Comprehensive Orthopaedics Data Breach: 21,897 Patients, No Lawsuit Filed Yet
Active Litigation
Comprehensive Orthopaedics & Musculoskeletal Care is a Connecticut orthopedic practice with offices in Wallingford, Meriden, Southington and Cheshire. Someone got into its network in February 2026 and accessed patient files. Notice letters went out from August 2026. As of October 18, 2026, law firms are investigating, but we found no filed lawsuit, no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What the Practice Says Happened
Per the practice’s own notice dated August 14, 2026, it became aware of suspicious activity on its network on February 12, 2026. It secured the environment and brought in a third-party forensic firm, which found that certain files were accessed by an unauthorized third party.
The practice then reviewed those files to work out whose information was in them. That review finished on June 17, 2026 — about four months after discovery. The notice does not name an attacker or say how the intruder got in. According to ClaimDepot, a ransomware group claimed the attack on the dark web on March 9, 2026 and said it would publish the data within 15 to 16 days; that is the group’s claim, not a finding by the practice.
What was in the files: your name together with one or more of: date of birth, Social Security number, government-issued ID, financial account or payment card information, medical information and health insurance information. Your own letter says which of those applied to you.
Case details
No court case found. As of October 18, 2026, we found no complaint filed over this comprehensive orthopaedics & musculoskeletal care data breach — no court, no case number, no judge. Our check of a local federal docket database (full file as of September 30, 2026, plus new filings since October 10, 2026) found no case naming the practice; federal filings between those dates and Connecticut state court filings could not be searched in the same way, so a very recent filing cannot be ruled out.
What exists are law firm investigations: ClassAction.org states that attorneys are “looking into whether a class action lawsuit can be filed.” That is recruitment of potential plaintiffs, not a lawsuit.
Do not confuse it with an older case. On June 11, 2025, Law360 reported a proposed class action against a different Connecticut orthopedic practice over a March 2 breach. That case predates this incident, which was discovered on February 12, 2026.
Status: Breach Confirmed, No Lawsuit, No Settlement
If a suit is filed, it would typically be a proposed class action alleging that the practice failed to protect patient data and took too long to notify patients — the gap here runs from February 12 to the August 14, 2026 notice. Those would be allegations to be proven, not findings. Even when such cases settle, it usually takes a year or more before anyone is paid.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Is Affected
The practice reported the incident to the U.S. Department of Health and Human Services as affecting 21,897 individuals. According to ClaimDepot, that report was filed on September 10, 2026.
The practical test is your mail. The practice says it is mailing notice letters to potentially impacted people. Keep the letter and the envelope: they show which data fields were involved and would be your proof of membership if a class is ever formed.
Not sure? Call the assistance line printed in the practice’s notice, 203-265-3280, Monday to Friday, 9 am to 5 pm ET. There is nothing to sign up for to “join” a case that does not exist.
Is There Any Money?
For a sense of what healthcare breach settlements with Social Security numbers have paid in other cases, use our data breach settlement calculator — as context, not a prediction. In those cases the people who kept receipts for real losses, such as fraud costs or time spent fixing accounts, usually fared better than those claiming a flat payment.
Comprehensive Orthopaedics Breach Timeline
February 12, 2026 — Suspicious Network Activity
The practice notices suspicious activity on its network, secures the environment and engages a third-party forensic firm.
March 9, 2026 — Ransomware Group Claims the Attack
Per ClaimDepot, a ransomware group claims responsibility on the dark web and threatens to publish the data. The practice’s notice names no group.
June 17, 2026 — File Review Completed
The investigation finds that the accessed files may have contained protected health information, including Social Security numbers.
August 14, 2026 — Public Notice
The practice posts its Notice of Data Security Incident and begins mailing letters to potentially impacted people.
September 10, 2026 — Reported to HHS: 21,897 People
Per ClaimDepot, the breach is reported to the HHS Office for Civil Rights; the report lists 21,897 affected individuals.
October 18, 2026 — Investigations, No Lawsuit Found
Law firms are recruiting affected patients. We found no filed complaint, no settlement and no claim form.
Three Things to Watch For
Letters to 21,897 patients plus a published ransomware claim give scammers both a list and a story:
“Submit your Comprehensive Orthopaedics claim” pages
There is no settlement, so there is no claim to submit. Lead-generation pages already use “submit a claim” wording for this breach. Typing your Social Security number into one of them does not file anything.
Calls or texts that mention your orthopedic visit
Stolen medical files can let a caller name your surgeon, your knee or your insurer. Use only the number printed in the practice’s own notice, 203-265-3280, and never give a Social Security number or card number to someone who called you.
“Your data was leaked — pay to remove it”
After a ransomware claim, extortion messages to patients sometimes follow. Paying does not remove anything. Report such messages to the FTC at identitytheft.gov and to the practice.
Comprehensive Orthopaedics Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
What happened in the Comprehensive Orthopaedics & Musculoskeletal Care data breach?
An unauthorized third party accessed certain files on the practice’s network. The practice spotted suspicious activity on February 12, 2026, finished reviewing the files on June 17, 2026 and posted its public notice on August 14, 2026.
How many people were affected?
21,897 individuals, per the report submitted to the U.S. Department of Health and Human Services. ClaimDepot gives September 10, 2026 as the date of that report.
What data was exposed?
Names together with one or more of: date of birth, Social Security number, government-issued ID, financial account or payment card information, medical information and health insurance information. Not every person had every field exposed — your letter lists yours.
Is there a comprehensive orthopaedics & musculoskeletal care data breach lawsuit?
Not that we could find as of October 18, 2026. Law firms are investigating and recruiting patients, but we found no filed complaint, court or case number. The proposed class action Law360 reported on June 11, 2025 involved a different Connecticut orthopedic practice and an earlier breach.
How much compensation will I get for a data breach?
For this breach, nothing yet: there is no settlement, no fund and no claim form. If a case is filed and later settles, payment amounts are set in that settlement. Our calculator shows how comparable settlements have been structured.
How can I check if I have been data breached?
For this incident, check your mail for a notice letter from the practice, or call its assistance line at 203-265-3280, Monday to Friday, 9 am to 5 pm ET. Then pull your free credit reports and read your health insurer’s explanation-of-benefits statements for care you never received. A credit freeze is free by federal law.
Can you sue a hospital for a data breach?
Patients do file such suits — usually as proposed class actions against hospitals or practices, like the 2025 case against another Connecticut orthopedic practice. Whether one succeeds depends on the facts and the court. Our hospital cyberattack lawsuits page tracks current cases.
Is there a class action lawsuit against Change Healthcare for data breach?
Yes, but it is a separate case with no link to this practice: the Change Healthcare litigation is a federal MDL, No. 3108, with no settlement as of October 6, 2026. See our Change Healthcare data breach lawsuit page for where it stands.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Data Breach Settlement CalculatorWhat breach settlements with Social Security numbers have paid
- Hospital Cyberattack LawsuitsOther patient data breach cases and where they stand
- Desert Orthopaedic Center BreachAnother orthopedic practice breach, a separate case
- Open Class Action SettlementsSettlements you can file a claim in right now