Mankato Clinic Data Breach Lawsuit: A Cyberattack Under Investigation, No Case Filed
Reference Guide
Mankato Clinic, the independent physician group in southern Minnesota, said in September 2026 that it is investigating a cyberattack on its network after a criminal group claimed it stole data. As of October 15, 2026 the clinic has not confirmed what was taken or how many people are affected, and we found no Mankato Clinic data breach lawsuit filed in any court we could search. There is no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened in September 2026
On September 10, 2026, a ransomware-extortion group listed Mankato Clinic on its leak site. According to a dark-web monitoring post cited by ClassAction.org, the group claims it took 610 gigabytes of data in an attack that the monitoring site estimates occurred the same day. That figure is the attackers' claim. The listing itself does not say how many people are involved or which kinds of information are in it.
On September 15, 2026, the clinic told KEYC News that it had become aware of “unauthorized activity involving our computer network” and brought in cybersecurity experts and legal counsel. It said it has not confirmed the accuracy of the group's claim, “including the amount or specific information,” nor how many people may be affected. Patient care was not affected and the clinics stayed open.
Case details
No lawsuit has been filed that we could find. A search of federal court records (CourtListener's RECAP archive and our own federal docket database, checked October 15, 2026) returned no data breach case against Mankato Clinic. Minnesota state-court records were not part of that search, so a state filing cannot be ruled out.
What exists is an attorney investigation: on September 10, 2026 a plaintiff-side firm posted that it was “looking into whether a class action lawsuit can be filed” and asked patients and staff to come forward. An investigation is a search for clients, not a case. It has no court, no case number and no judge.
Status: Investigation, No Lawsuit, No Settlement
Federal health-privacy law sets the clock. Under the HIPAA Breach Notification Rule, a provider must notify affected patients without unreasonable delay and no later than 60 calendar days after discovering a breach. If 500 or more people are involved, the federal health department must be told at the same time. The clinic has not said what day it discovered the activity, so no notification date can be calculated yet.
Am I Affected?
Nobody can answer that yet, including the clinic. It has not confirmed whether any patient information was taken. If you were a patient or employee of Mankato Clinic, the deciding document will be a notice letter from the clinic, which by law has to describe what happened and what information was involved.
Watch your mail. HIPAA notices go by first-class mail to the last address the clinic has. If you have moved since your last visit, update your address with the clinic. Keep any letter you receive: it states which of your fields were involved, and it would be your proof of membership in any future class.
Different clinic, different case: Mankato Clinic is an independent group with more than 100 years in the community. It is not Mayo Clinic Health System, which also runs hospitals and clinics in the Mankato area. For cases against Mayo, see our Mayo Clinic lawsuit page.
Is There Any Money?
For context only, not a prediction: healthcare-breach settlements have generally paid back documented out-of-pocket losses, made a smaller flat payment to people who document nothing, and offered credit monitoring. What a case like this could be worth depends on facts nobody has confirmed yet: how many people, and whether Social Security numbers or medical records were in the data. Our data breach settlement calculator shows how past cases were structured.
Mankato Clinic Data Breach Timeline
2010 — Stolen Laptop
A separate, earlier incident. A laptop holding information on nearly 3,200 patients is stolen from a nurse's car. The records include names, birth dates, medical record numbers and diagnoses, but no Social Security numbers.
August 3, 2021 — Misdirected Email
Another earlier incident. An employee emails a spreadsheet on 535 patients to an outside account by mistake. The clinic reports that the recipient deleted it unopened. No Social Security numbers are involved.
September 10, 2026 — Leak-Site Claim
A ransomware-extortion group lists Mankato Clinic and claims it took 610 gigabytes of data. It gives no count of people and no data categories.
September 10, 2026 — Attorneys Start Recruiting
A plaintiff-side firm posts an investigation and asks patients and staff to contact it. This is an investigation, and no case is filed.
