OSF HealthCare MyChart Lawsuit: No Tracking Case Found, Three Breaches on Record
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
As of October 6, 2026, we found no lawsuit and no settlement claiming that OSF HealthCare’s website or its OSF MyChart portal sent patient data to Meta or Google. What is in the news is different: on July 29, 2026 federal regulators announced a $552,250 HIPAA settlement with OSF over a 2021 ransomware attack. That money goes to the government, not to patients. The patient class action over the same attack settled years ago, and its claim deadline was December 15, 2022.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened at OSF HealthCare
OSF HealthCare is a Peoria, Illinois health system with 174 locations in Illinois and Michigan, including 16 hospitals. Its patient portal is called OSF MyChart (osfmychart.org and the MyChart app).
Tracking: many hospital systems have been sued for allegedly letting the Meta Pixel or Google tools collect what patients did on their websites and portals. We searched news coverage and federal court records for a case like that against OSF and found none. Illinois state-court filings are not searchable online, so a very new state case could exist without being reported.
The 2021 ransomware attack: an intruder was in OSF’s network between March 7, 2021 and April 23, 2021. OSF discovered the ransomware on April 23, 2021. A forensic review found on August 24, 2021 that records of 53,907 patients had been taken, including names, dates of birth, medical record numbers, diagnoses, prescriptions, insurance information and, for some people, Social Security or driver’s license numbers.
Two vendor breaches: in May 2023 the vendor Welltok had its MOVEit file-transfer server breached, which may have included OSF patient data. In December 2025 OSF began notifying patients that hackers had reached legacy systems of its former health-record vendor Cerner (now Oracle Health) as early as January 2025.
Case Details
2021 ransomware case: three class actions were resolved together by one settlement in the Circuit Court, Tenth Judicial Circuit, Peoria County, Illinois. KCC Class Action Services LLC was the administrator. OSF denied all liability. We could not find the case number.
HHS enforcement: this was not a lawsuit. The HHS Office for Civil Rights found that OSF had no accurate risk analysis and notified patients late. OSF sent letters 161 days after the attack, but the rule requires notice within 60 days of discovery. OSF agreed to pay $552,250 and to follow a corrective action plan, monitored for two years.
Oracle Health / Cerner breach: the patient lawsuits are being combined into Blount v. Oracle Health in the U.S. District Court for the Western District of Missouri, before Judge Beth Phillips. As of July 2026, OSF HealthCare was on the list of at least 17 health systems confirmed as affected. We found no report naming OSF as a defendant. See our Oracle Health data breach page for the status of that case.
Status: No OSF MyChart Case; Old Settlement Closed
The 2021 data breach settlement is closed. Claims were due December 15, 2022, and payments were scheduled for March 2023. Its website, osfhealthcaredatasettlement.com, no longer loads.
The HHS settlement of July 29, 2026 is a government penalty. Patients cannot file a claim for it.
The Oracle Health/Cerner litigation is still pending, and we found no settlement in it. If you got a Cerner notice letter from OSF, that case is the one to follow.
Are You Affected?
Tracking claims: no case exists, so there is no class to belong to. If one is filed, it would most likely cover people who used osfhealthcare.org or OSF MyChart to look up conditions, book visits or read results during the period the tracking allegedly ran. The form on this page asks whether you used the website or OSF MyChart, what you did there, and when you last used it. Your answers let us compare your use against any case that is filed later.
OSF HealthCare data breach letters: the 2021 letters went out starting October 1, 2021. The Cerner letters began in December 2025 and offer monitoring from OSF and Cerner. Each letter says which of your details were involved, so keep it.
What Similar Cases Paid
Other hospitals’ tracking cases, for context: these do not predict anything for OSF. The BJC MyChart settlement paid $35, and SSM Health’s paid $31.50. In Illinois, the Southern Illinois Healthcare pixel settlement offered a one-time $17.50 cash payment. Per-person amounts in these cases are small. Try the MyChart settlement calculator for tracking cases or the data breach settlement calculator for breach losses.
