Loading story…
Yale New Haven Health System, Connecticut's largest healthcare network, agreed to pay $18 million to settle a class action lawsuit following a major data breach in March that affected nearly 5.6 million individuals. The breach, which was discovered on March 8 after "unusual activity" was detected in the organization's IT systems, involved unauthorized third-party access to sensitive health data, making it the largest health data breach reported to federal regulators in 2025. The settlement received preliminary court approval, with a final hearing scheduled for March 2026.
The breach impacted a wide range of individuals associated with Yale New Haven Health, which employs over 12,000 staff and 4,500 physicians across Connecticut. The organization publicly disclosed the incident on March 11, and the legal resolution was reached relatively quickly, about seven months after the disclosure. Details regarding the specific nature of the compromised data or the attack vector have not been disclosed, but the scale of the breach and the rapid legal settlement underscore the significant impact on the healthcare sector and affected individuals.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Yale New Haven Health agreed to pay $18 million to settle litigation stemming from a hack, according to reports published on October 24, 2025. The references do not provide additional dated details about the underlying incident or settlement timeline.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Integris Health and Yale New Haven Health agreed to major class-action settlements tied to separate healthcare data breaches that exposed sensitive patient information and triggered litigation over alleged cybersecurity failures. Yale New Haven Health received preliminary approval for an **$18 million** settlement after a 2025 breach affected up to **5,556,702 individuals**; the incident was detected on March 8, 2025 and involved unauthorized network access and file exfiltration. Exposed data reportedly included names, contact details, dates of birth, race and ethnicity, patient types, medical record numbers, and Social Security numbers, though the electronic medical record system was not accessed. Integris Health separately agreed to a **$30 million** settlement to resolve class-action claims stemming from its breach, which had already drawn attention after patients reported receiving extortion emails following the cyberattack. In both cases, plaintiffs alleged the healthcare organizations failed to implement reasonable safeguards to protect patient data, while the settlements provide financial compensation and support services for affected individuals and include commitments to strengthen security controls.
Jun 29, 2026
Continuum Health Alliance, a health management provider based in New Jersey, agreed to settle a consolidated class action lawsuit following a data breach in October 2023 that compromised the personal information of over 377,000 patients from its client, Consensus Medical Group. The breach involved unauthorized access to sensitive data, including names and Social Security numbers, and led to multiple legal claims consolidated in New Jersey court. The settlement was reached after mediation, with all parties agreeing it was preferable to continued litigation, though the defendants denied liability. Separately, Denton County MHMR Center in Texas reported a significant data breach affecting nearly 109,000 patients, with unauthorized access occurring in December 2024. The compromised data included a wide range of protected health information, and affected individuals were notified and offered credit monitoring services. Additionally, Conduent, a major medical services provider, disclosed that a 2024 hacking incident impacted nearly 14.8 million Texans, a substantial increase from previous estimates, highlighting the ongoing challenges in accurately assessing the scope of large-scale healthcare data breaches and the risks posed by third-party vendors.
Jun 29, 2026
Heritage Provider Network, one of the largest physician-owned healthcare networks in the United States, and nine of its affiliated physician practices have agreed to pay nearly $50 million to settle consolidated class action lawsuits stemming from a major ransomware and data theft incident in December 2022. The breach affected more than 3.4 million current and former patients, whose sensitive personal and medical information was compromised. The impacted practices include Regal Medical Group, Lakeside Medical Organization, Greater Covina Medical Group, Affiliated Doctors of Orange County Medical Group, Arizona Health Advantage, AZPC Clinics, Community Surgery Center of Glendale, Pacific Family Hospice, and Valley’s Best Hospice. Plaintiffs in the lawsuits alleged that the compromised data, which included names, Social Security numbers, addresses, dates of birth, and medical information, was leaked on the dark web. Notices about the breach were sent to affected individuals in early 2023, alerting them to the exposure of their information. The $49.9 million settlement provides each class member with three years of complimentary identity and theft monitoring services. Eligible class members who submit valid claims can receive cash payments of up to $10,000 for documented fraud or out-of-pocket expenses related to the breach. The settlement aims to address the alleged failure of Heritage Provider Network and its affiliates to adequately protect patient data, as detailed in the class action complaints. The legal resolution covers an estimated 3,413,000 individuals who received notification of the breach. The settlement was reached after plaintiffs claimed that the defendants’ security measures were insufficient to prevent the ransomware attack and subsequent data theft. The incident has highlighted the ongoing risks faced by healthcare organizations in protecting sensitive patient information from cybercriminals. The settlement also underscores the significant financial and reputational consequences that can result from large-scale healthcare data breaches. Heritage Provider Network and its affiliates have not admitted wrongdoing but agreed to the settlement to resolve the litigation. The case serves as a reminder for healthcare providers to continually assess and strengthen their cybersecurity posture to mitigate the risk of future incidents. The settlement is one of the largest in recent years for a healthcare data breach, reflecting the scale and impact of the incident. Affected patients are encouraged to review the settlement terms and submit claims if eligible.
Jun 29, 2026