Carolina Asthma and Allergy Center Data Breach: Ransomware Claim, Federal Suit Filed
Active Litigation
On September 29, 2026 a ransomware group claimed it stole 290 GB of data from Carolina Asthma & Allergy Center, the Charlotte-area allergy practice. Three days later, on October 2, 2026, a federal lawsuit was filed against the practice in Charlotte. As of October 18, 2026 the practice has not publicly confirmed a breach, no number of affected patients has been reported, and there is no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Has Been Reported So Far
Carolina Asthma & Allergy Center (legal name Carolina Asthma and Allergy Center, PA) says it has 16 locations and more than 70 years in the Charlotte area, and calls itself the area’s largest asthma and allergy practice.
On September 29, 2026 the ransomware group Chaos posted the practice on its dark web leak site. The group claims it took 290 GB of data and gave management 24 hours to negotiate. According to the group’s own statement, the files include “Other Patient Forms” with name, date of birth, medical record number (MRN), Social Security number, phone number and address, plus administrative, financial and procurement records.
All of that is the attacker’s claim. The monitoring sites that recorded the post say they cannot confirm it. As of October 18, 2026 we found no breach notice on the practice’s website and no report to federal health regulators or the North Carolina Attorney General giving a number of affected people.
Case details
On October 2, 2026 a case titled Davis v. Carolina Asthma And Allergy Center, PA, No. 3:26-cv-00838, was filed in the U.S. District Court for the Western District of North Carolina, which sits in Charlotte. A summons was issued and the case was assigned the same day. On October 14, 2026 two motions were filed for out-of-state lawyers to appear in the case (pro hac vice). The public index we checked does not yet name the judge.
One caution: we could not read the complaint itself, so we cannot quote what it alleges. The court, the parties and the timing — three days after the leak post — fit a data-breach class action, but that is our reading of the record, not a statement from the filing. An older case against the practice, Klimas (No. 3:17-cv-00029), was an employee-benefits suit that closed in 2018 and has nothing to do with this.
Status: One Federal Suit, No Settlement
There is no settlement, no fund, no administrator, no claim form and no deadline. The practice has not publicly confirmed what was taken or how many people are affected. The next real milestone is likely a notice letter from the practice: if patient data is confirmed exposed, federal health-privacy rules require it to tell affected people. More lawsuits after a filing like this are common, and they are often later combined.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Could Be Affected
If the attacker’s claim is accurate, the people at risk are current and former patients of Carolina Asthma & Allergy Center, and possibly staff whose records sat in the administrative files. Nobody has published a count.
You do not join a class action by signing up anywhere. If a class is certified or a settlement is reached, a court-appointed administrator contacts class members directly.
The practical test is your mail. If the practice confirms a breach, it will send letters saying which of your details were involved. Keep that letter and its envelope — it is your best proof if a settlement ever opens.
Is There Any Money?
Carolina Asthma Data Breach Timeline
September 29, 2026 — Ransomware Claim Posted
The Chaos group lists the practice on its leak site, claims 290 GB of data and gives management 24 hours to negotiate. The attack itself was estimated to have happened the same day.
September 30, 2026 — Monitoring Sites Record It
Breach-tracking services log the claim. They note it rests on the group’s own statement and cannot be confirmed.
October 2, 2026 — Federal Suit Filed
Davis v. Carolina Asthma And Allergy Center, PA, No. 3:26-cv-00838, is filed in the Western District of North Carolina. A summons issues the same day.
October 14, 2026 — Out-of-State Counsel Move to Appear
Two pro hac vice motions are filed in the Davis case. The practice has not yet responded on the docket.
As of October 18, 2026 — No Public Confirmation
No breach notice on the practice’s website and no regulator report with a count of affected people that we could find.
Next — Notice Letters, Response to the Suit
Watch for notice letters from the practice and for its first filing in the Davis case. No settlement, fund or claim form exists.
Three Things to Watch For
An unconfirmed breach with patient Social Security numbers on the table is exactly where imposters move in:
Calls that know you see an allergist
If patient forms really leaked, a caller may know your name, birth date and that you are a patient. That does not make them the practice. Hang up and call the practice back at the number on its website, 704-372-7900.
“Carolina Asthma settlement” claim pages
There is no settlement and no claims portal. A site asking for your Social Security number to “register” for a payout is collecting data, not filing anything.
Allergy-shot or bill payment requests
Stolen billing and patient files can be used to send fake balance notices or ask for payment by gift card or wire. Check any bill against your patient portal or your insurer’s explanation of benefits before you pay.
Carolina Asthma and Allergy Center Data Breach — Common Questions
Short answers to the questions people ask most about this case.
Was there really a Carolina Asthma and Allergy Center data breach?
It is not confirmed. The Chaos ransomware group claimed on September 29, 2026 that it stole 290 GB of data. As of October 18, 2026 the practice had not posted a breach notice on its website, and we found no regulator report.
Is there a Carolina Asthma and Allergy Center data breach lawsuit?
Yes, a federal case was filed: Davis v. Carolina Asthma And Allergy Center, PA, No. 3:26-cv-00838, in the Western District of North Carolina on October 2, 2026. We could not read the complaint, so we cannot confirm its exact claims. The docket shows only opening steps.
What data does the hacker group say it took?
Per the group’s statement: patient forms with name, date of birth, medical record number, Social Security number, phone number and address, plus administrative, financial and procurement records. This is the attacker’s claim, not a confirmed list.
How many people were affected?
Unknown. No count has been published by the practice or reported to regulators as far as we could find by October 18, 2026. The practice has 16 locations in the Charlotte area, so a confirmed breach could involve many patients.
Is there a settlement or claim form?
No. There is no settlement, no fund, no administrator, no claim form and no deadline. If that changes, class members are notified directly.
Do I need to sign up to be part of the lawsuit?
No. If a class is certified, you are included automatically unless you opt out by a deadline in the official notice. Hiring a lawyer is a separate choice; read any agreement before you sign it.
I never got a letter. Am I safe?
Not necessarily. Letters normally go out only after a provider confirms whose records were involved, and that review can take weeks or months. No letter yet is not proof either way.
What should I do right now?
Freeze your credit at all three bureaus — it is free and reversible. Watch your insurer’s explanation-of-benefits statements for care you never received. Keep any notice letter you get. See what exposed medical data can lead to.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Goshen Medical Data BreachAnother North Carolina healthcare provider breach case
- Consequences of a Data BreachWhat exposed medical and Social Security data can lead to
- Data Breach Settlement CalculatorEstimate what comparable breach settlements have paid
- Open Class Action SettlementsSettlements that are taking claims right now