Copyright Newsweek
Yale New Haven Health reached an $18 million settlement over a data breach that impacted over five million people earlier this year. A Connecticut judge granted preliminary approval last week for the settlement over the data breach that occurred in March 2025. Why It Matters This was one of the largest data breaches so far this year, affecting 5,556,720 individuals. Health system data breaches expose personal, financial and medical records of patients and may leave them vulnerable to identity theft and fraud at the hands of bad actors. There are also time and financial burdens on victims to mitigate the risk with credit and fraud monitoring services to detect, prevent or recover assets in the face of fraud. Yale New Haven Health is one of the leading health systems in Connecticut and is the second-largest employer in the state, with more than 31,000 employees. It includes five acute-care hospitals with over 100 medical specialties and is affiliated with Yale University and Yale School of Medicine. What To Know In September, the parties informed the federal judge that they had reached a settlement of $18 million to provide monetary damages, as well as “injunctive relief” in the form of meaningful data security measures. The terms of the settlement would cover legal fees, administrative costs and would provide up to $5,000 in reimbursements for class members for documented losses caused by the data breach. Alternatively, there is a $100 pro-rate cash payout. Class members may also claim two years of medical data monitoring. Yale New Haven Health maintains that the claims in this lawsuit lack merit and denies all liability or wrongdoing. The health system said it entered the settlement agreement to “avoid the further expense, inconvenience and distraction of burdensome and protracted litigation” and to be “completely free of any further claims that were asserted or could possibly have been asserted in the action,” according to the settlement document. On April 11, Yale New Haven Health sent a notice to inform patients of a data breach that occurred on March 8. An investigation found that an unauthorized third party gained access to the health system's network and obtained patients’ personal data. The health system said its electronic medical record system was not breached. This data included names, dates of birth, addresses, telephone numbers, email addresses, race or ethnicity information, Social Security numbers and medical record numbers. “We take our responsibility to safeguard patient information incredibly seriously, and we regret any concern this incident may have caused,” Yale New Haven Health said in a statement at the time. A class action lawsuit was filed on April 16 alleging that the health system’s failure to protect patient data exposed them to “hackers with nefarious intentions” and “will harm affected individuals, including by invasion of their private health and financial matters.” The complaint accused the health system of negligence and/or careless acts and omissions in its “utter failure to protect its patients’ sensitive data,” adding that Yale New Haven didn’t encrypt or redact this highly sensitive information. This was the first of several separate lawsuits that were eventually consolidated into one case in the U.S. District Court of Connecticut. What Happens Next The final approval hearing for the settlement will be on March 3, 2026, at the federal courthouse in Bridgeport, Connecticut. At that hearing, a judge will determine whether the final settlement should be approved and will issue a final judgment on the case. In the settlement approval notice, the judge said he will also address “any other matters I deem necessary and appropriate" at the hearing. Plaintiffs who want to opt out of the settlement must do so 60 days after the notice date, by December 20, 2025. The deadline to file a claim for the settlement is 90 days after the notice, on January 19, 2026. Newsweek reached out to Yale New Haven Health for comment.
