Minnesota DHS Data Breach Lawsuit: 303,965 People, No Verified Case
Reference Guide
If you got a letter from the Minnesota Department of Human Services dated January 2026, this is the incident. A user tied to a licensed health care provider looked at records in MnCHOICES — the state system for long-term care assessments — between August 28 and September 21, 2025. As of October 2026 we found no verified Minnesota DHS data breach lawsuit in court, no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened, According to DHS
MnCHOICES is used by counties, Tribal Nations and managed care organizations to assess and plan long-term services and supports. It is run for the state by FEI Systems, a government IT firm based in Maryland.
This was not a hack. A user affiliated with a licensed health care provider had legitimate credentials for some MnCHOICES data, but, per DHS, viewed more “than was reasonably necessary to perform work assignments.” The access ran from August 28 to September 21, 2025. The user’s access was fully terminated on October 30, 2025, and the activity was detected on November 18, 2025.
DHS reported the incident to the U.S. Department of Health and Human Services and began mailing letters on January 16, 2026. The HHS breach portal lists 303,965 affected individuals.
Case details
No Minnesota DHS data breach lawsuit could be verified in court as of October 18, 2026. A search of our federal court database found no case against FEI Systems; the only recent federal case naming the DHS commissioner, Allina Health System v. Minnesota Department of Human Services Commissioner, No. 0:26-cv-04348, is about something else.
Plaintiffs’ firms announced investigations against DHS and FEI Systems from January 21, 2026. One firm’s website reportedly describes a class action filed against FEI Systems, but we could not confirm a court, case number or filing date, so we do not treat it as filed. A suit could also be in a Minnesota state court, which our database does not cover.
Status: Investigations, No Settlement
Are You Affected?
The test is your mail. DHS sent letters to the people in the 303,965 count beginning January 16, 2026. If you, or someone whose long-term care was assessed through a county, Tribal Nation or managed care plan, got one, keep it and the envelope.
What was viewed: for most people, names, addresses, email addresses, phone numbers, dates of birth, sex, Medicaid IDs and eligibility data. For 1,206 people more was viewed. Reports differ on what: some describe medical details and, for some, the last four digits of a Social Security number; another lists extra demographic data such as income and benefits. DHS says it could not tell exactly which fields were viewed for each person.
Is There Money?
For orientation only, Minnesota’s Data Practices Act lets a person sue a government entity for damages actually sustained, and for a willful violation adds exemplary damages of $1,000 to $15,000 per violation. Whether any of that applies here is undecided. Because there was no hack, no confirmed misuse and no full Social Security numbers, people with no documented loss should not expect much. For what resolved breach cases have paid, see the data breach settlement calculator.
Minnesota DHS Breach Timeline
August 28 – September 21, 2025 — The Access
A provider-affiliated user with legitimate MnCHOICES credentials views records beyond what the work required.
October 30, 2025 — Access Removed
The user’s access to MnCHOICES is fully terminated.
November 18, 2025 — Detected
FEI Systems, the vendor running MnCHOICES, detects the activity and notifies DHS. A forensic firm is hired at DHS’s request.
January 16, 2026 — Letters and HHS Report
DHS reports the incident to HHS and starts mailing notices. The HHS portal lists 303,965 people. No credit monitoring is offered.
January 21, 2026 — Firms Investigate
Plaintiffs’ firms announce investigations into claims against DHS and FEI Systems.
October 2026 — No Verified Case
As of October 18, 2026 we found no verifiable lawsuit, no settlement and no claim form.
Three Things to Watch For
The people in this breach are Medicaid and long-term care clients, and the exposed fields include Medicaid IDs and phone numbers:
“Claim your DHS breach payment”
There is no settlement and no claims site. A text or page asking for your Medicaid ID or bank details to “release” money is not connected to this incident.
Calls quoting your Medicaid ID
A caller who knows your Medicaid number, birth date and address may have it from this breach. Do not confirm details or pay anything. Report suspected Medicaid fraud to DHS at 651-431-2650.
“DHS will give you credit monitoring”
DHS has said it is not offering free credit monitoring for this incident. An offer in its name that asks for your full Social Security number deserves suspicion.
Minnesota DHS Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is there a Minnesota DHS data breach lawsuit?
As of October 18, 2026, we could not verify one. Firms announced investigations in January 2026 and one reportedly says it filed against FEI Systems, but we found no court, case number or filing date. There is no settlement.
What settlements are there for the data breach?
None. No settlement, fund, claim form or deadline exists for the MnCHOICES breach. Settlements open for claims elsewhere are listed on our open class action settlements page.
How much compensation will I get for a data breach?
For this breach, nothing is payable now. Minnesota law allows suits against a government entity for actual damages, plus $1,000 to $15,000 per willful violation, but no court has found a violation here.
Do companies have to notify you of a data breach?
Here the notifier was a state agency. Minn. Stat. § 13.055 requires written notice “in the most expedient time possible and without unreasonable delay,” and says you can get the investigation report. HIPAA requires a report to HHS within 60 days of discovery; DHS reported on January 16, 2026.
How many people were affected, and what was taken?
The HHS portal lists 303,965 people. Most had demographic and contact data plus Medicaid IDs viewed; 1,206 had more viewed. DHS says nothing was shown to be misused.
Is this the same as the DHS lawsuits in the news?
No. Most “DHS lawsuit” headlines involve the federal Department of Homeland Security; see our DHS lawsuit page. A story about a DHS breach of up to 3,000 people is an older phishing incident, not this one.
Who is the best solicitor for data breach claims?
“Solicitor” is a UK term, and this page does not rank lawyers. For this Minnesota incident, a Minnesota-licensed attorney is the relevant choice; read any retainer before signing.
What should I do right now?
Keep your letter. Read health care statements for services you did not receive and report suspected Medicaid fraud to DHS at 651-431-2650. A free credit freeze is a cheap precaution.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Open Class Action SettlementsSettlements currently taking claims, with deadlines
- Data Breach Settlement CalculatorWhat resolved breach cases have paid per person
- Minnesota ENT Data BreachA separate Minnesota health-data breach and its status
- DHS Lawsuit (Homeland Security)The federal DHS cases often confused with this one