Goshen Medical Center Data Breach: 456,385 Patients, No Lawsuit Found
Reference Guide
Goshen Medical Center is a community health center network in eastern North Carolina. In September 2025 it began mailing breach letters to 456,385 people after someone got into its network in February 2025. Names, Social Security numbers, driver’s license numbers and medical record numbers were in the files. As of October 18, 2026 we found no filed class action, no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Goshen Says Happened
Goshen Medical Center is a federally qualified health center based in Faison, North Carolina, with more than 35 locations across eastern North Carolina, including Bolton, Chadbourn, Elizabethtown, Southport, Whiteville, Wallace and Tabor City.
According to its own notice letter, Goshen detected suspicious activity on March 4, 2025. Its investigation found that files may have been accessed or acquired on February 15, 2025. A review of those files finished on or about September 12, 2025 and showed they contained patient health information.
The letter lists: name, address, date of birth, Social Security number, driver’s license number and medical record number. Goshen says it has no evidence that anyone misused the information. It notified law enforcement and says it added security measures.
A ransomware group claimed the attack on its leak site on March 22, 2025. That is the group’s claim. Goshen has not confirmed it and has not said whether a ransom was demanded or paid.
Case details
No data breach lawsuit found. As of October 18, 2026, our searches of news coverage, law-firm notices and federal court records turned up no class action filed over this breach, in federal court or in a North Carolina state court. Attorneys working with ClassAction.org said in September 2025 that they were “investigating” whether a class action can be filed. An investigation is an advertisement for clients, not a lawsuit.
One federal case does name Goshen: Reynolds v. Goshen Medical Center, Inc., No. 7:24-cv-01081 in the U.S. District Court for the Eastern District of North Carolina, before Judge Terrence W. Boyle. It is an employment case under the Americans with Disabilities Act, filed November 18, 2024 and closed October 24, 2025. It has nothing to do with the breach.
Note on court records: the free federal docket search we normally use was unavailable on October 18, 2026, and North Carolina state court files are not searchable online in the same way. A very recent filing could be missing from our check.
Status: Breach Confirmed, No Lawsuit, No Settlement
If you searched “goshen medical center announces data breach lawsuit,” here is what is behind it. In September 2025, Goshen Medical Center announces data breach notices to patients, and a headline titled “Goshen Medical Center announces data breach affecting 456K individuals” circulated on class action news sites. That story was about the notice letters. It said Goshen was not facing legal action at the time.
The official count is 456,385 people. That number appears in the federal HHS breach report (listed as a network server hacking incident, the largest provider breach reported that month) and in the filing with the Maine Attorney General. A filing with South Carolina regulators listed 5,234 people, which reflects that state’s residents only.
Are You Affected?
The test is your mail. If your information was in the files, Goshen sent you a letter headed “Notice of Data Security Incident” or “Notice of Data Breach.” Comparitech reports that Goshen serves around 53,000 patients, so the 456,385 figure includes many former patients too.
Keep the letter and the envelope. It shows which fields were involved and holds your activation code for the free monitoring. If a class action is ever filed and settled, that letter is how you show you belong in the class.
Lost the letter? Goshen’s notice lists a help line run by Epiq: 877-396-3238, Monday through Friday, 9 a.m. to 9 p.m. Eastern.
Is There Any Money?
What Goshen does offer is free credit monitoring and identity protection through Epiq Privacy Solutions ID Standard, for 12 or 24 months depending on your letter. It includes Equifax credit monitoring, a credit lock tool, dark web monitoring and identity restoration help. You enroll at privacysolutionsid.com with the activation code printed in your letter, before the enrollment deadline the letter gives.
For a sense of what healthcare breach settlements have paid elsewhere, see our data breach settlement calculator and the University of Hawaii Cancer Center settlement. Those are other cases, not a forecast for Goshen.
Goshen Medical Center Breach Timeline
February 15, 2025 — Files Accessed
Per Goshen’s notice, files in its network may have been accessed or acquired without authorization on this date.
