Westside GI Data Breach Lawsuit: An Unconfirmed Ransomware Claim
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
The Westside GI data breach in the news is a claim, not a confirmed incident. In late September 2026 a ransomware group calling itself PEAR listed Westside GI Center, a Manhattan endoscopy center, on its leak site and says it took 216 GB of patient and staff data. As of mid-October 2026 the center has posted no notice, no regulator listing names it, and we found no data-breach lawsuit in federal court. There is no settlement and no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Is Being Claimed
Westside GI Center is an ambulatory endoscopy center operated by West Side GI, LLC in Manhattan. Patients come there for colonoscopies and other GI procedures, so its records would combine identity details with procedure and insurance information.
On September 22, 2026 the ransomware group PEAR dated a post naming the center on its leak site. Tracker ransomware.live picked it up on September 24, 2026, and Breachsense logged it on September 25, 2026 with a claimed leak size of 216 GB. According to one investigation notice, the group says the files include patient and staff personal information, patient health records and internal company information.
These are the attackers’ own claims. The tracker that recorded them states it cannot confirm them, and as of mid-October 2026 Westside GI Center has not confirmed a breach, said how many people are involved, or listed which data fields were taken.
Case Details
No Westside GI data breach lawsuit has been confirmed. A CourtListener search of federal dockets for “West Side GI” returns 46 results and none is a data-breach case, and our federal case database shows no filing under the name. Several plaintiff firms opened “investigations” on September 25, 2026 — that is client recruitment, not a lawsuit.
Two things that are easy to mix up:
Shuler v. West Side GI, LLC. A case-listing site shows a New York matter under this title. We could not open the record, so its court, date and subject are unverified — it may or may not concern the breach.
Kairam v. West Side GI, LLC. Federal suits in the Southern District of New York, No. 1:18-cv-01005 and No. 1:19-cv-00953, assigned to Judge Analisa Torres, concern a physician’s membership agreement with the company. They are an internal business dispute, not a patient data case.
Status: Unconfirmed Breach, No Settlement
What would change that is a notice. Under HIPAA, a medical provider that confirms a breach must notify each affected patient without unreasonable delay and no later than 60 calendar days after discovery. If 500 or more people are involved, it must report to HHS at the same time, and HHS publishes those reports. Lawsuits usually follow the letters, not the leak-site post.
Am I Affected?
Nobody can tell you yet — including the law firms advertising about it. The group claims patient and staff data, so if it is real, both former patients and employees could be involved. No list of affected people has been published.
The practical test is your mail. HIPAA notices go by first-class mail to your last known address (or by email if you agreed to that). If Westside GI Center lacks current contact details for 10 or more people, it must post a substitute notice on its website for 90 days or run notice in major media. Keep any letter you receive: it says which of your data fields were involved and is your proof of membership in any later class.
Is There Money? Not Yet
If a breach is confirmed and a case is later filed and settled, patient-data settlements are typically structured around reimbursement of documented losses plus a smaller flat payment. Our data breach settlement calculator shows how such funds split per person — useful only once a real fund exists.
Westside GI Breach Claim Timeline
- 1
September 22, 2026 — Leak-Site Post
The ransomware group PEAR dates a post naming Westside GI Center on its leak site. A tracker summary says the attack reportedly disrupted clinical services and system access.
- 2
September 24, 2026 — Trackers Pick It Up
Ransomware.live records the listing. The tracker says it cannot confirm the group’s claims.
- 3
September 25, 2026 — 216 GB Claimed, Firms Advertise
Breachsense logs a claimed 216 GB leak. Plaintiff firms post investigation pages the same day; none reports a filed suit.
- 4
Within 60 Days of Discovery — HIPAA Notice Clock
If the center confirms a breach, it must mail affected patients no later than 60 calendar days after discovery, and report to HHS at the same time if 500 or more people are involved.
- 5
October 2026 — Still Unconfirmed
No notice on the center’s website, no confirmed count, no confirmed federal breach lawsuit, no settlement and no claim form.
Three Things to Watch For
An unconfirmed breach with stolen patient files and heavy law-firm advertising is a gift to imposters:
Extortion emails quoting your procedure
Ransomware groups and copycats sometimes contact patients directly, threatening to publish medical details unless paid. Do not pay or reply. Report it to the FBI’s IC3 and keep the message.
“Westside GI settlement” claim pages
There is no settlement and no claims portal. A site asking for your Social Security number or insurance ID to “check eligibility” is collecting data, not filing a claim.
Fake breach notices with a call-back number
A genuine HIPAA notice comes by first-class mail and names the center. Verify any letter or call by phoning the number on Westside GI Center’s own website, not the one in the message.
Westside GI Data Breach — Questions People Actually Ask
Was Westside GI actually hacked?
Unconfirmed. The ransomware group PEAR claims it was, and says it holds 216 GB of data. As of October 2026 Westside GI Center has not confirmed a breach, and the trackers that report the claim say they cannot verify it.
Is there a Westside GI data breach lawsuit?
Not one we could confirm. A federal docket search for “West Side GI” shows no data-breach case, only older business disputes. A New York matter titled Shuler v. West Side GI, LLC appears on a listing site, but its subject is unverified. Law firms are “investigating,” which is not the same as suing.
How do I know if I was a part of a data breach?
For a medical provider, by letter. HIPAA requires notice by first-class mail to your last known address within 60 calendar days of discovery. Breaches of 500 or more people are also reported to HHS, which publishes them. No Westside GI notice had been posted as of October 2026.
What data was taken?
Officially, nobody has said. According to the attackers, the files include patient and staff personal information, patient health records and internal company information. Treat that as a claim until a notice lists your specific fields.
Is the data breach settlement legit?
There is no Westside GI settlement, so anything presented as one is not legitimate. Real settlements are approved by a court and run by a named administrator, and they never charge a fee to file.
How much compensation will I get for a data breach?
For Westside GI, nothing at this point: no lawsuit, no settlement, no fund. Payment only becomes possible if a breach is confirmed, a case is filed and it settles — a process that typically takes years.
Is this the same as the Westside Family Healthcare breach?
No. Some sites list a 2021 Delaware Attorney General filing for “Westside.” That filing was made by CaptureRx on behalf of Westside Family Healthcare, Inc., covering 130 Delaware residents — a different organization and a different incident.
What is worth doing right now?
If you were a patient or employee, freeze your credit at Equifax, Experian and TransUnion — it is free and lasts until you lift it. Read your insurer’s explanation-of-benefits statements for procedures you never had, and keep any letter from the center.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Data Breach Settlement Calculator
Rough per-person estimates once a breach case actually settles
Open Class Action Settlements
Settlements taking claims now, with deadlines
Settlement Payout Calculator
How a fund is split among class members who file
Essen Medical Data Breach Settlement
Another New York medical provider breach case