This guide brings together and replaces our earlier news posts on healthcare data breaches and HIPAA enforcement, rewritten and expanded in October 2026 as a sourced reference.
Medical records are among the most valuable data a criminal can steal. They combine names, birth dates, addresses and Social Security numbers with insurance details and diagnoses, and, unlike a credit card, none of that can be cancelled and reissued. Hospitals also cannot simply switch off for a week while they recover, which makes them attractive targets for extortion.
The scale is large. Healthcare organizations reported 725 large breaches (500 or more records each) to federal regulators in 2023, a record, exposing more than 133 million patient records, according to HIPAA Journal's analysis of HHS data reported by Becker's Hospital Review. The five cases below, all drawn from that period, show the main ways patient data gets out: a trusted insider, a hacker who goes straight to patients, ransomware at an under-resourced clinic, a ransomware gang at a children's hospital, and a breach at an outside vendor. Each section sticks to what regulators, the organizations themselves and major outlets reported.
In this guide
- Timeline and at-a-glance table
- Montefiore Medical Center: an insider, and a $4.75 million HHS settlement
- Integris Health, November 2023: extortion emails sent to patients
- Cherry Health, December 2023: ransomware at a community health center
- Lurie Children's Hospital, January 2024: Rhysida and weeks of manual care
- Thompson Coburn and Presbyterian Healthcare Services, May 2024: the vendor breach
- What the cases have in common
- What this means for patients and for organizations
- FAQ
Timeline and at-a-glance table
Events are listed in date order. Several incidents were disclosed, or fully counted, months after they began.
- 2013 (about six months)
A Montefiore Medical Center employee takes patient records and sells them to an identity theft ring. - May 2015
New York police tell Montefiore that a patient's medical information was stolen, prompting an internal investigation. - Nov. 28, 2023
An unauthorized party accesses Integris Health files in Oklahoma. - Dec. 21, 2023
Ransomware hits Cherry Health in Grand Rapids, Michigan. It is discovered on Dec. 24. - Late Dec. 2023
Integris patients receive extortion emails; Integris confirms the incident and warns patients not to respond. - Jan. 26 to 31, 2024
Attackers are inside Lurie Children's Hospital systems in Chicago. The hospital takes its network offline on Jan. 31. - Feb. 6, 2024
HHS Office for Civil Rights announces a $4.75 million settlement with Montefiore. - Feb. 2024
Integris reports 2,385,646 affected people to HHS. Rhysida lists Lurie data for 60 bitcoin (about $3.4 million). - Early March 2024
Lurie restores its Epic electronic health record; Rhysida later claims the data was sold. - April 17, 2024
Cherry Health files a breach notice with the Maine Attorney General covering 184,372 people. - May 28 to 29, 2024
An unauthorized actor takes files from law firm Thompson Coburn, detected May 29. - June 2024
Lurie notifies 791,784 people and says it did not pay a ransom. - Nov. 2024
Thompson Coburn's breach report to HHS lists 305,088 people, all tied to client Presbyterian Healthcare Services. - Oct. 2025
Integris reaches a $30 million class action settlement, with a final approval hearing set for Dec. 16, 2025.
| Case | Type of incident | People affected | Main outcome |
|---|---|---|---|
| Montefiore Medical Center (NY) | Malicious insider | 12,517 | $4.75M HHS settlement, two-year corrective action plan |
| Integris Health (OK) | Data theft, direct patient extortion | 2,385,646 | $30M class action settlement (2025) |
| Cherry Health (MI) | Ransomware | 184,372 | Credit monitoring offered, safeguards added |
| Lurie Children's Hospital (IL) | Ransomware (Rhysida claimed) | 791,784 | No ransom paid; weeks of downtime |
| Thompson Coburn / Presbyterian (NM) | Breach at a law firm (business associate) | 305,088 | Credit monitoring offered |
Counts are the figures the organizations reported to HHS or state attorneys general.
Montefiore Medical Center: an insider, and a $4.75 million HHS settlement
Dates: theft in 2013; settlement announced Feb. 6, 2024. Where: the Bronx, New York.
What happened
For roughly six months in 2013, an employee at Montefiore Medical Center looked up patients' electronic protected health information and sold it to an identity theft ring. The hospital did not catch it. It found out in May 2015, when the New York Police Department told Montefiore that a specific patient's medical information had been stolen. An internal investigation then traced the theft back two years, and Montefiore reported it to the HHS Office for Civil Rights (OCR), the federal agency that enforces HIPAA.
