Loading story…
HCA Healthcare reached a multimillion-dollar settlement to resolve consolidated class action lawsuits stemming from a 2023 data breach that exposed the personal information of nearly 11.3 million patients. The breach involved hackers accessing an external storage location used for automating email formatting, resulting in the theft of patient data such as names, addresses, emails, telephone numbers, gender, service dates, locations, and upcoming appointment dates. HCA confirmed that no clinical, financial, driver’s license, or Social Security information was compromised in the incident.
A Tennessee federal court approved the settlement, which does not specify the total payout amount but allocates $3.1 million for class counsel attorney fees. Some of the stolen data was posted on an online forum by an unidentified party. The settlement brings closure to 27 lawsuits filed against the for-profit healthcare operator following the breach, aligning with recent trends in health data breach litigation outcomes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A court finalized the class action settlement related to the HCA data breach. The references do not provide additional details about the underlying breach timeline or settlement terms.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hospital Sisters Health System (HSHS), a network comprising 13 Catholic hospitals, community health centers, and clinics in the Midwest, has agreed to a $7.6 million settlement to resolve consolidated class action litigation stemming from a significant cyberattack in August 2023. The targeted attack compromised the personally identifiable information (PII) and protected health information (PHI) of approximately 882,782 individuals. The breach exposed sensitive patient data, raising concerns about identity theft and medical fraud among those affected. As part of the settlement, HSHS will offer up to $5,000 in compensation to each eligible class member who can demonstrate out-of-pocket losses directly linked to the incident. Alternatively, affected individuals may opt for a pro-rated cash payment, the amount of which will be determined after accounting for all valid claims and the costs of additional services. The settlement also includes the provision of 24 months of complimentary credit and identity monitoring services to help mitigate the risk of further harm. HSHS has committed to enhancing its data security practices as a condition of the settlement, aiming to prevent similar incidents in the future. The breach and subsequent litigation highlight the growing financial and reputational risks healthcare organizations face from cyberattacks. The incident underscores the critical importance of robust cybersecurity measures in the healthcare sector, where the value of patient data makes organizations prime targets for threat actors. The settlement reflects the increasing trend of legal and financial accountability for healthcare providers following major data breaches. The attack on HSHS is part of a broader pattern of escalating cyber threats against healthcare institutions, which often result in significant costs for detection, response, and recovery. The litigation and settlement process has drawn attention to the need for proactive risk management and incident response planning in healthcare. The case also demonstrates the legal recourse available to victims of healthcare data breaches, including compensation for direct financial losses. HSHS's response, including the settlement and security improvements, may serve as a model for other organizations facing similar incidents. The breach has prompted renewed calls for industry-wide adoption of stronger cybersecurity frameworks and regular security assessments. The incident has also contributed to ongoing discussions about regulatory requirements and best practices for protecting sensitive health information. Overall, the HSHS breach and its aftermath illustrate the complex challenges and high stakes involved in safeguarding healthcare data in an increasingly hostile cyber threat landscape.
Jun 29, 2026
Heritage Provider Network, one of the largest physician-owned healthcare networks in the United States, and nine of its affiliated physician practices have agreed to pay nearly $50 million to settle consolidated class action lawsuits stemming from a major ransomware and data theft incident in December 2022. The breach affected more than 3.4 million current and former patients, whose sensitive personal and medical information was compromised. The impacted practices include Regal Medical Group, Lakeside Medical Organization, Greater Covina Medical Group, Affiliated Doctors of Orange County Medical Group, Arizona Health Advantage, AZPC Clinics, Community Surgery Center of Glendale, Pacific Family Hospice, and Valley’s Best Hospice. Plaintiffs in the lawsuits alleged that the compromised data, which included names, Social Security numbers, addresses, dates of birth, and medical information, was leaked on the dark web. Notices about the breach were sent to affected individuals in early 2023, alerting them to the exposure of their information. The $49.9 million settlement provides each class member with three years of complimentary identity and theft monitoring services. Eligible class members who submit valid claims can receive cash payments of up to $10,000 for documented fraud or out-of-pocket expenses related to the breach. The settlement aims to address the alleged failure of Heritage Provider Network and its affiliates to adequately protect patient data, as detailed in the class action complaints. The legal resolution covers an estimated 3,413,000 individuals who received notification of the breach. The settlement was reached after plaintiffs claimed that the defendants’ security measures were insufficient to prevent the ransomware attack and subsequent data theft. The incident has highlighted the ongoing risks faced by healthcare organizations in protecting sensitive patient information from cybercriminals. The settlement also underscores the significant financial and reputational consequences that can result from large-scale healthcare data breaches. Heritage Provider Network and its affiliates have not admitted wrongdoing but agreed to the settlement to resolve the litigation. The case serves as a reminder for healthcare providers to continually assess and strengthen their cybersecurity posture to mitigate the risk of future incidents. The settlement is one of the largest in recent years for a healthcare data breach, reflecting the scale and impact of the incident. Affected patients are encouraged to review the settlement terms and submit claims if eligible.
Jun 29, 2026
Group Health Cooperative of South Central Wisconsin agreed to a $3.5 million settlement to resolve a class action lawsuit following a data breach that exposed the protected health information (PHI) of over 533,000 individuals. The breach, detected in January 2024, involved unauthorized access to sensitive data including names, Social Security numbers, and Medicare/Medicaid numbers. The settlement, which has received preliminary court approval, will compensate affected class members and was reached to avoid the costs and risks of continued litigation, with the defendant denying any wrongdoing. Separately, Concentra Inc. settled with the U.S. Department of Health and Human Services Office for Civil Rights (OCR) for $112,500 over a HIPAA Right of Access violation, after failing to provide a patient with timely access to their medical records despite multiple requests. This enforcement action is part of an ongoing OCR initiative targeting noncompliance with the HIPAA Privacy Rule's right of access provision. These cases highlight the significant financial and legal consequences for healthcare organizations that fail to adequately protect patient data or comply with HIPAA requirements.
Jul 12, 2026