Yale New Haven Health settles class action over massive data breach

Update:

• Yale New Haven Health has agreed to settle class action claims over a March 2025 data breach that may have compromised the personal and health information of 5.6 million individuals.
• Yale New Haven Health and 19 plaintiffs informed a Connecticut federal court that they had reached an agreement on the material terms of a classwide settlement and requested a stay of proceedings while they finalize the deal.
• The data breach stemmed from a ransomware attack that occurred in early March and prompted multiple federal lawsuits, which were later consolidated into a proposed class action.
• The Yale New Haven Health class action accused the hospital system of negligence, breach of fiduciary duty and failure to adequately protect sensitive patient data.
• Plaintiffs are expected to file a motion for preliminary approval of the settlement within 30 days.

Yale New Haven Health data breach overview:

• Who: Yale New Haven Health is notifying over 5.5 million patients of a data breach.
• Why: The breach involved unauthorized access to patient data, including Social Security numbers and other personal information.
• Where: The breach affects patients in Connecticut, New York and Rhode Island.

Yale New Haven Health has reported a significant data breach impacting more than 5.5 million individuals. 

The data breach, one of the largest in the healthcare sector this year, involved unauthorized access to sensitive patient information. 

Yale New Haven Health, affiliated with Yale University and the Yale School of Medicine, operates several hospitals and clinics across Connecticut, New York and Rhode Island.

The breach was detected on March 8, 2025, when an unusual activity was noticed within the organization’s IT systems. Yale New Haven Health quickly engaged Mandiant, a leading cybersecurity firm, to investigate and contain the incident. 

The breach was publicly announced three days later. According to the reports, the attackers accessed and exfiltrated patient data files. Electronic medical records and financial information were not compromised.

“Due to our team’s quick action to identify and help to contain this incident, it has not affected our ability to provide patient care,” the organization stated. 

Yale New Haven Health further assured that “YNHHS’ electronic medical record and treatment information were not involved or accessed, and no financial account or payment information was involved in this incident.”

Patient data compromised in the breach varied, potentially including names, addresses, telephone numbers, email addresses, dates of birth, race or ethnicity, patient types, medical record numbers and Social Security numbers. 

Yale New Haven Health began notifying affected individuals on April 14 and has offered complimentary credit monitoring and identity theft protection services to those whose Social Security numbers were compromised.

Swift response mitigates impact of Yale data breach

Yale New Haven Health’s swift response to the breach has been notable. The organization promptly engaged cybersecurity experts and notified federal authorities to ensure the incident was contained.

“Our patient portal and electronic medical records are running as normal, and our teams are working hard to manage the impact of phone and internet connection issues on patient care,” the organization assured.

The healthcare provider has emphasized its commitment to data security, stating that it continuously updates and enhances its systems to protect sensitive information. 

Despite the breach, Yale New Haven Health has maintained transparency and has been commended for its prompt notification process, which began shortly after the breach was detected.

For those seeking more information about the breach, Yale New Haven Health has provided details on its website and through direct communication with affected individuals. Patients can also contact the organization directly for further assistance.

Yale New Haven Health says it has not received any reports of identity theft or fraud related to the breach so far. The company is not currently facing legal action over the data breach, but Top Class Actions follows data breaches closely as they may sometimes lead to a class action lawsuit.

Are you affected by the Yale New Haven Health data breach? Let us know in the comments.

Read About More Class Action Lawsuits & Class Action Settlements:

• Nationwide recall of ice cream, frozen yogurt issued due to plastic contamination
• Planned Parenthood data breach exposed 1.6M patients’ info, class actions claim
• Ford class action alleges Escape, Lincoln Corsair hybrids have fire risk
• MathWorks class action alleges company secretly monitors website chat conversations