The impact
Records belonging to 12,517 patients were taken, according to Healthcare IT News. The stolen data was the kind used to open accounts and commit fraud in patients' names. Because nobody was watching who accessed what, the theft went on for months and stayed hidden for two years.
The response
OCR's investigation found multiple potential violations of the HIPAA Security Rule. As summarized by Healthcare Dive, Montefiore allegedly failed to identify risks and vulnerabilities to patient data, failed to monitor activity in its IT systems, and lacked policies to oversee systems that hold health information. In OCR's view, those gaps meant the hospital could neither prevent the theft nor spot it quickly. OCR Director Melanie Fontes Rainer said cyberattacks "from malicious insiders are not uncommon."
Montefiore agreed to pay $4.75 million and to follow a corrective action plan, monitored by OCR for two years. The plan covers a thorough risk analysis, fixing the risks it finds, stronger audit controls that record and review system activity, and updated policies and training. The employee was fired and prosecuted, Healthcare Dive reported.
What happened next
The case drew attention for its timeline: the settlement arrived more than a decade after the theft and more than eight years after Montefiore reported it. That is not unusual for HIPAA enforcement, where investigations often take years. The lesson most compliance experts took from it is simple. Access logs are only useful if someone reviews them, and a hospital should be able to tell when one employee is pulling far more records than their job requires.
Integris Health, November 2023: extortion emails sent to patients
Dates: intrusion Nov. 28, 2023; patient emails from late December 2023. Where: Oklahoma.
What happened
Integris Health, Oklahoma's largest not-for-profit health system, had files accessed by an unauthorized party on Nov. 28, 2023. The attacker did not encrypt systems, and care was not interrupted, according to BleepingComputer. Instead, the attacker skipped the hospital and went to the patients. In late December, people began receiving emails that contained their own accurate details and linked to a site on the Tor network. The site offered to "remove" a person's data for $50, or let anyone view another person's record for $3, and warned that the data would be sold to other criminals on Jan. 5, 2024.
Integris confirmed the incident around Christmas 2023, after the emails started. It told patients not to reply, click links or pay, and said all affected people would receive individual letters.
The impact
Integris reported 2,385,646 affected people to HHS. The exposed data varied by person and could include names, dates of birth, contact and demographic details, and Social Security numbers. Integris said employment details, driver's licenses, account credentials and financial information were not involved. Children were among those affected: TechTarget reported that the settlement class of nearly 2.4 million people includes about 224,000 minors. One lawsuit described a parent who received a demand to pay $50 to keep a young child's data off the dark web, a sign of how far the extortion reached.
The response
Within days, patients filed class action lawsuits accusing Integris of failing to protect their data and of notifying them only after the extortion began. HIPAA Journal counted 21 suits in state and federal court in Oklahoma, which were later consolidated. No ransomware group was publicly confirmed as responsible.
What happened next
In 2025, Integris agreed to a $30 million settlement that resolves the claims without a finding of wrongdoing. According to TechTarget, class members could claim up to $25,000 for documented losses or a pro rata payment of about $100, plus three years of three-bureau credit monitoring and up to $1 million in identity theft insurance. A final approval hearing was scheduled for Dec. 16, 2025. The deadline to pay passed long ago, so anyone affected should assume the data is circulating and guard against identity theft accordingly.
Cherry Health, December 2023: ransomware at a community health center
Dates: attack Dec. 21, 2023; notice filed April 17, 2024. Where: Grand Rapids, Michigan.
What happened
Cherry Street Services, which operates as Cherry Health, is a nonprofit federally qualified health center serving patients across six Michigan counties regardless of their ability to pay. It is often described as the state's largest. On Dec. 21, 2023, a ransomware attack disrupted its network, and the attack was discovered on Christmas Eve. In early January the organization publicly referred only to a "network disruption." It later described it as a cybersecurity incident.
The impact
After a review that finished on March 25, 2024, Cherry Health filed a notice with the Maine Attorney General on April 17 covering 184,372 people, according to The Record. SecurityWeek reported that the exposed data could include names, addresses, phone numbers, dates of birth, Social Security numbers, health insurance information, patient ID numbers, treatment and prescription information, and financial account information. No ransomware group was publicly named.
The response
Cherry Health offered affected people free credit monitoring and identity protection services and said it had added technical safeguards.
What happened next
The case became an example of a wider problem. Community health centers, which care for low-income and uninsured patients and depend heavily on federal funding, generally have far less to spend on security than large hospital systems. Regulators have still held smaller providers to account. In January 2024, New York Attorney General Letitia James announced a settlement with Refuah Health Center over a May 2021 ransomware attack that affected more than 260,000 people. Refuah agreed to pay $450,000 and invest more than $1.2 million in cybersecurity, including multi-factor authentication and twice-yearly security audits, SC Media reported.
