St. Joseph Health has finalized a class-action lawsuit settlement for a 2012 data breach that affected 31,000 patients.

The affected patients will split $7.5 million, with each getting about $242, according to The Orange County Register. The health system in Irvine, Calif., also paid $7.5 million in attorneys fees and costs.

The patients' personal health information, including lab results and body mass indices, was exposed on the internet. 

Plaintiffs who suffered identity theft losses can apply for up to $25,000, according to the report, as an additional $3 million is set aside for that.

Since the breach, St. Joseph has spent more than $17 million on upgrading security systems and $4.5 million on credit monitoring for affected patients, according to the report.

"St. Joseph Health is pleased that we could come to a settlement on this issue and regrets any undue concern to our patients," according to a statement from the health system. "Since the situation was discovered, we have invested in a number of initiatives to ensure the continued security of patient data, including enhanced data security infrastructure. These measures and more are intended to provide for the safety and security of our patients’ information."