Community Health System, located in Tennessee, has agreed to settle claims made against it arising from a 2014 data breach for $4.5 million. The data breach, believed to be caused by Chinese hackers, compromised the names, dates of birth, addresses, telephone numbers, and Social Security numbers of 4.5 million patients of the hospital system, which operates in multiple states.

Community Health System advised the Securities and Exchange Commission that it was compromised with malware between April 2014 and June 2014.

The settlement must be approved by the Judge, but claimants have until May to opt-out of the class action settlement and August to file a notice of claim. Claimants who can show that they have suffered from identity theft or fraud may be entitled to up to $5,000 and those who can substantiate out of pocket expenses and time lost can receive up to $250. The named plaintiffs are entitled to $3500 each and their attorneys seek up to $900,000.