Hospital Cyberattack Lawsuits: Which Patient Cases Are Live in October 2026
Reference Guide
When a hospital is hit by ransomware, patient lawsuits usually follow within days, long before anyone knows whose data was taken. As of October 18, 2026, the newest healthcare hospital cyberattack patient data breach ransomware cases are two federal suits against Luminis Health in Maryland and a state-court suit against Cedar County Memorial Hospital in Missouri. None of them has a settlement. Three older hospital and healthcare cyberattack settlements are still taking claims, the first one closing November 12, 2026.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What These Lawsuits Typically Claim
The pattern is consistent. A hospital takes its systems offline, runs on paper for days or weeks, and says it is investigating. A patient sues, usually before any notice letter exists, alleging that the hospital failed to protect the data it held.
In the Luminis Health case, the complaint alleges that patient data sat in “an unencrypted, Internet-accessible environment” and that patients now face a lasting risk of fraud. In the Cedar County Memorial Hospital case, the petition alleges that a ransomware group removed sensitive information and later listed the hospital on a leak site. These are allegations; neither hospital has confirmed that patient data was stolen.
The legal claims are usually negligence, breach of implied contract, invasion of privacy and unjust enrichment. Delay in notifying patients is often pleaded as a separate harm.
Case details
Luminis Health (Maryland). Two proposed class actions are pending in the U.S. District Court for the District of Maryland, both before Judge Chelsea J. Crawford: White v. Luminis Health, Inc., No. 1:26-cv-03606, filed September 11, 2026, and Ritchie v. Luminis Health, Inc., No. 1:26-cv-03663, filed September 16, 2026.
Cedar County Memorial Hospital (Missouri). A proposed class action was filed September 9, 2026 in Cedar County Circuit Court.
Settlements still taking claims: In Re: Susan B. Allen Data Security Litigation, Case No. BU-2025-CV-000185, District Court of Butler County, Kansas; Hall, et al. v. Roseland Community Hospital Association, Circuit Court of Cook County, Illinois; and Isabel Garcia Bueno v. Etairos Health, Inc., Pinellas County Circuit Court, Florida.
Status as of October 18, 2026
Older hospital ransomware case. Kettering Health in Ohio has faced litigation since June 2025 over its May 2025 ransomware attack. We could not confirm a settlement as of October 2026.
Open settlements with real deadlines: Susan B. Allen Memorial Hospital (claims by November 12, 2026), Etairos Health (claims by December 21, 2026) and Roseland Community Hospital Association (claims by December 31, 2026). Each needs a claim form to get cash. The largest healthcare ransomware case, Change Healthcare, is covered on our Change Healthcare page.
Am I Affected?
For the new cases, nobody knows yet. Being a Luminis or Cedar County Memorial patient does not mean your data was taken. Hospitals send notice letters only once their investigation finds whose records were involved. That letter is what tells you whether you are in a future class.
For the open settlements, your notice decides it. Class members were identified from the hospital’s own records. The Susan B. Allen administrator began mailing notices on August 14, 2026.
Etairos Health is different: its breach exposed data of current and former employees, not patients.
Separate hospital breaches we track on their own pages include Yale New Haven Health, UCLA Health, Green Clinic, CHRISTUS Health and Covenant Health.
What Hospital Cyberattack Settlements Actually Pay
Roseland Community Hospital Association — a $650,000 fund for 101,354 people. Documented losses up to $5,000, or a pro rata cash payment estimated at $50, plus one year of medical data monitoring.
Susan B. Allen Memorial Hospital — two years of credit monitoring for all class members, plus out-of-pocket losses and lost time at $25 per hour, capped together at $100 per person.
Etairos Health — documented losses up to $4,500, or a one-time $75 cash payment.
These are typical numbers for hospital breaches: small flat payments, larger amounts only with receipts. Our data breach settlement calculator shows how the pro rata math works.
