The ALN Medical Management lawsuit is a consolidated class action in federal court in Nebraska over a March 2024 data breach that exposed the personal and medical information of more than 1.8 million people. It ended in a $4 million settlement that a federal judge granted final approval on May 20, 2026. The deadlines to file a claim, opt out, or object have all passed, and payments to class members are on hold pending any appeals.
What Happened in the Breach
Between March 18 and March 24, 2024, an unauthorized actor accessed files stored in a third-party IT environment managed by Long View Systems Corporation on behalf of ALN, a Nebraska-based company that handles billing and revenue cycle services for healthcare providers.1HIPAA Journal. ALN Medical Management Data Breach
The compromised data included names, Social Security numbers, driver’s license and government-issued ID numbers, financial account information, medical information, and health insurance details.1HIPAA Journal. ALN Medical Management Data Breach Because ALN processes billing for healthcare providers across the country, patients of multiple practices were affected, including National Spine and Pain in Maryland, Hoag Clinic in California, and Allied Physicians Group in New York.2HIPAA Times. ALN Medical Breach Exposes Data of Over 1.8 Million Patients
ALN began mailing notification letters on March 21, 2025, nearly a year after the intrusion, and offered 12 to 24 months of complimentary credit monitoring through IDX.3New Hampshire Department of Justice. ALN Medical Management Breach Notification The final count of affected individuals on the HHS breach portal reached 1,823,844.2HIPAA Times. ALN Medical Breach Exposes Data of Over 1.8 Million Patients
The Consolidated Class Action
The first putative class action was filed on March 25, 2025, days after notification letters went out. Multiple suits followed, and on June 11, 2025, the U.S. District Court for the District of Nebraska consolidated them into In Re: ALN Medical Management LLC Data Incident Litigation, Case No. 4:25-cv-03067, before Judge Susan M. Bazis.4CourtListener. In Re ALN Medical Management LLC Data Incident Litigation The consolidated amended complaint, filed June 25, 2025, named both ALN and Long View Systems as defendants.5ClassAction.org. In Re ALN Medical Management LLC Data Incident Litigation Settlement
The plaintiffs brought claims for negligence, breach of implied contract, breach of third-party beneficiary contract, unjust enrichment, and violations of the California Consumer Privacy Act. They alleged ALN and Long View failed to implement reasonable security measures and sought damages, reimbursement of out-of-pocket costs, and court orders requiring better data security.1HIPAA Journal. ALN Medical Management Data Breach ALN denied all allegations of fault and liability as part of the settlement.5ClassAction.org. In Re ALN Medical Management LLC Data Incident Litigation Settlement
What the $4 Million Settlement Offered
On August 4, 2025, ALN and the plaintiffs reached a $4 million non-reversionary settlement, meaning unclaimed money does not go back to ALN.5ClassAction.org. In Re ALN Medical Management LLC Data Incident Litigation Settlement The court granted preliminary approval on December 5, 2025.6Justia. Preliminary Approval Order The settlement class covered all living U.S. residents who received a breach notification from ALN about the March 2024 incident.7ALN Settlement. Frequently Asked Questions
Class members had three claim options:
- Reimbursement of up to $5,000 for documented out-of-pocket losses tied to the breach, supported by receipts, bank statements, or similar proof. A personal declaration alone was not enough.8ClassAction.org. Class Notice
- An alternate cash payment estimated at $50 for class members without documented losses, subject to adjustment based on claim volume.9ALN Settlement. ALN Settlement Homepage
- One year of CyEx Medical Shield Complete, which includes three-bureau credit monitoring, healthcare fraud monitoring for insurance IDs and medical records, dark web scanning, and $1 million in identity theft insurance.10CyEx. Medical Shield
ALN also agreed to pay for cybersecurity improvements separately from the $4 million fund.11ClassAction.org. Settlement Agreement Court-approved deductions from the fund included one-third for attorneys’ fees ($1,333,333.33), $29,082.06 in litigation costs, $2,500 service awards for each of the eight named plaintiffs, and roughly $807,995 in administration costs with an estimated $140,482 more expected.12Justia. Final Approval Order
Where the Case Stands Now
The judge granted final approval on May 20, 2026, finding the settlement “fair, reasonable and adequate.”13Mealeys. Federal Judge Approves $4M Class Action Settlement The claim deadline was April 3, 2026, and the deadline to opt out or object was April 15, 2026. Both have passed, and payments to class members are contingent on the resolution of any appeals.7ALN Settlement. Frequently Asked Questions
The HHS Office for Civil Rights, which oversees HIPAA enforcement, has closed its investigation into the breach. No enforcement action by the FTC or any state attorney general has been publicly reported.1HIPAA Journal. ALN Medical Management Data Breach
The Long View Systems Claims Are Still Pending
The settlement resolved claims against ALN and several of its healthcare-provider clients, including National Spine and Pain Centers and Hoag Clinic. It did not resolve claims against Long View Systems, the IT company that hosted the compromised environment. That part of the litigation remains pending in the same federal court.9ALN Settlement. ALN Settlement Homepage4CourtListener. In Re ALN Medical Management LLC Data Incident Litigation