TLC Perinatal Data Breach: A Hacker Claim, No Lawsuit Yet
Reference Guide
TLC Perinatal PA is a maternal-fetal medicine practice in Silver Spring and Germantown, Maryland. On October 1, 2026 a ransomware group called Genesis listed it as a victim and claimed about 500GB of data. As of October 15, 2026 the practice has not confirmed a breach, no affected-patient count has been published, and no TLC Perinatal data breach lawsuit has been filed. There is no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Has Actually Been Reported
Everything known so far comes from the attackers' side. Dark-web tracker Ransomware.live recorded the Genesis listing for tlcperinatal.com on October 1, 2026, with an estimated attack date of September 30, 2026. Breachsense, another tracker, logged the same claim on October 2, 2026 with a claimed leak size of 500GB.
These are the group's claims, not findings. No one outside the group has said what the files contain or how many people they cover. Because the practice provides routine and high-risk pregnancy care, patient records are the obvious concern — but which fields, if any, were taken is not public.
TLC Perinatal's own website showed no breach or security-incident notice when we checked on October 15, 2026.
Case details
No lawsuit has been filed that we can find. As of October 15, 2026, our search of federal court filings shows no case naming TLC Perinatal, and news searches turn up none. What exists is an attorney investigation: a lawyer-advertising site published a call for current and former patients and staff on October 2, 2026, asking whether a class action can be filed. That is a recruitment step, not a case. Maryland state-court filings were not checked and could change this answer.
Status: Unconfirmed Claim, No Case, No Settlement
Two legal clocks matter. Under HIPAA, a medical practice must notify affected patients no later than 60 calendar days after it discovers a breach, and report breaches of 500 or more people to HHS at the same time. Maryland law requires notice to individuals within 45 days of discovery, and the Maryland Attorney General must be notified first. If the practice confirms a breach, a letter and a public filing are where real numbers will first appear.
Could You Be Affected?
If the claim is real, the people at risk are patients of TLC Perinatal — and possibly staff, since the attorney investigation is also looking for current and former employees. Nobody has published a list of affected people, and there is no class to join.
The practical test is your mail. A confirmed breach of patient records triggers individual notice letters under HIPAA. If you receive one, keep the letter and envelope: it says which of your fields were involved and is your best proof of membership if a case is later filed. Not having a letter yet proves nothing either way.
Is There Money? Not Now
For context only, not a prediction: a nearby comparison in search results is Capital Health, a New Jersey hospital system that agreed to pay $4.5 million over a ransomware attack. Its class members could claim up to $5,000 in documented losses or an estimated $100 cash payment, plus three years of credit monitoring. That claim deadline was April 6, 2026. It is a different case, and outcomes for small practices vary widely.
TLC Perinatal Breach Timeline
September 30, 2026 — Estimated Attack Date
Ransomware.live estimates the attack on tlcperinatal.com occurred on this date. This is a tracker estimate, not a confirmed finding.
October 1, 2026 — Genesis Lists the Practice
The ransomware group Genesis posts TLC Perinatal on its leak site; Ransomware.live records the listing.
October 2, 2026 — 500GB Claimed
Breachsense logs the claim with a stated leak size of 500GB. Contents and affected count are not disclosed.
October 2, 2026 — Attorney Investigation Announced
A lawyer-advertising site asks patients and staff to come forward to see whether a class action can be filed. No suit is filed.
October 15, 2026 — No Notice, No Lawsuit
The practice website shows no breach notice, and no lawsuit naming TLC Perinatal turns up in federal filings we checked.
Next — Watch for Notice Letters
If a breach is confirmed, HIPAA requires patient notice within 60 calendar days of discovery and Maryland within 45 days.
Three Things to Watch For
An unconfirmed breach of pregnancy-care records, with no official notice yet, leaves room for imposters:
“Your TLC Perinatal records are online” messages
Extortion crews sometimes contact patients directly after a leak claim, threatening to publish medical details unless paid. Do not pay or reply; report it to the FBI's IC3 and to the practice.
Calls posing as the practice or its billing office
A caller who knows you were a patient can sound legitimate. Hang up and call the Silver Spring or Germantown office using the number on the practice's own website before confirming anything.
“Claim your TLC Perinatal settlement” pages
There is no settlement and no claims site. A form asking for your Social Security number or insurance ID to “register” is collecting data, not filing a claim.
TLC Perinatal Data Breach — Questions People Ask
Short answers to the questions people ask most about this case.
Is there a TLC Perinatal data breach lawsuit?
Not as of October 15, 2026. Attorneys announced an investigation on October 2, 2026, but no complaint naming TLC Perinatal appears in the federal filings we checked. If one is filed, this page will list the court and case number.
Did TLC Perinatal confirm a breach?
No. The only reports come from dark-web trackers recording a claim by the ransomware group Genesis on October 1, 2026. The practice's website carried no notice when we checked on October 15, 2026.
What data was taken, and how many people are affected?
Unknown. The group claims about 500GB but has not been verified, and no affected-patient count has been filed with HHS or the Maryland Attorney General that we could find. HHS reporting is required at the time of patient notice for breaches of 500 or more people.
How can I check if I have been data breached?
For this incident, watch for a notice letter from TLC Perinatal; HIPAA requires one within 60 calendar days of discovery if your records were involved. Larger healthcare breaches also appear on the HHS Office for Civil Rights breach portal. Notification letters and that portal are the reliable checks; a stranger's email is not.
How much do you usually get from a data breach settlement?
There is nothing to collect here yet. As one example, the Capital Health hospital settlement offered up to $5,000 for documented losses or an estimated $100 cash payment. Actual amounts depend on the fund size and how many people file. Our data breach settlement calculator shows how those factors interact.
Is the Capital Health settlement about TLC Perinatal?
No. Capital Health is a New Jersey hospital system; its $4.5 million settlement, Graycar v. Capital Health Systems in the District of New Jersey, covers a separate ransomware attack, and its claim deadline was April 6, 2026. It has nothing to do with TLC Perinatal patients.
Is this connected to the Aesto Health breach?
Nothing we found links them. Aesto Health is a separate healthcare vendor incident with its own litigation; see our Aesto Health data breach lawsuit page.
What is worth doing right now?
Freeze your credit with Equifax, Experian and TransUnion — the FTC notes it is free to place and lift. An initial fraud alert is also free and lasts one year. Read insurer explanation-of-benefits statements for care you never received, and keep any letter you get from the practice.
About This Information
- Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated
- $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Consequences of a Data BreachWhat exposed medical and identity data can lead to
- Data Breach Settlement CalculatorEstimate what a healthcare breach claim might pay
- Open Class Action SettlementsSettlements currently accepting claims, with deadlines
- Settlement Payout CalculatorHow claim rates change individual payments