied on January 9th, 2025.

The second incident took place on September 29th, 2024, when Numotion determined they had been the victim of a third-party phishing incident. The incident ultimately resulted in approximately 494,326 individuals having their private information accessed.

The big picture

While many organizations become the victim of data breaches for a variety of reasons, two breaches in close proximity signal a need for Numotion to evaluate their cybersecurity practices and the cybersecurity of their vendors. Currently, these breaches have not been officially attributed to any criminal gangs, but most strikes organizations out of opportunity, meaning they go for businesses that have vulnerabilities that can easily be exploited. If a first breach is successful, it may also make the organization more prone to repeat attacks.

Recently, we’ve seen another instance of organizations facing multiple breaches in close proximity. For instance, Survival Flight, faced a data breach in May of 2024 and then another in September of 2025. Multiple breaches against a company can lead to larger class action suits, as is the case in Numotion, as well as more victims.

FAQs

Is it common for class action cases to be combined?

It’s unusual for class action suits to be combined, because it’s uncommon for two lawsuits to be issued against an organization for separate, but very similar, issues. In this case, court documents note that two separate cases would be “impractical” and that the claims from both cases “arise from the same operative facts and seek similar relief.”

Do class members know they are part of the settlement?

Class members are generally notified by the plaintiff’s legal team. Usually, members have to provide their address or contact information to receive payment, but everyone impacted is ultimately included in the class unless they decide to opt-out of the suit, a decision usually only made if victims wish to pursue separate legal action.