Loading story…
Integris Health and Yale New Haven Health agreed to major class-action settlements tied to separate healthcare data breaches that exposed sensitive patient information and triggered litigation over alleged cybersecurity failures. Yale New Haven Health received preliminary approval for an $18 million settlement after a 2025 breach affected up to 5,556,702 individuals; the incident was detected on March 8, 2025 and involved unauthorized network access and file exfiltration. Exposed data reportedly included names, contact details, dates of birth, race and ethnicity, patient types, medical record numbers, and Social Security numbers, though the electronic medical record system was not accessed.
Integris Health separately agreed to a $30 million settlement to resolve class-action claims stemming from its breach, which had already drawn attention after patients reported receiving extortion emails following the cyberattack. In both cases, plaintiffs alleged the healthcare organizations failed to implement reasonable safeguards to protect patient data, while the settlements provide financial compensation and support services for affected individuals and include commitments to strengthen security controls.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
The final approval hearing for Yale New Haven Health's $18 million data breach settlement was scheduled for March 3, 2026. This marks the next major court milestone in resolving the litigation.
A federal court granted preliminary approval to an $18 million settlement resolving litigation over Yale New Haven Health's 2025 data breach. The settlement includes reimbursement for losses, cash payments, two years of medical data monitoring, and security improvements.
Multiple lawsuits arising from the Yale New Haven Health breach were consolidated into a single action in the U.S. District Court for the District of Connecticut. Plaintiffs alleged inadequate cybersecurity safeguards, which the organization denied.
Integris Health agreed to a $30 million settlement to resolve class action litigation stemming from its data breach. The settlement was reported in October 2025.
Yale New Haven Health detected unauthorized access to its network and file exfiltration. The breach ultimately affected up to 5,556,702 individuals, though its electronic medical record system was not accessed.
Affected Integris Health patients began receiving extortion emails threatening to publish stolen personal and health information. Reporting on December 26, 2023 established this as a significant escalation of the breach's impact.
Integris Health experienced a cyberattack that resulted in the theft of patient data. The incident later led to extortion emails being sent to affected patients and subsequent litigation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcehipaajournal.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Yale New Haven Health System, Connecticut's largest healthcare network, agreed to pay $18 million to settle a class action lawsuit following a major data breach in March that affected nearly 5.6 million individuals. The breach, which was discovered on March 8 after "unusual activity" was detected in the organization's IT systems, involved unauthorized third-party access to sensitive health data, making it the largest health data breach reported to federal regulators in 2025. The settlement received preliminary court approval, with a final hearing scheduled for March 2026. The breach impacted a wide range of individuals associated with Yale New Haven Health, which employs over 12,000 staff and 4,500 physicians across Connecticut. The organization publicly disclosed the incident on March 11, and the legal resolution was reached relatively quickly, about seven months after the disclosure. Details regarding the specific nature of the compromised data or the attack vector have not been disclosed, but the scale of the breach and the rapid legal settlement underscore the significant impact on the healthcare sector and affected individuals.
Jul 12, 2026
Integris Health, the largest nonprofit healthcare network in Oklahoma, agreed to pay $30 million to settle class action lawsuits stemming from a 2023 data breach that compromised the personal information of approximately 2.4 million individuals. The breach involved cybercriminals who not only stole sensitive data but also directly contacted some affected patients, including minors, with ransom and blackmail demands. These demands threatened to sell the stolen data on the dark web if payments were not made. The settlement provides for class members to claim up to $25,000 for documented losses, which explicitly includes reimbursement for any ransom payments made to the attackers. In addition to compensation for direct financial losses, affected individuals can opt for a pro-rated cash payment of about $100. The settlement also offers three years of credit monitoring services, which include up to $1 million in identity theft insurance coverage for each class member. Class representatives are set to receive $5,000 service awards for their roles in the litigation. The legal counsel representing the class will seek court approval for attorney fees as part of the settlement process. Integris Health operates more than 15 hospitals and dozens of clinics across Oklahoma, making the scale of the breach significant in terms of both the number of affected individuals and the potential impact on healthcare operations. The incident highlights the evolving tactics of cybercriminals, who are increasingly targeting patients directly in addition to attacking healthcare organizations. The direct ransom demands to patients represent a particularly aggressive form of extortion, raising concerns about the psychological and financial impact on victims, especially minors. The breach and subsequent legal action underscore the critical importance of robust cybersecurity measures and incident response planning in the healthcare sector. The settlement aims to provide financial relief and monitoring services to those affected, while also serving as a warning to other healthcare providers about the risks of inadequate data protection. The case has drawn attention to the need for improved security practices and greater support for victims of healthcare data breaches. The outcome of the settlement may influence how future cases involving direct patient extortion are handled in the legal system. Integris Health's response, including the settlement and support services, is intended to mitigate the long-term consequences for patients whose data was compromised. The incident is a stark reminder of the high stakes involved in protecting sensitive health information from increasingly sophisticated cyber threats.
Jul 12, 2026
Several healthcare organizations are resolving class-action litigation tied to alleged exposure of sensitive patient data, with settlements emphasizing cost avoidance rather than admissions of wrongdoing. **Kaiser Permanente** agreed to a **$46 million** settlement over claims that patient interactions with certain Kaiser websites and digital tools resulted in personal health information being transmitted to third parties (including **Google, Microsoft Bing, Twitter/X, and Adobe**) via online tracking/advertising technologies; the allegations focus on web/digital activity rather than Kaiser’s core electronic medical record systems, and the proposed class period spans **2017–2024**. Separately, two healthcare entities reached settlements following **network intrusions** that allegedly exposed protected health information and other sensitive identifiers. **Mystic Valley Elder Services** agreed to pay **$520,000** to settle claims stemming from an **April 2024** incident in which attackers accessed its network and potentially obtained data including SSNs, financial/payment data, credentials, and medical/insurance information affecting **~89,600** people; plaintiffs also alleged delayed detection and notification. **Consulting Radiologists Ltd.** received approval for a **$2.2 million** settlement after a 2024 intrusion affecting up to **583,824** individuals, with allegations including inadequate security controls and delayed breach notification; the organization reported that some impacted records included medical/insurance data and SSNs (for a subset of individuals).
Jun 29, 2026