Northern NJ Eye Institute Data Breach: A Ransomware Claim, No Lawsuit Yet
Reference Guide
Searching for a Northern NJ Eye Institute data breach lawsuit? As of mid-October 2026 there is none we could find. What exists is a claim: on September 30, 2026 a ransomware group listed the South Orange, West Caldwell and Elizabeth eye practice on its leak site, with an estimated attack date of September 29. The practice has not posted a confirmation, no patient count has been published, and there is no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Has Actually Been Reported
Northern New Jersey Eye Institute (NNJEI) is an ophthalmology practice with an ambulatory surgery center. Its own website describes more than thirty years in practice and three clinics in South Orange, West Caldwell and Elizabeth.
On September 30, 2026, ransomware trackers recorded a post by a group calling itself The Gentlemen naming the practice as a victim. Ransomware.live lists the estimated attack date as September 29, 2026. One threat-intelligence site reports that the group threatens to publish data unless its demands are met.
That is the attacker's claim, not a confirmed breach. As of mid-October 2026, the practice's homepage carried no incident notice, trackers list the leak size as unknown, and no source we found states which patient data — if any — was taken.
Case details
No lawsuit has been filed that we could find. A search of federal dockets on CourtListener for both “Northern NJ Eye Institute” and “Northern New Jersey Eye Institute” returned only unrelated older matters (a Social Security appeal and several bankruptcy dockets), and our own database of federal court filings shows no case naming the practice.
What does exist is lawyer advertising: the lawsuit-referral site ClassAction.org published an “investigation” page on September 30, 2026, asking patients and staff to come forward. An investigation page means a firm is looking for clients — it is not a complaint, it has no case number, and nobody is a class member of it. New Jersey state-court filings are not searchable in the same way, so a state-court suit cannot be ruled out entirely.
Status: Unconfirmed Claim, No Case, No Settlement
What happens next is set by federal law, not by the lawyers. If protected health information was taken, the HIPAA Breach Notification Rule requires the practice to notify affected patients without unreasonable delay and no later than 60 calendar days after it discovered the breach. If 500 or more people are affected, it must report to HHS at the same time, and the incident then appears on the public HHS breach portal with a patient count. Breach lawsuits typically follow those letters, not the leak-site post.
Could You Be Affected?
Possibly, if you are a current or former patient or employee of NNJEI. But nobody — not the attackers, not the trackers, not the law firms — has published which records were involved or how many people.
The practical test is your mail. If the practice confirms that patient data was taken, affected people receive a written notice that says which fields were in their record. Keep that letter and its envelope: it is the proof that matters if a lawsuit or settlement follows.
If no letter arrives, that is not proof you were unaffected while the investigation is still running. It is also not a reason to give your details to anyone who calls first.
Is There Any Money?
For context only: when eye-practice breaches have settled, they have typically paid documented out-of-pocket losses and a smaller flat amount, sometimes with credit monitoring. Our page on the Eye Physicians of Central Florida breach settlement shows how one such deal worked, and our Asheville Eye report covers another, for up to 327,756 patients. Those are different cases and say nothing certain about this one — the size of any fund here would depend on facts nobody has published yet.
Northern NJ Eye Institute Breach Timeline
September 29, 2026 — Estimated Attack Date
Ransomware.live lists this as the estimated date of the attack claimed against NNJEI. The date comes from tracking the leak site, not from the practice.
September 30, 2026 — Leak-Site Claim Appears
A group calling itself The Gentlemen names the practice on its leak site. Trackers including Ransomware.live, HookPhish and DeXpose record the claim the same day.
September 30, 2026 — Lawyer Investigation Page Appears
An investigation page on ClassAction.org asks patients and staff to come forward. It lists the impacted data as to be determined. No complaint is filed.
October 2026 — Still Unconfirmed
As of mid-October 2026 the practice has posted no incident notice on its homepage, the leak size is listed as unknown, and no lawsuit appears in the federal dockets we searched.
Next — Notice Letters and an HHS Report
If patient health data was taken, HIPAA requires notice within 60 calendar days of discovery, and an HHS report at the same time if 500 or more people are affected.
Three Things to Watch For
An unconfirmed ransomware claim against a medical practice, with no official notice yet, is exactly the gap imposters use:
“Your eye-clinic records were leaked” calls
A caller can name NNJEI and the clinic you visited without knowing anything about you — the practice name and locations are public. The practice's real notice comes in writing. Do not confirm your date of birth, insurance ID or Social Security number to an inbound caller.
“Claim your NNJEI settlement” pages
There is no settlement and no claims portal. Any page asking for your Social Security number or bank details to “register” for this breach is collecting data, not filing anything.
Offers to “check whether your file was leaked”
Leak-site posts are run by the attackers. Sites or messages offering to search stolen files for your name, or to have your data removed for a fee, cannot deliver that and may be extortion. Wait for the practice's letter.
Northern NJ Eye Institute Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is there a Northern NJ Eye Institute data breach lawsuit?
Not that we could find as of mid-October 2026. Federal docket searches for both versions of the practice's name returned only unrelated older matters. Attorneys working with ClassAction.org are running an “investigation”, which is a search for clients, not a filed case.
Did Northern NJ Eye Institute confirm a data breach?
Not publicly as of mid-October 2026. The only source is a ransomware group's leak-site post recorded on September 30, 2026, with an estimated attack date of September 29. The practice's homepage carried no incident notice when we checked.
What data was taken, and how many patients are affected?
Unknown. Trackers list the leak size as unknown and investigation pages list the impacted data as to be determined. No patient count has been published, and no entry on the HHS breach portal has been found.
Is there a settlement or a claim form?
No. There is no settlement, no fund, no administrator, no claim form and no deadline. If that changes, class members are notified directly by a court-appointed administrator, not by a cold call.
How to check if there is a data breach?
For a medical practice, watch for a written notice: HIPAA requires one no later than 60 calendar days after the practice discovers a breach. Incidents affecting 500 or more people are also reported to HHS and show up on its public breach portal. A leak-site listing alone does not confirm what was taken.
What are the laws in New Jersey regarding data breaches?
For a New Jersey medical practice, the federal HIPAA Breach Notification Rule applies: notice to patients without unreasonable delay and within 60 calendar days of discovery, a report to HHS at the same time for 500 or more people, and an annual report for smaller incidents. New Jersey also has its own notification statute for businesses; we have not quoted it here because we could not verify its current text.
Do I need to sign up with a law firm to be included?
No. There is no case to join yet. If a class action is filed and a class is certified or a settlement is reached, class members are included automatically and notified by an administrator. Signing a retainer is a real legal choice, not a registration step.
What is worth doing right now?
Freeze your credit at all three bureaus — free and reversible. Read your health insurer's explanation-of-benefits statements for care you never received. Keep any letter that arrives from the practice, and contact the practice directly, using a number you look up yourself, if you want to ask about the incident.
About This Information
- Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated
- $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Data Breach Settlement CalculatorWhat comparable breach settlements have paid per person
- Eye Physicians of Central FloridaA different eye-practice breach that did reach a settlement
- Open Class Action SettlementsSettlements currently accepting claims, with deadlines
- Settlement Payout CalculatorEstimate a per-person share once a fund exists