MedImpact Healthcare Systems Data Breach Lawsuit: Three Federal Suits, No Settlement
Active Litigation
MedImpact is a pharmacy benefit manager — it runs prescription benefits for health plans and employers, so most affected people never dealt with it directly. It spotted unauthorized activity in its systems on October 18, 2025, but, by its own account, began mailing notices on September 25, 2026. Within days, three proposed class actions were filed in federal court in San Diego. As of October 19, 2026, there is no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened and What the Lawsuits Say
According to MedImpact’s own website notice, it identified unauthorized activity “within certain systems in its environment” on October 18, 2025. It finished reviewing the affected data on July 17, 2026, told its clients on August 13, 2026 and began mailing letters to individuals on their behalf on September 25, 2026.
The people affected are current or former members of pharmacy benefit plans run by MedImpact and/or Elixir Solutions. The data varied by person: name plus address, date of birth and subscriber number; prescription and treatment details (date of service, location, provider name); insurance ID numbers; and, in limited instances, Social Security numbers. MedImpact says it is not aware of any misuse.
The lawsuits allege MedImpact failed to protect that data and then waited too long to say so. One complaint alleges that on October 27, 2025 a ransomware group claimed to have taken about 160 gigabytes of data, that MedImpact acknowledged ransomware the same day, and that the letters to individuals never use the word. Those are allegations; no court has ruled on them.
Case details
All three cases are in the U.S. District Court for the Southern District of California:
Crew v. Medimpact Healthcare Systems, Inc., No. 3:26-cv-05495, filed September 24, 2026, before Judge Benjamin J. Cheeks. Claims: negligence, breach of implied or third-party beneficiary contract, unjust enrichment and the California Confidentiality of Medical Information Act.
McMillian v. Medimpact Healthcare Systems, Inc., No. 3:26-cv-05672, filed October 2, 2026, before Judge Barry Ted Moskowitz. It also names MedImpact Direct, LLC and pleads negligence, breach of implied contract and declaratory judgment.
Sockwell v. Medimpact Healthcare Systems, Inc., No. 3:26-cv-05693, filed October 5, 2026, before Judge Linda Lopez. The plaintiff says he is a former employee of a MedImpact client. A notice of related case was filed in it on October 14, 2026.
Status: Three Early-Stage Cases, No Settlement
MedImpact has not published how many people were affected, and HIPAA Journal reports that neither the affected clients nor the number of individuals has been disclosed. Anything telling you to “file your MedImpact settlement claim” today describes something that does not exist.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Is in the Proposed Classes
Each complaint proposes a nationwide class. Sockwell, for example, seeks “all individuals in the United States who had Private Information impacted as a result of the Data Breach.” A proposed class is only a request; nobody is a class member until a court certifies a class or approves a settlement.
The practical test is your mail. Letters went out from MedImpact on behalf of its clients, so the envelope may mention your health plan or employer benefit plan rather than a name you recognize. The letter states which data fields were in your record. Keep it.
Not sure? MedImpact runs a call center at (844) 958-8925, Monday to Friday, 8 a.m. to 5:30 p.m. Central Time.
What a Case Like This Could Pay
For context only, not a prediction: resolved healthcare-breach settlements have usually combined reimbursement of documented losses (receipts required), a smaller flat payment for people who document nothing, and credit monitoring. Our data breach settlement calculator shows how those pieces add up. Separately, MedImpact is offering free credit monitoring now, but only to people whose Social Security number was involved; the offer is in your letter.
MedImpact Breach Timeline
October 18, 2025 — Unauthorized Activity Found
MedImpact identifies unauthorized activity in certain systems, secures them and starts an investigation with outside experts.
October 27, 2025 — Ransomware Claim
Per one complaint, a ransomware group claims about 160 gigabytes of data and MedImpact says it found ransomware. Both are allegations in the complaint.
July 17 to August 13, 2026 — Review Done, Clients Told
MedImpact finalizes its data review on July 17 and notifies its health plan and employer clients on August 13.
September 25, 2026 — Letters to Individuals
MedImpact starts mailing notices on its clients’ behalf; its call center opened September 22.
September 24 to October 5, 2026 — Three Lawsuits
Crew, McMillian and Sockwell are filed in the Southern District of California, each seeking a nationwide class.
October 19, 2026 — No Settlement
A notice of related case was filed October 14. No ruling, no settlement, no claim form and no deadline exist.
Three Things to Watch For
A breach with an undisclosed victim count and a vendor most people never heard of leaves room for imposters:
“Claim your MedImpact settlement” pages
There is no settlement and no claims portal. A form asking for your Social Security number or member ID to “secure your payment” is collecting data, not filing a claim. Sign-up forms run by lawyers are not claim forms either.
Calls about your prescriptions
The exposed data includes prescription and treatment details, so a caller can sound convincing by naming a drug or pharmacy. MedImpact’s letter does not ask you to call back with your full Social Security number or pay anything.
Fake credit monitoring offers
Real monitoring is offered only to people whose Social Security number was involved, and MedImpact says it is offered by letter. An email or text with a link to “activate MedImpact protection” that you did not request is a red flag; check it against the letter or the (844) 958-8925 call center.
MedImpact Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
What is MedImpact Healthcare Systems?
MedImpact Healthcare Systems is a pharmacy benefit manager. It runs prescription drug benefits for health plans, government entities and self-insured employers. If your plan used MedImpact or Elixir Solutions, your pharmacy data passed through its systems even if you never dealt with it directly.
Is there a MedImpact Healthcare Systems data breach lawsuit?
Yes, three. Crew (No. 3:26-cv-05495, filed September 24, 2026), McMillian (No. 3:26-cv-05672, filed October 2, 2026) and Sockwell (No. 3:26-cv-05693, filed October 5, 2026) are all proposed class actions in the U.S. District Court for the Southern District of California. As of October 19, 2026, none has a ruling or settlement.
How many people were affected?
MedImpact has not said publicly. HIPAA Journal reports that the affected clients and the number of affected individuals have not been disclosed. One complaint says only that “at least thousands” were affected.
What data was exposed?
It varied by person: name plus address, date of birth and subscriber number; prescription and treatment details; insurance ID numbers; and, in limited instances, Social Security numbers. Your own letter lists the fields that applied to you.
How much compensation will I get for a data breach?
From this breach, nothing yet. There is no settlement, no fund and no claim form, and no court has valued the claims. If a settlement comes, the official notice will set out the payment options and the deadline.
Is the MedImpact letter real?
MedImpact posted a website notice and filed a sample letter with the California Attorney General. The letters are headed “Notice of Data Breach” and give the call center number (844) 958-8925. If your letter shows a different number or asks for payment, treat it as suspect.
Do I have to do anything to join the lawsuit?
No. You cannot sign up for a class action. If a class is certified or a settlement is approved, class members are notified, typically by mail or email, with any claim form and deadline.
What is worth doing right now?
Keep your letter. If it offers credit monitoring, enroll following the instructions in the letter. Read your health plan’s explanation-of-benefits statements for prescriptions you never filled, and consider a free credit freeze. For other vendor breaches we track, see Unlimited Technology Systems.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Change Healthcare Data BreachAnother health-data vendor breach, now a federal MDL
- Guardian Pharmacy Data BreachA separate pharmacy data breach case and where it stands
- Data Breach Settlement CalculatorEstimate what comparable breach settlements have paid
- Open Class Action SettlementsSettlements you can file a claim in right now