Hudson MD Group Data Breach: A Ransomware Claim, Not Yet a Lawsuit
Reference Guide
Hudson MD Group is a physician-owned multispecialty practice based in West Orange, New Jersey, co-owned with RWJBarnabas Health. On September 21, 2026 a ransomware group listed it on its leak site. As of October 18, 2026, Hudson MD Group has not publicly confirmed a breach, no patient count or data list has been published, and we found no Hudson MD Group data breach lawsuit on file. There is no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Has Actually Been Reported
Everything known so far comes from the attackers’ side. Ransomware tracker Ransomware.live recorded on September 21, 2026 that the group Metaencryptor had claimed Hudson MD Group, LLC (hudsonmdgroup.com), with an estimated attack date of the same day. Breach tracker Breachsense lists the claim as discovered September 22, 2026 and the leak size as unknown.
That is a claim by the criminals, not a confirmed breach. The attackers have not said publicly what they took, and no outside source has verified it. As of October 18, 2026, the Hudson MD Group website carries no incident notice, and we found no press statement from the company.
Why it matters if it is confirmed: Hudson bills all its member physicians’ services under one tax ID, through separate “Care Centers” across New Jersey. A breach of the central group could touch patients of many of those Care Centers.
Case details
No lawsuit found. As of October 18, 2026, our federal docket database (all district courts, current through mid-October 2026) shows no case naming Hudson MD Group, and we found no state-court filing reported anywhere. Plaintiff firms have opened “investigations” and are collecting contact details from patients; one such page dated September 22, 2026 said notices had not yet been sent. An investigation is advertising, not a case. If a complaint is filed, the most likely venues are the U.S. District Court for the District of New Jersey or the New Jersey Superior Court, and it will have a case number you can check.
Status: Unconfirmed Incident, No Case, No Settlement
The next real event is a notice from Hudson MD Group itself. If patient health information was taken, HIPAA requires the group to notify affected patients without unreasonable delay and no later than 60 calendar days after it discovered the breach. If 500 or more people are affected, it must report to the U.S. Department of Health and Human Services at the same time, and if more than 500 residents of one state are affected, it must also notify prominent media in that state. Lawsuits usually follow those notices, not leak-site posts.
Could You Be Affected?
Possibly, if you were a patient of a Hudson MD Group care center or a physician member’s practice in New Jersey. The group covers primary care, internal and family medicine, cardiology, gastroenterology, neurology, OBGYN, nephrology and urology.
The practical test is your mail. A notice may come from Hudson MD Group or from your doctor’s office, so check the sender. If you get one, keep the letter and the envelope: it will state which fields were in your record and is your proof of membership in any future class. If you have received nothing, that is not proof either way yet.
Is There Any Money?
For context only: when healthcare-breach cases do settle, payments usually come in two forms — reimbursement of documented out-of-pocket losses (receipts required) and a smaller flat payment — often with credit monitoring. Our data breach settlement calculator shows what comparable resolved cases have paid. Treat any specific dollar figure quoted for Hudson MD Group right now as a guess.
Hudson MD Group Breach Timeline
2019 — Hudson MD Group Formed
Independent New Jersey physicians form the group with RWJBarnabas Health. CityHealth Partners manages operations; all members bill under one tax ID.
September 21, 2026 — Leak-Site Claim
Ransomware group Metaencryptor lists Hudson MD Group, LLC on its leak site. Trackers estimate the attack date as the same day.
September 22, 2026 — Trackers Log It
Breach trackers record the claim with leak size unknown. Plaintiff firms open investigation pages the same week.
Next — A Notice From Hudson MD Group
If patient data was taken, HIPAA sets a 60-calendar-day outer limit from discovery for patient letters, and an HHS report if 500 or more people are affected.
October 18, 2026 — No Notice, No Lawsuit
No confirmation from the company, no published patient count, no lawsuit found, no settlement and no claim form.
Three Things to Watch For
A leak-site claim with no official notice is exactly the gap imposters fill:
Calls or texts naming your doctor
Anyone who reads the leak-site post can name Hudson MD Group or your practice and sound informed. A real breach notice comes by letter; nobody legitimate calls to ask for your Social Security number or insurance ID to “verify” you.
“Start your free claim” forms
There is no claim to start: no lawsuit, no settlement. Those forms are law-firm intake. Signing one may be a retainer with a specific firm — read it before you sign, and do not treat it as registration.
Fake “protection” offers
If Hudson MD Group offers credit monitoring, the enrollment code will be in its own letter. Unsolicited offers that charge a fee are not from the company — and a credit freeze, which you can do yourself, is free.
Hudson MD Group Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is there a Hudson MD Group data breach lawsuit?
Not as of October 18, 2026. We found no complaint in federal court and no reported state-court filing. Law firms are investigating, which means they are looking for clients, not that a case exists.
Did Hudson MD Group confirm a data breach?
No public confirmation as of October 18, 2026. The only source is a ransomware group’s leak-site claim from September 21, 2026, recorded by trackers. The company’s website shows no incident notice.
What data was exposed, and how many patients?
Unknown. Breach trackers list the leak size as unknown, and no patient count has been published. If at least 500 people are affected, HIPAA requires a report to HHS, which is where an official number would first appear.
How much compensation will I get for a data breach?
For this incident, nothing today — there is no lawsuit, settlement or fund. In breach cases that do settle, payouts depend on documented losses and the size of the class, so nobody can give an honest figure for Hudson MD Group yet.
Is it worth suing over a data breach?
You do not need to sue on your own to benefit. If a class action is filed and settles, class members are notified and can claim without hiring anyone. Signing with a firm now is a choice, not a requirement; a licensed attorney can advise on an individual claim.
How can I check if I have been data breached?
For this incident, watch for a letter from Hudson MD Group or your practice — HIPAA requires it within 60 calendar days of discovery if your health data was involved. Larger breaches of 500 or more people are also reported to HHS. Checking your credit reports shows whether anyone has used your identity.
Do I have to do anything right now?
No form, no deadline. If you are a patient, you can freeze your credit at Equifax, Experian and TransUnion — the FTC notes it is free and does not affect your score. If you see misuse, report it at IdentityTheft.gov.
Is Hudson MD Group the same as other Hudson breaches in the news?
No. Hudson MD Group, LLC is a multispecialty physician group in West Orange, New Jersey, at hudsonmdgroup.com. Other organizations with “Hudson” in their names are separate companies with separate incidents. Check the name on any letter you receive.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Open Class Action SettlementsSettlements currently accepting claims, with deadlines
- Data Breach Settlement CalculatorWhat comparable breach settlements have paid per person
- Settlement Payout CalculatorEstimate a per-person share once a fund exists
- AMCA Data Breach LawsuitA New Jersey medical-billing breach that did reach court