Lurie Children's Hospital, January 2024: Rhysida and weeks of manual care
Dates: intrusion Jan. 26 to 31, 2024; notices sent June 2024. Where: Chicago.
What happened
Ann & Robert H. Lurie Children's Hospital of Chicago, which serves about 239,000 children a year, took its network offline on Jan. 31, 2024, after detecting what it first called a "cybersecurity matter." Its electronic health record, email, phones and the MyChart patient portal went down. The hospital stayed open, but staff switched to manual processes. Some appointments and elective surgeries were cancelled, prescription refills slowed, and families were asked to bring printed insurance cards and their child's medication bottles.
In late February the Rhysida ransomware group listed data it said came from Lurie on its leak site and asked 60 bitcoin, a little over $3.4 million, for it, The Record reported. Rhysida is a ransomware-as-a-service operation that emerged in May 2023. HHS had warned the health sector about it in August 2023. The hospital confirmed only that its network had been accessed by "a known criminal threat actor."
The impact
Lurie later reported to regulators in Texas, Maine and California that 791,784 people were affected. The data could include names, addresses, dates of birth and dates of service, and for some people Social Security numbers, medical and prescription information, health claims information and treatments received. The attackers were in the network from Jan. 26 to 31. The hospital said it had no indication that its electronic health record system itself was accessed.
The response
Lurie did not pay a ransom, it said. By early March it had restored its Epic electronic health record and other key systems, verifying and testing each one before bringing it back. MyChart took longer. Affected people were offered two years of identity protection services.
What happened next
In March, Rhysida updated its listing to say "all data was sold." That claim was never independently verified. The case showed that refusing to pay does not end the risk to patients, and that recovery for a large academic hospital is measured in weeks. Patient lawsuits were reported after the notification.
Thompson Coburn and Presbyterian Healthcare Services, May 2024: the vendor breach
Dates: files taken May 28 to 29, 2024; reported to HHS in November 2024. Where: a St. Louis-based law firm and its New Mexico health system client.
What happened
Thompson Coburn, a national law firm headquartered in Missouri, detected unauthorized activity on its network on May 29, 2024. Its investigation found that an unauthorized actor had taken files on May 28 and 29, and that some contained protected health information about patients of a client, Presbyterian Healthcare Services. Presbyterian is one of New Mexico's largest health providers and also runs health plans, including Medicare Advantage and Medicaid plans.
This is a business associate breach. Under HIPAA, a vendor that handles patient data for a hospital, such as a law firm, billing company or IT provider, must protect it under a business associate agreement and report a breach to the hospital. Here, the law firm reported to HHS and notified patients.
The impact
The HHS breach report lists 305,088 people. SecurityWeek reported that the data could include names, Social Security numbers, dates of birth, medical record and patient account numbers, prescription and treatment information, provider and clinical details, and health insurance information. At the time, the firm's notification site mentioned only Presbyterian, and it was unclear whether other clients were affected. No ransomware group was known to have claimed the attack.
The response
Thompson Coburn said it found no indication of identity theft or fraud linked to the incident, offered free credit monitoring and identity theft protection, and said it had added security measures.
What happened next
The case joined a growing list of law firm breaches involving health data. The closest comparison is Orrick, Herrington & Sutcliffe, whose 2023 breach led to notices to more than 638,000 people. A federal judge gave final approval to an $8 million class action settlement in that case in November 2024, the ABA Journal reported. For hospitals, the takeaway is that patient data sent to outside counsel, consultants or vendors is only as safe as their security, and the less of it you send, the less can leak.
What the cases have in common
- Detection is slow. Montefiore learned of its insider two years later, from the police. Integris patients learned of their breach from the criminals. Lurie's and Cherry Health's full counts took four to five months.
- Extortion has moved to patients. Integris showed that attackers will email victims directly, and charge small amounts to many people rather than one large sum to the hospital.
- Not paying is common, and the data still leaks. Lurie refused to pay. Rhysida then claimed it sold the data anyway.
- The weakest link is often outside the hospital. Thompson Coburn held Presbyterian's data. Hospitals share records with many vendors, and each one is a potential entry point.
- Resources matter. Community health centers like Cherry Health face the same attackers as large systems with far smaller budgets.
- Consequences arrive years later. Regulatory settlements and class action payouts came one to eleven years after the incidents.
What this means for patients and for organizations
If you are a patient who gets a breach letter
- Read the letter and enroll in the free monitoring. Note the enrollment deadline. Monitoring does not prevent fraud, but it alerts you sooner.
