Atlantic Digestive Specialists Data Breach: Notices Out, No Lawsuit Filed
Reference Guide
Atlantic Digestive Specialists is a gastroenterology practice in Somersworth and Portsmouth, New Hampshire. Someone got into its network on March 16 and 17, 2026, and the files may have included Social Security numbers, medical records and payment details. Letters started going out on September 30, 2026. As of October 17, 2026, law firms are recruiting patients, but no lawsuit has been found, and there is no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What the Practice Says Happened
According to the practice’s own notice, it was alerted to suspicious activity in its network in March 2026, secured the network and brought in cybersecurity experts. Investigators found that some information may have been viewed or acquired without authorization between March 16 and March 17, 2026.
The practice says a review of the affected files concluded in August 2026, and that it finished locating mailing addresses on September 8, 2026. Notices to patients began on September 30, 2026. HIPAA Journal reports that an unauthorized third party “potentially acquired files containing patient information.” The practice has not said who was behind the attack or whether a ransom was demanded.
The data list is long. It combines identity fields (name, Social Security number, driver’s license or state ID, date of birth, passport, alien registration and taxpayer ID numbers), financial fields (account and payment card information), medical fields (diagnosis, medical history, treatment and procedure details, prescriptions, Medicaid/Medicare number, health insurance policy numbers), plus usernames, passwords and digital signatures. Your letter says which of these were in your own record.
Case details
No court case has been found. As of October 17, 2026, we found no complaint naming Atlantic Digestive Specialists in any federal court, including the District of New Hampshire, either in news coverage or in federal court filings received since October 10, 2026. The free CourtListener docket search could not be checked today, and New Hampshire state courts such as Strafford County Superior Court are not searchable online in the same way. So a very recent filing cannot be ruled out.
What does exist is lawyer advertising. Since early October 2026, several firms and lead-generation sites have said they are “investigating” whether a class action can be filed. That is a recruitment step, not a lawsuit. There is no case number, no judge and no class.
The practice had an earlier, separate incident: ransomware discovered on February 20, 2017, with notices starting April 21, 2017. That is not the incident in the September 2026 letters.
Status: Breach Notified, No Lawsuit, No Settlement
The practice has not published a total number of affected people. HIPAA Journal reported on October 8, 2026 that the count “has not yet been publicly disclosed.” A copy of the notice letter is posted by the Massachusetts consumer-affairs office as document 2026-1688 under the name Atlantic Digestive Specialists, PLLC, which means Massachusetts residents are among those notified.
We had the same kind of case with a different company: see Security Industry Specialists, where a breach was notified but no lawsuit had been filed.
Who Is Affected
The people affected are those whose information was in the practice’s systems during the March 16–17, 2026 access. That means mainly patients of its Portsmouth and Somersworth, New Hampshire offices. The Somersworth office serves patients from Strafford County and south-central Maine, and the Massachusetts filing shows the mailing went beyond New Hampshire.
The practical test is your mail. If you got a letter dated around September 30, 2026, keep the letter and the envelope. It lists the fields involved in your record, and it is your proof if a case is ever filed or settled. If you have questions, the practice’s call center is 1-866-200-0962, Monday to Friday, 9 a.m. to 9 p.m. Eastern.
Nobody needs to sign up anywhere to stay eligible. If a class action is filed and settled, a court-appointed administrator would contact class members directly.
Is There Money?
If a case is filed and later settles, healthcare-breach settlements usually pay back documented out-of-pocket losses, sometimes add a smaller flat payment, and offer credit monitoring. How much depends on the size of the fund and the number of people in the class, and the practice has not disclosed that number. For the range seen in comparable resolved cases, see the data breach settlement calculator. Treat it as context, not a prediction.
Atlantic Digestive Specialists Breach Timeline
February 2017 — An Earlier Ransomware Incident
Ransomware began around February 18, 2017 and was discovered on February 20. Notices started on April 21, 2017, along with one year of credit monitoring. This was a separate event.
March 16–17, 2026 — Network Accessed
The practice is alerted to suspicious activity. Investigators find that information may have been viewed or acquired during these two days.
August 2026 — File Review Concludes
The review confirms that personal and protected health information was in the affected data.
September 8, 2026 — Addresses Located
The practice finishes finding contact details and arranges for notification letters.
September 30, 2026 — Notices and Press Release
Letters to patients begin, a paid press release goes out, and a call center opens at 1-866-200-0962.
October 2026 — Lawyer Ads, No Lawsuit
Firms advertise “investigations.” As of October 17, 2026, no complaint, settlement or claim form has been found.
Three Things to Watch For
A breach that exposed Social Security numbers and medical details, with no official claim process yet, is easy for others to exploit:
“Submit your Atlantic Digestive claim” forms
There is no settlement, so there is no claim to submit. Sites using that wording are lawyer intake forms. Do not type your Social Security number, card number or medical details into them.
Calls or emails asking you to “verify” your record
Usernames, passwords and patient account numbers were on the exposed-data list, so a scammer may already know real details about you. Do not give out codes or account information. Call the practice back on a number you look up yourself, or on 1-866-200-0962 from the notice.
Fake medical bills and insurance statements
With Medicaid/Medicare and health-insurance policy numbers exposed, look for bills or explanation-of-benefits statements for procedures or prescriptions you never had. Report them to your insurer rather than paying.
Atlantic Digestive Specialists Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is there an Atlantic Digestive Specialists data breach lawsuit?
Not as of October 17, 2026, as far as we can find. Law firms say they are investigating, but we found no filed complaint, case number or court. If one is filed, this page will list the court and case number.
What happened in the Atlantic Digestive Specialists data breach?
The practice says it was alerted to suspicious network activity in March 2026, and that information may have been viewed or acquired between March 16 and March 17, 2026. Notices began on September 30, 2026.
What information was exposed?
Possibly names, Social Security numbers, driver’s license or state ID numbers, dates of birth, financial account and payment card information, passport and taxpayer ID numbers, diagnoses, medical history, prescriptions, Medicaid/Medicare and insurance numbers, usernames and passwords, and digital signatures. Not every field applies to every person. Your letter lists yours.
How many people were affected?
The practice has not published a total. HIPAA Journal reported on October 8, 2026 that the number had not been publicly disclosed. Notices were also filed in Massachusetts, so the letters went to people outside New Hampshire.
Is the letter from Atlantic Digestive Specialists real?
The practice announced on September 30, 2026 that it was mailing notices and set up a call center at 1-866-200-0962. If you are unsure about a letter, call that number or the office number you already have. Do not use contact details printed in an unexpected email.
Can you sue a hospital or medical practice for a data breach?
Patients can file lawsuits, usually class actions claiming negligence. Whether a court lets the case go forward depends on the facts. For this incident, no such case has been found as of October 17, 2026. You do not need to file anything to stay eligible for a future class settlement.
Is this the same as the 2017 Atlantic Digestive breach?
No. In 2017 the practice found ransomware on February 20, 2017 and started notifying patients on April 21, 2017. The 2026 incident is a separate event, with access on March 16–17, 2026.
What should I do right now?
Freeze your credit at all three bureaus. It is free and you can undo it. Change any password that matches the one you used on the patient portal. Check insurance statements for care you never received. Keep your notice letter. To compare with resolved cases, see open class action settlements.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Data Breach Settlement CalculatorWhat comparable breach settlements have paid per person
- Desert Orthopaedic Center BreachAnother medical-practice breach and where its case stands
- Open Class Action SettlementsSettlements currently accepting claims, with deadlines
- Settlement Payout CalculatorEstimate a per-person share once a fund exists