Case research · Sources checked October 12, 2026
Ascension Health May 2024 ransomware data breach class action
Plaintiffs allege that on May 8, 2024 Ascension's technology network suffered a ransomware attack in which hackers copied electronic files containing patients' protected health information and personally identifiable information. The complaint claims that Ascension's December 2024 notices disclosed that the files could include names, dates of birth, addresses, medical records, payment information, insurance information and government identification numbers.
Every line on this page is checked against the court docket and the regulators involved. We do not decide whether you are part of this case or match you with a lawyer. What we do is help you get the medical records that matter, from any provider.
- Status
- Active
- Court
- U.S. District Court for the Eastern District of Missouri, Eastern Division
- Docket
- No. 4:24-cv-00669-JAR (lead case; the court states fourteen cases involving the same breach are consolidated into it)
- Judge
- Hon. John A. Ross
- Started
- May 14, 2024
- Defendants
- Ascension Health, Ascension Health-IS, Inc. d/b/a Ascension Technologies, Ascension Health Alliance
Where it stands
As of October 12, 2026
The consolidated case is proceeding in discovery before Judge Ross. On September 23, 2025 the court granted in part and denied in part Ascension's motion to dismiss the amended Negron complaint, allowing negligence, negligence per se (HIPAA-based) and several state statutory claims to proceed while dismissing contract, unjust enrichment, invasion of privacy and certain state-law counts. On April 9, 2026 the court ruled on the motion to dismiss the consolidated Coton complaint, dismissing its Stored Communications Act, implied-contract and unjust-enrichment counts but allowing negligence and breach of fiduciary duty to proceed with the lead case. No class has been certified and no settlement appears in any court document reviewed.[2]
The complaint
What is alleged, and what is not decided
Plaintiffs allege that on May 8, 2024 Ascension's technology network suffered a ransomware attack in which hackers copied electronic files containing patients' protected health information and personally identifiable information. The complaint claims that Ascension's December 2024 notices disclosed that the files could include names, dates of birth, addresses, medical records, payment information, insurance information and government identification numbers. Plaintiffs assert negligence, negligence per se and various state consumer-protection and health-privacy statutory claims, and allege risk of identity theft, time spent on mitigation, fraudulent account activity and disrupted medical care. Ascension denies the claims; the court has made no finding of liability.
On the record
What the regulators and the court have said
- 01
State attorney-general breach filing (Maine): entity 'Ascension Health'; date breach occurred 02/29/2024; date discovered 05-08-2024; total persons affected 5,599,699 (658 Maine residents); type 'External system breach (hacking)'; consumer notice sent 12/19/2024; 24 months of credit and CyberScan monitoring via IDX offered.[4]
- 02
Delaware Attorney General update letter (Feb. 3, 2025) from counsel for Ascension states Ascension 'has finalized its analysis of affected data and completed mailing notice to applicable individuals,' with approximately 616 Delaware residents notified by mail.[5]
- 03
The court's September 23, 2025 order recites that, beginning in December 2024, Ascension informed consumers the files could include names, dates of birth, addresses, medical records, payment information, insurance information and government ID numbers, and that Ascension offered 24 months of credit monitoring and identity-theft recovery services.[1]
Timeline
How the case has moved
Date of the ransomware attack on Ascension's technology network (as alleged and recited by the court); Ascension posted a website notice on May 9, 2024.[1]
Negron class action filed in E.D. Mo.; amended complaint filed October 2024.[1]
Ascension sends individual breach notices; its filing with the Maine Attorney General reports 5,599,699 total persons affected, breach occurring 02/29/2024 and discovered 05/08/2024, 'External system breach (hacking)', with 24 months of credit and CyberScan monitoring through IDX.[4]
Coton v. Ascension Health (No. 4:25-cv-00072) consolidated into the Negron lead case; the court notes fourteen cases involving the same breach are consolidated.[2]
Memorandum and Order granting in part and denying in part Ascension's motion to dismiss; negligence and multiple state statutory claims proceed, standing found for future-risk and mitigation injuries.[1]
Memorandum and Order on Ascension's motion to dismiss the consolidated Coton complaint; Stored Communications Act, implied contract and unjust enrichment dismissed; negligence and breach of fiduciary duty proceed.[2]
If this involves you
The records that matter, and who has them.
Whatever you decide to do next, you will be asked for these. They are yours by law, and most providers have up to 30 days to send them once they have your signed request.
Ascension breach notification letter (mailed on or after December 19, 2024)
Confirms you are on Ascension's notification list and lists the specific categories of your data involved; the proposed nationwide class is defined by people 'whose Personal Information was compromised in the Data Breach discovered by Ascension in May 2024.'