Hospital Cyberattack Cases: Key Dates
May 2025 — Kettering Health Ransomware
A June 2025 class action alleges a ransomware group breached Kettering Health’s systems on May 20 and took over 730,000 files.
August 14, 2026 — Cedar County Memorial Shuts Down
An IT disruption leads the Missouri hospital to shut down its networks. A patient sues on September 9, 2026.
September 4, 2026 — Luminis Health Attack Announced
Luminis says a cyberattack has hit Anne Arundel Medical Center and Doctors Community Medical Center. Federal suits follow on September 11 and September 16, 2026.
October 13, 2026 — Susan B. Allen Opt-Out Closes
The opt-out and objection deadline passes. The claim deadline is still open until November 12, 2026.
November 12 to December 31, 2026 — Claim Deadlines
Susan B. Allen claims close November 12, Etairos Health claims December 21 and Roseland claims December 31, 2026.
December 7, 2026 to January 20, 2027 — Approval Hearings
Final approval hearings: Susan B. Allen on December 7, 2026, Roseland on January 6, 2027 and Etairos Health on January 20, 2027. Payments come only after final approval.
Three Things to Watch For
Hospital ransomware leaves patients scared and without answers for weeks. That gap is where these show up:
“Luminis settlement” claim pages
There is no Luminis Health settlement and no claim form as of October 2026. A site asking for your Social Security number to “register” for one is collecting data, not filing a claim.
“Your records are on the dark web” calls
After a ransomware leak, patients sometimes get messages saying their medical records will be released unless they pay. Do not pay or reply. Report it to the hospital and to the FBI at ic3.gov.
Lookalike settlement sites
Real administrators use the case name and never charge a fee. For Susan B. Allen, the official site is SBAMHDataSettlement.com. Type the address yourself instead of clicking links in texts.
Hospital Cyberattack Lawsuits — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Which hospital cyberattack lawsuit is in the news right now?
As of October 2026, the newest ones are against Luminis Health in Maryland (two federal suits filed September 11 and September 16, 2026) and Cedar County Memorial Hospital in Missouri (filed September 9, 2026). Neither has a settlement.
Was my data stolen in the Luminis Health attack?
Not known. Luminis has said the system that stores patient records was not affected, and that it will notify patients if protected information was impacted. The lawsuits claim otherwise. Wait for a notice letter before assuming either way.
Is there a settlement I can file for today?
Yes, if you received a notice: Susan B. Allen Memorial Hospital (claims by November 12, 2026), Etairos Health (claims by December 21, 2026) and Roseland Community Hospital Association (claims by December 31, 2026). See all open settlements.
How much do hospital data breach settlements pay?
Usually little per person without receipts: an estimated $50 in Roseland, a $75 flat payment in Etairos, and a $100 cap in Susan B. Allen. Documented losses can pay more, up to $5,000 in Roseland.
Do I need to join a lawsuit to get paid later?
No. If a class is certified or a settlement is reached, you are included unless you opt out. You will need to submit a claim form at that stage to receive cash.
Can I sue over a canceled appointment or delayed care?
Some patients do. The Kettering Health class action alleges that patients missed appointments and treatments. Claims about care itself are individual cases, separate from a data breach class action, and need a lawyer.
Why do lawsuits come before notice letters?
Law firms file early to be first in line, often based on news reports. The Cedar County Memorial plaintiff says she had received no notice when she sued. Filing early says nothing about whether the claims will succeed.
What should I do right now?
Keep any notice letter and envelope. Freeze your credit at all three bureaus. Read your insurer’s explanation-of-benefits statements for care you never received. Never pay anyone who contacts you about your hospital records.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Open Class Action SettlementsEvery settlement still taking claims, with deadlines
- Data Breach Settlement CalculatorEstimate what a breach settlement claim may pay
- Change Healthcare Data BreachThe largest healthcare ransomware case, consolidated as MDL 3108
- Healthcare Highways Data BreachA newer health data breach with no lawsuit filed yet