Millstone Medical Outsourcing Data Breach Lawsuit: What Happened and Where It Stands
Active Litigation
Millstone Medical Outsourcing, a medical-device packaging, testing and logistics company in Fall River, Massachusetts, says an intruder was in its systems from December 15 to December 19, 2025. It took until July 15, 2026 to confirm personal data was involved, and notices went out in September 2026. A federal suit was filed in Massachusetts on September 25, 2026. As of October 2026 there is no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened in the Millstone Medical Outsourcing Data Breach
Millstone does post-manufacturing work for medical-device makers: sterile packaging, testing and logistics, with its headquarters in Fall River, Massachusetts and a distribution center in Olive Branch, Mississippi.
According to the company's own notice, it became aware of suspicious activity on December 16, 2025. Its investigation found that between December 15 and December 19, 2025, company data was subject to unauthorized access and/or acquisition. A data review then had to work out what was taken and whose it was; on July 15, 2026 it determined that personal information was involved.
A filing listed by the Vermont Attorney General, dated September 21, names Social Security numbers, government ID numbers, financial account codes, credit and debit account information and health records. The company says it is unaware of any personal information being released. We could not read the complaint, so what the lawsuit alleges is covered in the next section.
Case details
One federal suit, as of October 2026. Correia v. Millstone Medical Outsourcing, LLC, No. 1:26-cv-14390, was filed on September 25, 2026 in the U.S. District Court for the District of Massachusetts and assigned to Judge Brian E. Murphy, with Magistrate Judge Paul G. Levenson for referrals. The docket lists a jury demand and attaches the breach notice as Exhibit A. We could not read the complaint itself, so whether it is pleaded as a class action is not confirmed here.
Not the same case: O'Neal v. Millstone Medical Outsourcing, No. 3:25-cv-25 in the Northern District of Mississippi, is an individual employment dispute that ended with summary judgment for Millstone on March 26, 2026. It has nothing to do with the breach.
Status: Lawsuit Filed, No Settlement
What is real and available now is the company's own offer: 24 months of free credit monitoring and identity protection through TransUnion. Enrollment instructions are in the notice letter. That offer comes from the company, not from the court case.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Was Affected by the Millstone Medical Outsourcing Data Breach
Millstone has not published a total. HIPAA Journal reported on September 28, 2026 that the number had not been publicly disclosed. The breach tracker Claim Depot lists 1,094 Massachusetts residents and a total of 3,503 people; we could not confirm either figure against a state filing, so treat them as reported, not official.
The practical test is your mail. The company says it is notifying “impacted individuals and customers.” Millstone's customers are device manufacturers, so the letter may be the only sign your record was in its files. Keep the letter and envelope: it names the data fields involved and is your proof if a class is ever certified.
This is a data-security case, not a medical-malpractice claim. If you are researching an injury claim against a provider, our state tools for Texas, Tennessee, Virginia and Washington cover that separately.
What the Millstone Medical Outsourcing Data Breach Lawsuit Could Pay
Millstone Medical Outsourcing Breach Timeline
December 15–19, 2025 — The Intrusion
Per the company's notice, data is subject to unauthorized access and/or acquisition during this window. Suspicious activity is spotted on December 16.
July 15, 2026 — Personal Data Confirmed
A third-party data review determines that personal information was involved — about seven months after the intrusion.
September 18, 2026 — Public Notice
The notice runs in USA Today, per Paubox, and appears on the company website on September 22.
September 21, 2026 — Vermont Filing
A report listed by the Vermont Attorney General names SSNs, government IDs, financial account data and health records.
September 25, 2026 — Suit Filed in Massachusetts
Correia v. Millstone Medical Outsourcing, No. 1:26-cv-14390, is filed in the District of Massachusetts before Judge Brian E. Murphy.
As of October 2026 — No Settlement
The case is at the complaint stage. No fund, administrator, claim form or deadline exists.
Three Things to Watch For
A small breach with a real lawsuit and no claim form is easy to exploit:
“Millstone settlement claim” pages
There is no settlement and no claims site as of October 2026. A page asking for your Social Security number to “register for your payout” is collecting data, not filing a claim.
Fake TransUnion enrollment calls
The free monitoring is real, which makes it good cover. Enroll only with the code and instructions printed in your letter — never through a caller who offers to activate it for you.
Messages citing your health records
Health records were among the data listed, so expect texts or calls that mention a device, a surgery or an insurer to sound credible. A real administrator will never ask for a fee or your full SSN by phone.
Millstone Medical Outsourcing Data Breach — Questions People Ask
Short answers to the questions people ask most about this case.
Is there a Millstone Medical Outsourcing data breach lawsuit?
Yes. Correia v. Millstone Medical Outsourcing, LLC, No. 1:26-cv-14390, was filed on September 25, 2026 in the U.S. District Court for the District of Massachusetts before Judge Brian E. Murphy. As of October 2026 it is at the complaint stage.
Is there a Millstone Medical Outsourcing data breach lawsuit payout?
No. There is no settlement, no fund, no claim form and no deadline. If a settlement is ever approved, a court-appointed administrator notifies class members directly.
What data was exposed?
Per the Vermont filing: Social Security numbers, government ID numbers, financial account codes, credit and debit account information and health records. Your letter states which of those applied to you.
How many people were affected?
Millstone has not published a total. Claim Depot reports 1,094 Massachusetts residents and 3,503 people overall; we could not verify those figures against an official filing.
Why did notice take nine months?
The intrusion ran December 15–19, 2025. The company says its data review only determined on July 15, 2026 that personal information was involved, and public notice followed on September 18, 2026. Delays like this are a common complaint in breach suits.
How much compensation will I get for a data breach?
For this breach, nothing is available today. In general, data breach settlements pay documented losses plus a smaller flat amount, and the share depends on fund size and claim rates. Our data breach settlement calculator shows what comparable cases paid.
Was the letter I got from Millstone real?
The company says it is notifying impacted individuals and offering 24 months of TransUnion credit monitoring. A genuine letter matches that description and does not ask you to pay or to call back with your SSN.
What is worth doing right now?
Enroll in the free monitoring using your letter's code, freeze your credit at all three bureaus, and watch insurer statements for care you never received. Keep the letter.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Open Class Action SettlementsSettlements currently accepting claims, with deadlines
- Data Breach Settlement CalculatorWhat comparable breach settlements have paid per person
- Aesto Health Data BreachAnother December 2025 intrusion at a healthcare vendor
- Class Action Payout CalculatorEstimate a per-person share of a settlement fund