- Freeze your credit with all three bureaus (Equifax, Experian and TransUnion). A freeze is free and is the most effective block against new accounts in your name. You can also freeze a child's credit, which matters after breaches like Integris and Lurie that involved minors.
- Watch for medical identity theft. Read every explanation of benefits from your insurer and look for visits, prescriptions or equipment you did not receive. Ask your provider for a copy of your records if something looks wrong.
- Never pay or reply to extortion emails. Paying does not delete data and can mark you as a target. Report the message to the FBI's Internet Crime Complaint Center (ic3.gov) and to the provider named in it.
- Expect convincing phishing. Criminals with your real details may pose as your hospital, insurer or a "settlement administrator." Contact organizations using the phone number on your card or their official website.
- If fraud happens, use the FTC's IdentityTheft.gov to report it and get a recovery plan. Keep records in case a class action settlement lets you claim documented losses.
If you run or advise a healthcare organization
| Lesson | Case that shows it | Practical step |
|---|---|---|
| Know your risks | Montefiore | Run and update an enterprise-wide HIPAA risk analysis; OCR cites its absence constantly |
| Review access logs | Montefiore | Alert on unusual record lookups by staff and review audit logs regularly |
| Plan for direct patient extortion | Integris | Prepare patient messaging and a hotline before an incident, not after |
| Require MFA and audits | Refuah | Multi-factor authentication on remote access and email, plus regular audits |
| Rehearse downtime | Lurie Children's | Practice paper-based workflows for records, prescriptions and phones |
| Vet and limit vendors | Thompson Coburn | Check business associates' security and share the minimum necessary data |
FAQ
Does HIPAA let me sue a hospital after a breach?
HIPAA itself does not give patients a private right to sue. It is enforced by HHS's Office for Civil Rights and state attorneys general, as in the Montefiore and Refuah cases. Patients usually sue under state laws on negligence, privacy or consumer protection, which is how the Integris class actions were brought.
How do I know if my data was in a large health breach?
Covered organizations must notify affected people by letter, and breaches of 500 or more people are listed publicly on HHS's breach portal. Many states, including Maine, Texas and California, also publish the notices they receive. If you are unsure whether a letter is genuine, call the provider at a number you already trust.
Should a hospital pay a ransom?
U.S. authorities discourage it, because payment funds further attacks and does not guarantee the data will be deleted. Lurie did not pay, and Rhysida still claimed to have sold the data. The decision usually turns on patient safety and whether systems can be restored from backups.
Is a breach at a law firm or vendor covered by HIPAA?
Yes, when the vendor is a business associate handling protected health information for a covered entity. Business associates must safeguard the data and report breaches, and they can be investigated directly by OCR. The Thompson Coburn incident was reported to HHS for exactly this reason.
Sources
- Becker's Hospital Review: Healthcare data breaches set record in 2023 (Feb. 2024)
- HHS: HHS Office for Civil Rights settles malicious insider cybersecurity investigation (Feb. 6, 2024)
- Healthcare Dive: HHS settles with Montefiore Medical Center over cybersecurity failures (Feb. 2024)
- Healthcare IT News: Montefiore settles with OCR for $4.75M over stolen ePHI (Feb. 2024)
- BleepingComputer: Integris Health says data breach impacts 2.4 million patients
- HIPAA Journal: Integris Health data breach and lawsuit updates
- TechTarget: Integris Health reaches $30M class action data breach settlement (Oct. 2025)
- The Record: Michigan healthcare organization says ransomware breached data of 185,000 (April 2024)
- SecurityWeek: 180k impacted by data breach at Michigan healthcare organization (April 2024)
- SC Media: Significant cyber investment, fines part of Refuah Health's ransomware settlement (Jan. 2024)
- The Record: Ransomware gang seeks $3.4 million after attacking children's hospital (Feb. 2024)
- The Record: Ransomware gang claims payment for Lurie Children's data (March 2024)
- TechTarget: Lurie Children's restores key systems following cyberattack (March 2024)
- The Record: Chicago children's hospital says nearly 800,000 affected by January ransomware attack (June 2024)
- SecurityWeek: Law firm data breach impacts 300,000 Presbyterian Healthcare patients (Nov. 2024)
- ABA Journal: Judge gives final OK to $8M settlement in Orrick data breach (Nov. 2024)
- FTC: IdentityTheft.gov
- FBI Internet Crime Complaint Center (IC3)
Top image: "Corridor on the second level - NÄL hospital 1" by W.carter, CC0 1.0, via Wikimedia Commons (resized). Charts by Thank You Robot.
0 Comments