Case research · Sources checked October 12, 2026
Yale New Haven Health March 2025 data breach class action (settled)
Plaintiffs allege that on March 8, 2025 cyber criminals breached Yale New Haven Health Services Corporation's IT network and copied files containing patient information, including names, dates of birth, addresses, phone numbers, email addresses, race or ethnicity, Social Security numbers, patient type and medical record numbers, and that the files were stored unencrypted. 6 million individuals were affected and cites an April 11, 2025 report to the HHS Office for Civil Rights listing 5,556,702 individuals.
Every line on this page is checked against the court docket and the regulators involved. We do not decide whether you are part of this case or match you with a lawyer. What we do is help you get the medical records that matter, from any provider.
- Status
- Settlement
- Court
- U.S. District Court for the District of Connecticut
- Docket
- No. 3:25-cv-00609 (SRU)
- Judge
- Hon. Stefan R. Underhill
- Started
- June 12, 2025
- Defendants
- Yale New Haven Health Services Corporation
Where it stands
As of October 12, 2026
Settled and closed to new claims. Judge Underhill granted preliminary approval on October 21, 2025, the opt-out/objection deadline was January 20, 2026 and the claim deadline February 18, 2026, and the court granted final approval at the March 3, 2026 hearing. The settlement website (last updated June 1, 2026) states that all claims have been processed and payments began dispersing on May 27, 2026.[4]
The complaint
What is alleged, and what is not decided
Plaintiffs allege that on March 8, 2025 cyber criminals breached Yale New Haven Health Services Corporation's IT network and copied files containing patient information, including names, dates of birth, addresses, phone numbers, email addresses, race or ethnicity, Social Security numbers, patient type and medical record numbers, and that the files were stored unencrypted. The consolidated complaint alleges that more than 5.6 million individuals were affected and cites an April 11, 2025 report to the HHS Office for Civil Rights listing 5,556,702 individuals. Plaintiffs asserted negligence and negligence per se, breach of implied contract, unjust enrichment and declaratory relief. Yale denied the claims and the court made no finding of wrongdoing; the case was resolved by settlement.
On the record
What the regulators and the court have said
- 01
YNHHS's notification letter filed with the Massachusetts Attorney General / OCABR (filing 2025-646) states that an unauthorized third party gained access to its network and on March 8, 2025 obtained copies of certain data; data types include name, date of birth, address, phone, email, race/ethnicity, Social Security number, patient type and medical record number; electronic medical records, treatment information and financial/payment account information were not involved; Experian IdentityWorks Credit 3B monitoring was offered.[5]
- 02
The consolidated complaint alleges that the HHS OCR breach portal report dated April 11, 2025 lists 5,556,702 individuals affected (plaintiffs' allegation citing HHS; the portal row itself was not independently opened).[2]
- 03
The court's preliminary approval order defines the settlement class as 'All living individuals residing in the United States who were sent a notice of the Data Incident' and notes the class has more than 100 members.[1]
Timeline
How the case has moved
YNHHS identifies unusual activity on its IT systems; an unauthorized third party obtained copies of certain data the same day (per YNHHS's notice filed with the Massachusetts AG).[5]
Date of the HHS OCR breach report cited in the consolidated complaint (5,556,702 individuals).[2]
Consolidated Class Action Complaint filed (Doc. 54) on behalf of 19 named plaintiffs.[2]
Order Granting Motion for Preliminary Approval of Class Action Settlement (ECF No. 70); settlement class provisionally certified; Epiq appointed administrator; final approval hearing set for March 3, 2026.[1]
Court-approved deadline to opt out of or object to the settlement.[3]
Court-approved claim-form deadline.[3]
Court grants final approval of the settlement at the fairness hearing.[4]
Settlement payments begin dispersing; all claims processed (site updated June 1, 2026).[4]
If this involves you
The records that matter, and who has them.
Whatever you decide to do next, you will be asked for these. They are yours by law, and most providers have up to 30 days to send them once they have your signed request.
YNHHS breach notification letter (April 2025)
The settlement class was defined as people who were sent a notice of the Data Incident, so the letter is the direct proof of class membership and lists the data elements involved for you.
Held by: You; YNHHS (contact number in the letter)
Experian IdentityWorks enrollment confirmation (and, for claimants, the Medical Data Monitoring enrollment offered under the settlement)
Documents that you took up the monitoring YNHHS offered and when; the settlement separately provided two years of medical data monitoring to claimants.
