Loading story…
Omni Family Health, a nonprofit network of community health centers in California, has agreed to pay $6.5 million to settle class action lawsuits stemming from a 2024 cyberattack that compromised the personal information of nearly 470,000 patients and employees. The breach, attributed to the ransomware group Hunters International, resulted in sensitive data being leaked on the dark web and prompted legal action from affected individuals across the United States. As part of the settlement, Omni Family Health will also implement enhancements to its data security program to prevent future incidents.
The settlement covers all U.S. residents whose information was potentially exposed in the incident, with a specific subclass for California residents affected between August 2024 and January 2026. The organization, which operates about 40 health centers in four California counties, has faced significant scrutiny and is taking steps to address the fallout from the breach, including offering compensation to victims and committing to improved cybersecurity measures.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
A final approval hearing for the proposed Omni Family Health settlement was scheduled for Feb. 26, 2026. The settlement also set a Jan. 5, 2026 claims deadline for affected individuals.
Omni Family Health agreed to pay $6.5 million to settle proposed class action lawsuits arising from the 2024 cyberattack. The settlement includes reimbursement for losses, monitoring services, and commitments to security and business-practice improvements, while Omni denied wrongdoing.
On Oct. 4, 2024, Omni Family Health reported the incident to the U.S. Department of Health and Human Services, stating that 468,344 individuals were affected. The organization also said it had engaged outside cybersecurity specialists and notified federal law enforcement.
Omni Family Health said it became aware on Aug. 7, 2024 of claims that information stolen in the cyberattack had been posted on the dark web. The incident was later tied to a ransomware attack affecting patients and employees.
In August 2024, the ransomware group Hunters International added Omni Family Health to its dark web leak site, publicly claiming responsibility for the attack. This marked the public emergence of the incident in ransomware extortion channels.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Heritage Provider Network, one of the largest physician-owned healthcare networks in the United States, and nine of its affiliated physician practices have agreed to pay nearly $50 million to settle consolidated class action lawsuits stemming from a major ransomware and data theft incident in December 2022. The breach affected more than 3.4 million current and former patients, whose sensitive personal and medical information was compromised. The impacted practices include Regal Medical Group, Lakeside Medical Organization, Greater Covina Medical Group, Affiliated Doctors of Orange County Medical Group, Arizona Health Advantage, AZPC Clinics, Community Surgery Center of Glendale, Pacific Family Hospice, and Valley’s Best Hospice. Plaintiffs in the lawsuits alleged that the compromised data, which included names, Social Security numbers, addresses, dates of birth, and medical information, was leaked on the dark web. Notices about the breach were sent to affected individuals in early 2023, alerting them to the exposure of their information. The $49.9 million settlement provides each class member with three years of complimentary identity and theft monitoring services. Eligible class members who submit valid claims can receive cash payments of up to $10,000 for documented fraud or out-of-pocket expenses related to the breach. The settlement aims to address the alleged failure of Heritage Provider Network and its affiliates to adequately protect patient data, as detailed in the class action complaints. The legal resolution covers an estimated 3,413,000 individuals who received notification of the breach. The settlement was reached after plaintiffs claimed that the defendants’ security measures were insufficient to prevent the ransomware attack and subsequent data theft. The incident has highlighted the ongoing risks faced by healthcare organizations in protecting sensitive patient information from cybercriminals. The settlement also underscores the significant financial and reputational consequences that can result from large-scale healthcare data breaches. Heritage Provider Network and its affiliates have not admitted wrongdoing but agreed to the settlement to resolve the litigation. The case serves as a reminder for healthcare providers to continually assess and strengthen their cybersecurity posture to mitigate the risk of future incidents. The settlement is one of the largest in recent years for a healthcare data breach, reflecting the scale and impact of the incident. Affected patients are encouraged to review the settlement terms and submit claims if eligible.
Jun 29, 2026
Several healthcare organizations are resolving class-action litigation tied to alleged exposure of sensitive patient data, with settlements emphasizing cost avoidance rather than admissions of wrongdoing. **Kaiser Permanente** agreed to a **$46 million** settlement over claims that patient interactions with certain Kaiser websites and digital tools resulted in personal health information being transmitted to third parties (including **Google, Microsoft Bing, Twitter/X, and Adobe**) via online tracking/advertising technologies; the allegations focus on web/digital activity rather than Kaiser’s core electronic medical record systems, and the proposed class period spans **2017–2024**. Separately, two healthcare entities reached settlements following **network intrusions** that allegedly exposed protected health information and other sensitive identifiers. **Mystic Valley Elder Services** agreed to pay **$520,000** to settle claims stemming from an **April 2024** incident in which attackers accessed its network and potentially obtained data including SSNs, financial/payment data, credentials, and medical/insurance information affecting **~89,600** people; plaintiffs also alleged delayed detection and notification. **Consulting Radiologists Ltd.** received approval for a **$2.2 million** settlement after a 2024 intrusion affecting up to **583,824** individuals, with allegations including inadequate security controls and delayed breach notification; the organization reported that some impacted records included medical/insurance data and SSNs (for a subset of individuals).
Jun 29, 2026
**General Physician, P.C.** agreed to pay **$2.5 million** to settle consolidated class-action litigation tied to a **2024 email-environment compromise** that exposed sensitive patient data. The organization detected suspicious activity on **June 12, 2024**, and a forensic investigation found an unauthorized party had accessed its email system from **April 6 to June 12, 2024**. Potentially exposed data included **SSNs, financial account information, dates of birth, medical and treatment details, diagnoses, medical record numbers, and insurance information**; the affected population was later updated to **167,387 individuals** (after an initial placeholder report of 501 to HHS OCR). The settlement fund is intended to provide class benefits after fees/expenses, and the company did not admit wrongdoing. Two additional California healthcare providers reported separate security incidents involving unauthorized access to systems containing patient information. **Valley Radiology Consultants Medical Group** identified a breach on **September 15, 2025**, engaged third-party incident response support, confirmed unauthorized access to its network and files, and began mailing notifications after completing file review on **February 18, 2026**; it also offered **12 months of credit monitoring** and reported taking remediation steps (e.g., password changes and security enhancements). **Nephrology Associates Medical Group** separately began notifying patients about a cyberattack first identified on **May 20, 2025** (details in the provided excerpt are truncated), indicating another healthcare-sector intrusion with patient data exposure risk.
Jun 29, 2026