Downriver Pediatric Associates Data Breach: The Vendor Was Hit
Active Litigation
Downriver Pediatric Associates, a pediatric practice in Brownstown Township, Michigan, began mailing breach letters on October 8, 2026. The attack was not on the practice itself but on Technical Solutions Group (TSG), the company that used to host its electronic health records. As of October 2026, two federal class actions have been filed against TSG in Detroit. We found no lawsuit against Downriver, and there is no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened in the Downriver Pediatric Associates Data Breach
According to the practice’s notice, TSG told Downriver it suffered a cyberattack in June 2026 that affected many of its customers. The attackers encrypted information on TSG’s systems and left a note claiming to have copied data out.
On September 16, 2026, TSG told Downriver it could not recover the encrypted data it hosted for the practice. It also could not say what Downriver information, if any, was accessed or taken. So Downriver is notifying every patient whose information was in the TSG-hosted records system.
The files varied by patient but could have included names plus Social Security numbers, driver’s license numbers, dates of birth, treating physician, dates of service, medication, insurance, and treatment or diagnostic information. For a pediatric practice, that mostly means children’s records.
There is a second problem beyond privacy: the notice says treatment records created between June 2025 and June 2026 may no longer be available. Downriver says it no longer uses TSG to host its records.
Case details
No lawsuit against Downriver Pediatric Associates. As of October 2026, we found no case naming the practice in the federal-court records we searched. A ClassAction.org page describes lawyers investigating a possible case, which is not a filed lawsuit. Wayne County state-court filings are not searchable online, so a state case cannot be fully ruled out.
Two federal suits against the vendor. Both are in the U.S. District Court for the Eastern District of Michigan:
— Anderson v. Technical Solutions Group, LLC d/b/a Medical Data RX, No. 2:26-cv-13891, complaint docketed October 13, 2026.
— Quinten v. Technical Solutions Group, LLC d/b/a Medical Data RX, No. 2:26-cv-13967, complaint docketed October 16, 2026.
TSG serves many medical practices, so these suits are about the vendor’s breach as a whole. We could not read the complaints, so we cannot confirm whether the named plaintiffs were Downriver patients.
Status: Two Vendor Lawsuits Filed in October 2026, No Settlement
One detail matters for the timeline: on October 5, 2026, a second ransomware group was reported claiming an attack on TSG’s Medical Data Rx division, with an estimated attack date of September 5, 2026. That claim is unverified, and it is not clear whether it is the same incident as the June attack described in Downriver’s letter.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Are You Affected?
Downriver says it is notifying all patients whose information was kept in the records system TSG hosted. If you or your child were seen at the practice, a letter dated on or after October 8, 2026 is the clearest sign. Keep it and the envelope.
You do not need to sign up anywhere to be part of a class action. If a class is certified or a settlement is reached, a court-appointed administrator notifies class members directly.
Questions about your letter: Downriver’s incident line is 833-918-9468, Monday–Friday, 9 am–9 pm Eastern. Do not confuse this practice with Downriver Medical Associates in Wyandotte, a different practice that a ransomware group listed as a victim on June 4, 2026.
Is There a Payout?
If the TSG cases settle someday, healthcare-breach settlements usually combine repayment of documented losses, a smaller flat payment, and credit monitoring. Since affected patients here are mostly minors, monitoring for a child’s identity can matter more than cash. For how a different medical-provider breach case has moved toward settlement, see our page on the Radiology Associates of Richmond data breach.
Downriver Pediatric Associates Data Breach Timeline
June 2026 — Attack on TSG
Per Downriver’s notice, TSG suffers a cyberattack. Data is encrypted and the attackers leave a note claiming they took data.
July 7, 2026 — Ransomware Claim
A ransomware group publicly claims the attack on TSG and threatens to leak data. That is the group’s claim, not a confirmed fact.
September 16, 2026 — Data Lost
TSG tells Downriver it cannot recover the encrypted records and cannot determine what, if anything, was taken.
October 8, 2026 — Letters Mailed
Downriver begins mailing notices to all patients whose information was in the TSG-hosted records system.
October 13 and 16, 2026 — Suits Against TSG
Anderson (2:26-cv-13891) and Quinten (2:26-cv-13967) are filed against TSG in the Eastern District of Michigan.
As of October 2026 — No Settlement
No lawsuit names Downriver, and neither TSG case has a ruling, settlement, fund or claim form.
Three Things to Watch For
A breach of children’s records with no claim process invites imposters:
Calls about your child’s records
A caller who names the practice and asks you to “verify” your child’s Social Security number or date of birth is not from a court. If in doubt, call the number printed in your letter, 833-918-9468.
“Claim your Downriver settlement” sites
There is no settlement and no claim form. A page asking for your SSN or a fee to “reserve your payout” is collecting data, not filing anything.
Fake medical bills and insurer statements
Insurance and treatment details were in the files. Read every explanation-of-benefits statement for visits your child never had, as the notice itself recommends, and report them to the health plan.
Downriver Pediatric Associates Data Breach — Questions People Ask
Short answers to the questions people ask most about this case.
Is there a Downriver Pediatric Associates data breach lawsuit?
Not against the practice, as far as we found as of October 2026. Two federal class actions were filed against its former records vendor, Technical Solutions Group: Anderson (No. 2:26-cv-13891) and Quinten (No. 2:26-cv-13967), both in the Eastern District of Michigan.
What is the Downriver Pediatric Associates data breach payout?
There is none. No settlement, fund, administrator or claim form exists. Anyone quoting a per-person amount is speculating.
What information was exposed?
It varied by patient but could include names, Social Security numbers, driver’s license numbers, dates of birth, treating physician, dates of service, medication, insurance, and treatment or diagnostic information. TSG could not determine what, if anything, was actually taken.
How many patients were affected?
No count had been published that we could find as of October 2026. Downriver says it is notifying every patient whose information was in the TSG-hosted system.
Is the letter from Downriver Pediatric Associates real?
The practice’s own website links a “Notice of TSG Data Security Incident,” and mailing began October 8, 2026. The incident line in the notice is 833-918-9468. Verify through that number or the practice, not through a number given by a caller.
Why might my child’s medical records be missing?
Because TSG could not recover the encrypted data, the notice says treatment records created between June 2025 and June 2026 may no longer be available. If you need those records, ask the practice what it can reconstruct.
Is there a California Downriver Pediatric Associates data breach lawsuit?
No. The practice is in Brownstown Township, Michigan, and the only suits we found are in federal court in Michigan. If you were a patient elsewhere, this case does not cover you.
What should I do now?
Keep the letter. Consider a credit freeze for your child at all three bureaus — it is free and blocks new accounts in their name. Check insurer statements for care you did not receive. You do not need to sign anything to stay part of a future class.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Change Healthcare Data BreachAnother vendor breach that reached patients of many providers
- Data Breach Settlement CalculatorEstimate what breach settlements typically pay per person
- Open Class Action SettlementsSettlements currently accepting claims, with deadlines
- Settlement Payout CalculatorHow a settlement fund gets divided among class members