March 4, 2025 — Suspicious Activity Detected
Goshen detects suspicious activity, starts an investigation and brings in outside cybersecurity specialists.
March 22, 2025 — Ransomware Group’s Claim
A ransomware group lists Goshen on its leak site. Goshen has not confirmed the claim or any ransom.
September 12, 2025 — Review Finished
Goshen’s review confirms the files held patient names, Social Security numbers, driver’s license numbers and medical record numbers.
September 2025 — 456,385 People Notified
Letters go out and the breach is reported to HHS and the Maine Attorney General. Attorneys working with ClassAction.org announce an investigation.
October 2026 — Still No Lawsuit Found
As of October 18, 2026, we found no filed class action, no settlement, no fund and no claim form.
Three Things to Watch For
A breach with real letters, Social Security numbers and no settlement is the setup imposters look for:
“Claim your Goshen settlement” pages
There is no Goshen Medical Center settlement, so there is no claim site. A form asking for your Social Security number to “join” or “add you to” the case is collecting data. On news sites, commenters are already asking to be “added” — nothing like that exists.
Calls claiming to be from Goshen or Epiq
The real letter lists one help line, 877-396-3238. Enrollment happens on privacysolutionsid.com with the code in your letter. Neither Goshen nor Epiq calls to ask for your full Social Security number, a card number or a fee.
Fake medical bills and insurance claims
Medical record numbers and dates of birth are what medical identity thieves need. Read every Medicaid, Medicare or insurer statement for visits you never had, and question any bill from a clinic you did not visit.
Goshen Medical Center Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is there a Goshen Medical Center data breach lawsuit?
Not that we could find. As of October 18, 2026, we found no class action filed over the February 2025 breach. Law firms announced investigations in September 2025, which is not the same as a lawsuit. The only federal case naming Goshen we found is an unrelated employment case, closed October 24, 2025.
How many people were affected?
456,385 people, according to Goshen’s reports to HHS and the Maine Attorney General. A separate South Carolina filing listed 5,234 residents of that state.
What information was exposed?
Per Goshen’s notice letter: name, address, date of birth, Social Security number, driver’s license number and medical record number. Goshen says it has no evidence the information was misused.
Is the Goshen breach letter real?
Genuine letters came from a “Secure Processing Center” return address in Suwanee, Georgia, were signed by Goshen Medical Center in Faison, North Carolina, and offered Epiq Privacy Solutions ID Standard monitoring with an activation code. The help line in the letter is 877-396-3238. If anything in your letter differs, call the clinic using a number you look up yourself.
How much compensation will I get for a data breach?
For this breach, nothing today — there is no settlement, no fund and no claim form. Breach settlements elsewhere range widely; our data breach settlement calculator shows what comparable cases paid. Goshen’s concrete offer right now is free credit monitoring for 12 or 24 months.
Can you sue a hospital for a data breach?
Yes, patients do. One example with a similar name: patients of Goshen Health in Indiana, a different organization, sued in Elkhart County Superior Court on May 23, 2023 over website tracking tools, and the case settled with a $25 cash payment for patients who logged into its portal between January 1, 2020 and December 31, 2023. That settlement does not cover Goshen Medical Center patients in North Carolina.
Is this the same as the Goshen Health settlement?
No. Goshen Health is a hospital system in Goshen, Indiana, and its settlement was about Meta Pixel tracking on its website. Goshen Medical Center is a North Carolina health center network, and its case is a 2025 network breach. Different organizations, different events.
What is worth doing right now?
Enroll in the free monitoring with the code in your letter before its deadline. Freeze your credit at all three bureaus — free and reversible. Check benefit statements for care you never received. Keep the letter. For similar clinic breaches, see our Skin Center breach page.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Data Breach Settlement CalculatorWhat breach settlements have actually paid per person
- Open Class Action SettlementsSettlements taking claims right now, with deadlines
- Riviera Healthcare Center BreachAnother clinic breach where no lawsuit has been filed
- Regal Medical SettlementA medical group breach case that reached a settlement