There is no Jackson Hospital data breach settlement to claim as of mid-2026. No lawsuit has been filed on behalf of patients of Jackson Hospital and Clinic in Montgomery, Alabama, and no settlement fund exists for the roughly 14,000 people whose information was exposed through the hospital’s former debt collection vendor. One law firm has announced an investigation, and the hospital is offering free credit monitoring to those affected.
What Happened
The breach did not occur on Jackson Hospital’s own systems. An unauthorized actor accessed the network of Nationwide Recovery Services, a debt collector that had previously handled accounts for the hospital, between July 5 and July 15, 2024.1Jackson Health System. Notice of Nationwide Recovery Services Incident Nationwide Recovery Services detected the activity that same month but did not notify Jackson Hospital until January 27, 2026, about 18 months later.2HIPAA Journal. Alabama Hospital 2024 Data Breach
Jackson Hospital began mailing notices on February 27, 2026. A federal breach report filed with the U.S. Department of Health and Human Services listed 13,910 affected individuals;3The Record Herald. Jackson Hospital and Clinic Data Breach Record a separate tally by HIPAA Journal put the figure at 14,485.2HIPAA Journal. Alabama Hospital 2024 Data Breach
What Information Was Exposed
The compromised data included patient names combined with one or more of the following: Social Security numbers, phone numbers, addresses, dates of birth, account information, health insurance details, and dates of service.1Jackson Health System. Notice of Nationwide Recovery Services Incident Social Security numbers paired with medical and financial account data carry a heightened risk of identity theft and insurance fraud.
What Jackson Hospital Is Offering Now
Affected patients are being offered complimentary credit monitoring and identity protection through Experian IdentityWorks.1Jackson Health System. Notice of Nationwide Recovery Services Incident Enrollment instructions are included in the notification letter mailed by the hospital.
Jackson Hospital also set up a dedicated call center at 833-918-7884, open Monday through Friday from 8:00 a.m. to 8:00 p.m. Central time, for people who received a letter.1Jackson Health System. Notice of Nationwide Recovery Services Incident The notice also gave instructions for placing fraud alerts and security freezes with Equifax, Experian, and TransUnion.
Is a Lawsuit Being Pursued?
The law firm Federman & Sherwood announced in March 2026 that it was investigating the Jackson Hospital breach to determine whether “appropriate oversight and vendor security measures were in place” and whether affected patients have viable claims.4Federman & Sherwood. Jackson Hospital and Clinic Data Breach Investigated by Federman Sherwood That investigation had not resulted in a filed complaint as of the most recent available information.
Related litigation does exist against the vendor. In April 2025, a plaintiff named Gary Self filed a class action in federal court against Nationwide Recovery Services along with Hamilton Health Care System and Vitruvian Health, two other healthcare organizations hit by the same vendor intrusion. The suit accused the defendants of failing to secure patient information and failing to notify victims in a timely manner.5WRCB. Update: Hamilton Co. Offering Identity Theft Protection Services After April Data Breach Jackson Hospital was not named as a defendant, and Jackson patients are not covered by that case.
The Nationwide Recovery Services intrusion affected more than 560,000 people across at least 20 healthcare and government organizations, so additional lawsuits tied to the vendor may follow.6HIPAA Journal. Nationwide Recovery Service Data Breach Any settlement covering Jackson Hospital patients would depend on a case first being filed on their behalf.
Steps to Take While the Situation Develops
If you received a notification letter from Jackson Hospital:
- Enroll in the Experian IdentityWorks monitoring described in your letter.
- Consider placing a fraud alert or security freeze with Equifax, Experian, and TransUnion, using the instructions in the hospital’s notice.
- Keep the letter. If a lawsuit is later filed and a settlement is reached, proof that you received notice is typically what establishes class membership.
- Watch for suspicious medical bills, insurance statements for services you did not receive, and unfamiliar accounts on your credit report.
A Note on the Name
Jackson Hospital and Clinic in Montgomery, Alabama, is not the same facility as the Jackson County Hospital District in Marianna, Florida, which detected a ransomware attack on January 9, 2022.7WJHG. Jackson Hospital Fends Off Ransomware Attack That earlier incident is unrelated to the Nationwide Recovery Services breach and produced no lawsuit or settlement.