Held by: You; Ascension's notification call center (listed in the letter)
IDX credit/CyberScan monitoring enrollment confirmation
Shows you enrolled in the 24-month monitoring Ascension offered and when, documenting your mitigation steps.
Held by: You; IDX
Your Ascension medical records (visit notes, test results, imaging) and patient-portal records for care before May 2024
Establish which encounters, diagnoses and records were held in Ascension systems at the time of the attack; also let you check for inaccurate or unfamiliar entries if your identity was misused for care.
Held by: Ascension hospital or clinic HIM / medical records department; Ascension patient portal
Ascension billing statements and your insurer's EOBs around and after May 2024
Payment card, bank account and insurance information were among the data categories Ascension disclosed; EOBs and statements show the accounts that were on file and reveal unrecognized charges or claims.
Held by: Ascension patient billing; your health insurer
Documentation of disrupted care during the May 2024 outage (rescheduled procedures, delayed prescriptions)
The court accepted disruptions in medical care as a cognizable injury at the pleading stage; appointment records and pharmacy records date and document them.
Held by: Ascension scheduling/medical records; your pharmacy
Credit reports, bank/credit alerts and any identity-theft report
Dated evidence of fraudulent activity after the breach is what the court treated as a present injury for standing.
Held by: Credit bureaus; your bank; FTC IdentityTheft.gov; police
We send the request, follow up with the provider, and deliver the records to you. We don't take case details here and we never share your records with a law firm unless you tell us to.
Questions people ask
Straight answers, with sources
Is the Ascension data breach lawsuit real, and which court is handling it?
Yes. The lead case is Negron v. Ascension Health, No. 4:24-cv-00669-JAR, in the U.S. District Court for the Eastern District of Missouri before Judge John A. Ross; the court states fourteen cases about the same breach are consolidated into it. It is not a multidistrict litigation (MDL).[2]
How many people were affected?
Ascension's breach filing with the Maine Attorney General reports 5,599,699 persons affected in total, with consumer notices sent December 19, 2024.[4]
What has the court decided so far?
On September 23, 2025 the court let negligence, HIPAA-based negligence per se and several state statutory claims proceed while dismissing contract, unjust enrichment, invasion of privacy and some state-law counts. On April 9, 2026 it dismissed the consolidated Coton complaint's Stored Communications Act, implied-contract and unjust-enrichment counts but allowed negligence and breach of fiduciary duty to go forward.[1]
Is there a settlement or a claim form?
No. As of October 12, 2026, no court document reviewed reports a class certification, settlement or claims process in this litigation.[2]
What information did Ascension say was involved?
According to the court's recitation of Ascension's December 2024 notices, the files could include names, dates of birth, addresses, medical records, payment information (card and bank account numbers), insurance information and government ID numbers such as Social Security, driver's license and passport numbers; Ascension offered 24 months of credit monitoring.[1]
Sources
Where every fact on this page comes from
Primary sources only: court orders, the Judicial Panel on Multidistrict Litigation, federal regulators and state attorneys general. Each entry shows the day we opened it. This is reference material, not legal or medical advice.
- [1]Memorandum and Order, Negron v. Ascension Health, No. 4:24-CV-00669-JAR (E.D. Mo. Sept. 23, 2025)
U.S. Courts via GovInfo · govinfo.gov · opened October 12, 2026
Grants in part and denies in part Ascension's motion to dismiss; recites May 8, 2024 attack and December 2024 notices.
- [2]Memorandum and Order, Coton v. Ascension Health (consolidated into No. 4:24-CV-00669-JAR) (E.D. Mo. Apr. 9, 2026)
U.S. Courts via GovInfo · govinfo.gov · opened October 12, 2026
Confirms consolidation of fourteen cases into Negron and rules on the Coton motion to dismiss.
- [3]Negron v. Ascension Health (24-669) — case details
U.S. Courts via GovInfo · govinfo.gov · opened October 12, 2026
GovInfo record for the E.D. Mo. case with April 9, 2026 as latest document date.
- [4]Data Breach Notification — Ascension Health
Office of the Maine Attorney General · maine.gov · opened October 12, 2026
5,599,699 persons affected; breach occurred 02/29/2024, discovered 05/08/2024; notices 12/19/2024; IDX monitoring.
- [5]Ascension Delaware Notification Update Letter (Feb. 3, 2025)
Delaware Department of Justice (Attorney General) · attorneygeneral.delaware.gov · opened October 12, 2026
Ascension completed mailing of notices; ~616 Delaware residents.