Held by: You; Experian; settlement administrator (Epiq)
Claim-form confirmation and any settlement payment record
Claims closed February 18, 2026 and payments began May 27, 2026; your confirmation is the record of what you submitted and received.
Held by: You; Epiq Class Action & Claims Solutions via www.YaleNewHavenSettlement.com (1-877-730-7795)
Your YNHHS patient demographic/registration record and medical record number
The exfiltrated data included demographic fields, patient type and medical record numbers; your registration record shows exactly what YNHHS held about you as of March 2025. YNHHS states clinical treatment records were not involved.
Held by: Yale New Haven Health HIM / Release of Information; MyChart portal
Credit reports and identity-theft/fraud reports after March 2025
Social Security numbers were among the exposed fields; dated evidence of misuse supports documented-loss claims and identity-theft remediation.
Held by: Credit bureaus; FTC IdentityTheft.gov; police
We send the request, follow up with the provider, and deliver the records to you. We don't take case details here and we never share your records with a law firm unless you tell us to.
Questions people ask
Straight answers, with sources
Is the Yale New Haven Health data breach lawsuit real?
Yes. It was consolidated as In re: Yale New Haven Health Services Corp. Data Breach Litigation, No. 3:25-cv-00609-SRU, in the U.S. District Court for the District of Connecticut before Judge Stefan R. Underhill, and resolved by a class settlement that received preliminary approval on October 21, 2025.[1]
How many people were affected?
The consolidated complaint alleges more than 5.6 million individuals and cites an April 11, 2025 HHS OCR breach report listing 5,556,702 individuals.[2]
Can I still file a claim?
No. The court-approved claim deadline was February 18, 2026 (opt-out/objection deadline January 20, 2026). The court granted final approval on March 3, 2026, and the settlement website reports that claims have all been processed and payments began May 27, 2026.[4]
What information was involved?
According to YNHHS's notice filed with the Massachusetts Attorney General, the copied data could include name, date of birth, address, phone, email, race or ethnicity, Social Security number, patient type and medical record number; YNHHS stated that electronic medical records, treatment information and financial account information were not involved.[5]
Did the court find Yale New Haven Health liable?
No. The settlement notice states that the defendant denies the claims and that the court has made no finding of wrongdoing; the court approved the settlement as fair, reasonable and adequate rather than deciding the merits.[3]
Sources
Where every fact on this page comes from
Primary sources only: court orders, the Judicial Panel on Multidistrict Litigation, federal regulators and state attorneys general. Each entry shows the day we opened it. This is reference material, not legal or medical advice.
- [1]Order Granting Motion for Preliminary Approval of Class Action Settlement (ECF No. 70), In re: Yale New Haven Health Services Corp. Data Breach Litigation, No. 3:25-cv-00609 (SRU)
U.S. District Court, D. Conn. (hosted on court-approved settlement site) · yalenewhavensettlement.com · opened October 12, 2026
October 21, 2025 order by Judge Underhill provisionally certifying the class and setting the March 3, 2026 hearing.
- [2]Consolidated Class Action Complaint (Doc. 54), No. 3:25-cv-00609-SRU
U.S. District Court, D. Conn. (hosted on court-approved settlement site) · yalenewhavensettlement.com · opened October 12, 2026
June 12, 2025 complaint alleging the March 8, 2025 breach, data types, and citing the April 11, 2025 HHS report of 5,556,702 individuals.
- [3]Long Form Notice of Class Action Settlement
Court-approved class notice (D. Conn.) · yalenewhavensettlement.com · opened October 12, 2026
Class definition, allegations, Jan 20 / Feb 18, 2026 deadlines, March 3, 2026 hearing, two years of medical data monitoring.
- [4]Yale New Haven Settlement — Home
Settlement administrator (Epiq) under D. Conn. order · yalenewhavensettlement.com · opened October 12, 2026
Final approval granted March 3, 2026; payments began May 27, 2026; claims processed.
- [5]2025-646 Yale New Haven Health System (data breach notification filing)
Commonwealth of Massachusetts (Attorney General / OCABR) · mass.gov · opened October 12, 2026
YNHHS notice letter: March 8, 2025 access and copying; data types; EMR/treatment data not involved; Experian monitoring.