ProMantra Data Breach Lawsuit: A Ransomware Claim, Then a Federal Case
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
ProMantra is a New Jersey medical-billing company — if your records were there, it is because your doctor's office or hospital used it. On September 17, 2026 a ransomware group claimed it had hit ProMantra. Four days later a federal lawsuit, Shrader v. ProMantra, Inc., was filed in New Jersey. As of October 12, 2026 the company has not publicly confirmed a breach, no notice to a regulator has surfaced, and there is no settlement and no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Is Known About the ProMantra Data Breach
ProMantra describes itself as a revenue cycle management company: it submits insurance claims, chases denials and processes billing data for healthcare providers. Ransomware.live describes it as specializing in “Revenue Cycle Management (RCM), medical billing, healthcare data processing” and founded in 2003.
On September 17, 2026, the ransomware group Metaencryptor listed “Promantra, Inc” on its leak site. The estimated attack date given was the same day. The group threatened that “the full leak will be published soon” unless the company contacted it. One tracker, Breachsense, lists a claimed leak size of 40GB.
All of that is the attackers' claim. The listing names no data categories and no number of people. Analysts note that billing companies typically hold names, insurance details and billing records rather than full clinical charts — but which fields, if any, left ProMantra's systems is not public.
Case Details
Shrader v. ProMantra, Inc., No. 3:26-cv-12403, was filed in the U.S. District Court for the District of New Jersey on September 21, 2026. The docket shows a complaint and a summons issued the same day (public docket).
The complaint itself is not available on the free public docket, and the public index shows no assigned judge yet. Its filing four days after the ransomware listing points to the incident, but we could not read the pleading — so the claims and the proposed class definition are not confirmed here.
Status: One Lawsuit Filed, No Confirmed Breach, No Settlement
Separately, attorneys working with ClassAction.org announced an “investigation” on September 17, 2026, the day of the listing. An investigation is an advertisement for clients, not a lawsuit.
The missing piece is an official notice. We found no filing with the HHS breach portal or a state attorney general, so there is no confirmed count of affected people. Healthcare breach notices often arrive weeks or months after an attack.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Could My Data Be Involved?
Possibly, if a healthcare provider you used sends its billing to ProMantra. Attorneys investigating a possible suit (via ClassAction.org) are seeking current and former ProMantra employees and patients of its healthcare clients — but no one outside the company knows yet whose records were affected.
The practical test is a notice letter. Because ProMantra is a vendor, a letter may come from ProMantra or from your doctor's office. Keep it and the envelope: it states which fields were involved. No letter so far is not proof either way, since no notice has been reported at all.
Is There Any Money?
ProMantra Data Breach Timeline
- 1
September 17, 2026 — Ransomware Group Claims the Attack
Metaencryptor lists Promantra, Inc on its leak site and threatens to publish the data. Monitoring site Ransomware.live records it the same day.
- 2
September 17, 2026 — Investigation Announced
Attorneys working with ClassAction.org publish an “investigation” page seeking employees and patients. This is a recruitment notice, not a lawsuit.
- 3
September 18, 2026 — 40GB Claimed
Tracker Breachsense lists the incident with a claimed leak size of 40GB. The figure comes from the attackers and is unverified.
- 4
September 21, 2026 — Federal Lawsuit Filed
Shrader v. ProMantra, Inc., No. 3:26-cv-12403, is filed in the District of New Jersey; a summons issues the same day.
- 5
October 2026 — No Notice, No Settlement
As of October 12, 2026, no public company confirmation, no regulator filing and no affected-person count. The case is at its earliest stage.
Three Things to Watch For
An unconfirmed healthcare breach with a lawsuit and no notice letters is exactly the gap scammers use:
“Claim your ProMantra settlement” messages
There is no settlement and no claims site. Any page asking for your Social Security number or insurance ID to “secure a payment” is collecting data, not filing a claim.
Calls about your medical bill after the leak
If billing data was taken, criminals can name your provider and a real balance. Hang up and call the billing number printed on a statement you already have before paying anything.
“Pay to remove your data from the leak”
Ransomware groups and copycats sometimes contact individuals directly. Paying removes nothing — stolen data can be copied endlessly. Do not reply or pay.
ProMantra Data Breach — Questions People Actually Ask
Is there a ProMantra data breach lawsuit?
Yes. Shrader v. ProMantra, Inc., No. 3:26-cv-12403, was filed in the U.S. District Court for the District of New Jersey on September 21, 2026. The complaint is not on the free public docket, so its specific claims could not be reviewed.
Did ProMantra confirm a data breach?
Not publicly, as of October 12, 2026. What exists is a claim by the Metaencryptor ransomware group, posted September 17, 2026. A leak-site listing is the attackers' assertion, not proof that data was taken.
Who is ProMantra, and why would it have my information?
ProMantra is a New Jersey revenue cycle management company that handles medical billing and healthcare data processing for providers. If your doctor's office or hospital outsourced billing to it, your name and insurance details could pass through its systems without you ever dealing with ProMantra directly.
How many people were affected?
Unknown. No notice to the HHS breach portal or a state attorney general has been found, and the attackers' listing gives no number of people. The only figure in circulation is a claimed 40GB of data, which says nothing about how many records it holds.
What data was exposed?
Not confirmed. The listing names no categories. Analysts expect that any exposure at a billing vendor would center on billing records, insurance details and related administrative data rather than full medical histories; your notice letter, if one arrives, will state the actual fields.
Is there a settlement or claim form?
No. There is no settlement, fund, administrator, claim form or deadline. If that changes, class members are notified directly by a court-appointed administrator.
How much is a data breach lawsuit worth?
Nothing is payable in this case, and no court has put a value on it. Settled breach cases generally pay documented losses plus a small flat amount; our data breach settlement calculator shows ranges from resolved cases. Questions about other breaches, such as hospital cases, are separate matters with their own courts and deadlines.
What is worth doing right now?
Freeze your credit at all three bureaus — it is free and reversible. Read your insurer's explanation-of-benefits statements for care you never received. Keep any notice letter from ProMantra or your provider.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Data Breach Settlement Calculator
What comparable breach settlements have paid per person
CareCloud Data Breach Lawsuit
Another healthcare billing vendor breach and where it stands
Open Class Action Settlements
Settlements currently accepting claims, with deadlines
Settlement Payout Calculator
Estimate a per-person share once a fund exists