September 15, 2026 — Clinic Confirms an Investigation
Mankato Clinic says it found unauthorized activity on its network and is investigating with outside experts. It has not confirmed the group's claim or how many people are affected, and patient care continues.
October 15, 2026 — No Notice, No Lawsuit Found
We found no patient notice letters, no public breach report and no lawsuit in the federal records we searched. There is no settlement or claim form.
Three Things to Watch For
When a hack is announced before the facts are known, scammers move into the gap:
Calls or texts claiming to be the clinic
The clinic has said it will notify affected people directly, and HIPAA notices go by mail. A caller who mentions your Mankato Clinic visit and then asks you to “verify” your Social Security number, insurance ID or card details is fishing.
Messages claiming your records were leaked
Leak-site listings are public, so anyone can name the clinic and claim to hold your file. Do not pay or reply to anyone who demands money to keep your records private. Keep the message and tell the clinic.
“Mankato Clinic settlement claim” forms
No settlement exists, so no claim form exists. A page asking for your personal details to “secure your share” of a Mankato Clinic payout is collecting data. An attorney intake form is not a claim either: it is a request to become a client.
Mankato Clinic Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is there a Mankato Clinic data breach lawsuit?
Not that we could find as of October 15, 2026. A plaintiff-side firm announced an investigation on September 10, 2026. We found no complaint in federal court records. We did not search Minnesota state-court records, so a state filing cannot be ruled out. If a case is filed, we will add the court, the case number and the date here.
What happened at Mankato Clinic in September 2026?
On September 10, 2026 a ransomware group claimed it had stolen 610 gigabytes of the clinic's data. On September 15 the clinic said it had found unauthorized activity on its network and was investigating with cybersecurity experts and legal counsel. It has not confirmed the group's claim.
How many patients were affected, and what data was exposed?
Unknown as of October 15, 2026. The clinic says it has not confirmed how many people may be affected or what information was involved, and the attackers' listing names neither. Any figure you see elsewhere is unconfirmed. The official answer will come in the clinic's notice letters and, if 500 or more people are involved, in the clinic's report to the federal health department.
Is there a Mankato Clinic data breach lawsuit payout per person?
No. There is no settlement and no fund, so there is no per-person amount. Nobody can calculate one until a case is filed, the number of affected people is known and a settlement is approved by a court.
How much can I get from a data breach settlement?
It depends on the settlement. Healthcare-breach settlements typically reimburse documented losses (with receipts), make a smaller flat payment to people who document nothing, and add credit monitoring. Nothing is payable for this incident. Our data breach settlement calculator explains how past cases paid. For breaches that are paying now, see open class action settlements.
Is Mankato Clinic the same as Mayo Clinic Health System in Mankato?
No. Mankato Clinic is an independent group, and its CEO said in January 2026 that it plans to stay independent. Mayo Clinic Health System is a separate organization that also operates in the Mankato area. This incident concerns Mankato Clinic only. For cases involving Mayo, see our Mayo Clinic lawsuit page.
Has Mankato Clinic had a data breach before?
Yes, two smaller ones that were made public. In 2010 a laptop with information on nearly 3,200 patients was stolen from a nurse's car. On August 3, 2021 a spreadsheet on 535 patients was emailed to an outside account by mistake and was reported deleted unopened. Neither involved Social Security numbers.
What should I do right now?
Watch your mail for a letter from Mankato Clinic, and make sure the clinic has your current address. Read your insurer's explanation-of-benefits statements for care you never received. Consider a free credit freeze at all three bureaus. Do not give personal details to anyone who contacts you about a “settlement.”
About This Information
- Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated
- $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Data Breach Settlement CalculatorWhat healthcare breach settlements have paid per person
- Open Class Action SettlementsSettlements taking claims right now, with deadlines
- Mayo Clinic LawsuitA different provider: the Mayo Clinic cases and their status
- Settlement Payout CalculatorEstimate a share once a settlement fund exists