MorseLife Health System Data Breach: A Ransomware Claim, No Lawsuit Yet
Reference Guide
MorseLife is a nonprofit senior-care system in West Palm Beach, Florida. On October 4, 2026, a ransomware group listed it as a victim and claimed 344 GB of stolen data. As of October 17, 2026, MorseLife has not published a notice, no number of affected people has been reported, and we found no lawsuit. There is no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Has Actually Been Reported
Everything public so far comes from the attackers, not from MorseLife. Ransomware.live, a site that indexes leak-site posts, recorded MorseLife Health System, Inc. as a victim of a group calling itself Booba Project on October 4, 2026, with an estimated attack date of October 2, 2026. The listing claims 344 GB of stolen data. Breachsense, another tracker, shows the same claim with an October 5 discovery date.
That is a claim, not a confirmed breach. Ransomware.live says it indexes only what ransomware operators post publicly and does not access the data. No source we found names which files, or whose records, are in the 344 GB. One security vendor writes that the data is “projected” to contain health and personal information about residents and patients — a guess based on what MorseLife does, and the vendor itself says it does not warrant the claims.
Separately, Breachsense lists older leaked logins for morselife.org addresses from unrelated breaches, and says none of it is necessarily connected to this attack.
Case details
No lawsuit has been found. A search of our federal court database (CM/ECF feeds since October 10, 2026, which do not cover every court) on October 17, 2026 returned no case naming MorseLife. Florida state courts were not searched, so a state filing cannot be ruled out.
What exists is a lawyer investigation: a page published October 5, 2026 on a case-listing site says attorneys are “looking into whether a class action lawsuit can be filed” and are seeking current and former staff, residents and their families. An investigation is an advertisement for clients, not a case.
Note that Florida’s breach-notice statute, section 501.171, says it “does not establish a private cause of action.” Data breach suits are normally built on negligence and similar claims instead.
Status: Unconfirmed Incident, No Notice, No Lawsuit
The next real event would be notice letters. Under HIPAA, a health provider must notify affected people “in no case later than 60 calendar days after discovery of a breach,” and report breaches of 500 or more people to the U.S. Department of Health and Human Services at the same time. Florida law separately requires notice to residents and to the state within 30 days of determining a breach, with up to 15 additional days for good cause. The clock starts at discovery, which MorseLife has not disclosed — so no exact deadline can be computed. Florida keeps its own breach reports confidential during an investigation, so the federal HHS list is where a count would most likely appear first.
Who Could Be Affected
Nobody knows yet whose data is involved. MorseLife runs a West Palm Beach campus with independent and assisted living, short-term rehabilitation, long-term care and memory care, plus home health care, Palm Beach Hospice and the PACE program in Palm Beach County. That means residents, patients, home-care and hospice clients, their family contacts and employees could all have records with the organization.
The practical test is a letter from MorseLife. If your data was involved, the notice should say which fields were exposed. Keep it and the envelope. Without a notice, there is no way to know whether you are affected — and no class exists to join.
Is There Money? Not Now
For context only: when health-system breach cases do settle, they usually offer a flat payment without proof and a larger, capped reimbursement for documented losses. The Tift Regional Health System settlement, for example, offers an estimated $75 without proof or up to $5,000 with it. That is a different case and not a prediction for this one. Our data breach settlement calculator shows how documented losses change the numbers.
MorseLife Breach Timeline
October 2, 2026 — Estimated Attack Date
The date ransomware trackers give for the claimed attack on MorseLife Health System. It comes from the group’s post, not from MorseLife.
October 4, 2026 — Leak-Site Listing
Ransomware.live records MorseLife as a victim of Booba Project, with a claim of 344 GB of stolen data.
October 5, 2026 — Lawyers Start Advertising
A case-listing site publishes an investigation page seeking staff, residents and families. Impacted data is listed as “TBD.”
October 17, 2026 — Still No Notice or Lawsuit
No MorseLife statement, no count of affected people and no lawsuit found in federal court records.
Next — Notice Letters, Then Possibly Lawsuits
HIPAA allows up to 60 calendar days after discovery for notice. Breach lawsuits typically follow notice letters, not leak-site posts.
Three Things to Watch For
A claimed breach at a senior-care provider, with no official information yet, is an easy opening for scammers targeting older adults and their families:
Calls “from MorseLife” about your stolen records
A caller who knows a resident’s name and room is not proof of anything. Do not give a Social Security number, Medicare number or bank details by phone; hang up and call MorseLife on the number you already have.
“Pay to delete your data” messages
Leak-site groups and copycats sometimes contact individuals directly. Paying a stranger does not delete anything. Report such messages to the FBI’s Internet Crime Complaint Center instead of answering.
“MorseLife settlement” sign-up pages
There is no settlement and no claims site. A page asking for your details to “claim your share” is collecting data, and an attorney intake form is a request to become a client, not a registration.
MorseLife Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Was MorseLife Health System really hacked?
Unconfirmed. A ransomware group listed MorseLife as a victim on October 4, 2026 and claimed 344 GB of data. As of October 17, 2026, MorseLife has not published a statement we could find, and nothing in the claim has been independently verified.
Is there a MorseLife Health System data breach lawsuit?
Not that we could find as of October 17, 2026. Our federal court database showed no case naming MorseLife; Florida state courts were not searched. Law firms have announced investigations, which are not lawsuits.
What data was exposed, and how many people?
Neither is known. No official count has been reported, and the ransomware claim does not list the data types. If 500 or more patients are involved, HIPAA requires MorseLife to report it to HHS, which publishes such reports.
How much do you usually get from a data breach settlement?
It depends on the case, and here there is nothing to get: no lawsuit and no settlement. Health-system settlements often pay a small flat amount without proof and more for documented losses — the Tift Regional settlement offers an estimated $75 without proof or up to $5,000 with it. Our calculator shows the range.
Is the data breach settlement legit?
There is no MorseLife settlement, so any “MorseLife settlement” message or claim site is not legitimate. Real settlements are run by a court-appointed administrator after a judge approves them, and they are listed on our open settlements page.
Can you sue for a healthcare data breach?
People do, usually on negligence and related claims; Florida’s breach-notice statute itself does not create a private right to sue. Other health-system cases show the range of outcomes, such as the Rush MyChart case and the Yale New Haven Health case. For your own situation, talk to a licensed attorney.
When should I expect a notice letter?
HIPAA sets an outer limit of 60 calendar days after discovery, and Florida law 30 days after a breach is determined. MorseLife has not said when it discovered the incident, so no exact date can be given.
What is worth doing right now?
Freeze credit at all three bureaus — free and reversible, and useful for older relatives too. Read Medicare or insurance statements for care that was never received. Keep any letter from MorseLife, and treat unsolicited calls about the breach with suspicion.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Data Breach Settlement CalculatorWhat comparable breach settlements have paid, by documented loss
- Open Class Action SettlementsSettlements you can file a claim in right now, with deadlines
- Settlement Payout CalculatorHow a fund divides among claimants once fees are paid
- Unlimited Systems Data BreachAnother 2026 breach, from notice letters to consolidated suits