OSF HealthCare Timeline
- 1
March 7 – April 23, 2021 — Ransomware Attack
An intruder is inside OSF’s network. OSF discovers the ransomware on April 23, 2021, and a forensic review later finds that records of 53,907 patients were taken.
- 2
October 1, 2021 — Patients Notified
OSF starts mailing notice letters and reports the breach to HHS. Three class actions follow in Peoria County.
- 3
December 15, 2022 — Claim Deadline Passes
The last day to file a claim in the class settlement. Credit monitoring codes went out on February 23, 2023, and payments were scheduled for March 2023.
- 4
November 30, 2023 — Welltok Vendor Breach Reported
Local news reports that the May 2023 MOVEit breach at Welltok may affect OSF patients. OSF said it had stopped sending data to Welltok.
- 5
December 2025 — Cerner Breach Letters
OSF patients start getting letters about the breach of Cerner’s legacy systems. They are offered two years of credit monitoring and identity restoration.
- 6
July 29, 2026 — HHS Settlement
HHS announces that OSF will pay $552,250 over its 2021 risk analysis and late notice, under a corrective action plan monitored for two years. As of October 6, 2026, we found no tracking lawsuit.
Three Things to Watch For
OSF is in the news because of a government fine, and that is easy to misrepresent:
“Claim your share of the $552,250”
The HHS money is a penalty paid to the government. No patient can claim any of it. A message saying otherwise is fishing for your information.
“Reopen your 2021 OSF settlement claim”
The KCC settlement closed for claims on December 15, 2022, and its website is offline. Anyone charging a fee to “reopen” or speed up that claim is not the administrator.
“OSF MyChart settlement” claim pages
No OSF MyChart tracking settlement exists, so a page asking for your MyChart login or Social Security number to file a claim is phishing. A real administrator never asks for your portal password.
OSF HealthCare Lawsuit — Questions People Actually Ask
Is there an OSF HealthCare MyChart lawsuit?
As of October 6, 2026, no. We found no lawsuit and no settlement claiming that OSF’s website or OSF MyChart shared patient data with Meta, Google or other trackers. Illinois state-court filings are not searchable online, so a brand-new case could exist without having been reported.
Why is OSF HealthCare in the news?
On July 29, 2026 the HHS Office for Civil Rights announced a $552,250 HIPAA settlement with OSF over the 2021 ransomware attack. HHS found that OSF lacked an accurate risk analysis and notified patients too late.
Can I still file a claim for the 2021 OSF HealthCare data breach?
No. The class settlement in Peoria County required claims by December 15, 2022, and payments were scheduled for March 2023. That claim window does not reopen.
Was OSF affected by the Oracle Health / Cerner breach?
Yes. Starting in December 2025, OSF notified patients that hackers had reached legacy Cerner systems as early as January 2025. As of July 2026, OSF HealthCare was listed among at least 17 affected health systems. The patient lawsuits are pending in federal court in Missouri, and we found no settlement.
What is the patient portal called?
OSF MyChart. You can reach it at osfmychart.org or through the MyChart mobile app.
Did OSF HealthCare have a data breach in 2026?
We found no OSF HealthCare data breach that happened in 2026. The 2026 news is the HHS settlement over the 2021 attack. The latest breach notices came in December 2025 and were about the Cerner vendor breach.
How did tracking cases against other hospitals turn out?
Several settled for small per-person payments: $35 at BJC, $31.50 at SSM Health, and $17.50 at Southern Illinois Healthcare. Our MyChart claim form page lists which ones are still open.
What should OSF patients do now?
If you got a Cerner or OSF breach letter, keep it and sign up for the free monitoring it offers. You can also freeze your credit for free at all three bureaus, and check your insurer’s statements for care you never received. If you want to be matched to a tracking case if one is ever filed, use the form on this page.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
MyChart Class Action Claim Form
Open and closed hospital tracking settlements, by health system
Oracle Health Data Breach Lawsuit
The legacy Cerner breach that reached OSF patients
MyChart Settlement Calculator
What past patient-portal tracking settlements paid per person
Data Breach Settlement Calculator
Estimate a breach payout from your documented losses