MNGI Digestive Health $2.84M Data Breach Settlement

The MNGI Digestive Health data breach settlement is a $2,838,749.62 class action fund resolving claims tied to the August 2023 ransomware attack that exposed the personal and medical information of roughly 766,000 patients. Eligible class members could choose reimbursement of up to $10,000 for documented out-of-pocket losses, two years of medical monitoring, or a pro rata cash payment from what remained in the fund. Payments to valid claimants were scheduled to begin May 11, 2026.¹

Who Qualified for a Payment

The class covered every person in the United States who received a formal breach notice from MNGI about the August 20, 2023 incident. Residency did not matter. Excluded were MNGI’s officers and directors, the judge and court staff, anyone who validly opted out by August 5, 2025, and any person found criminally responsible for the breach.¹

The claim deadline was September 4, 2025. Class members who did not file by that date are not eligible for a payment from the fund.¹

What the Settlement Pays

Claimants had to choose among three forms of relief.

Reimbursement of Documented Losses, Up to $10,000

Class members could claim up to $10,000 each for unreimbursed, documented losses traceable to the breach. Qualifying costs included expenses from identity theft or tax fraud, credit freeze fees, and smaller charges like postage and notary fees. Lost wages from unpaid time off spent dealing with breach-related problems also qualified.²

Two Years of Medical Monitoring

Class members could instead elect two years of medical and healthcare monitoring through CyEx, aimed at catching potential medical fraud tied to exposed health information. This is separate from, and longer than, the 12 months of credit and identity protection MNGI offered directly after the breach.²³

A Pro Rata Cash Payment

Class members without documentation could file for a pro rata cash share. Those payments come from whatever remains in the $2.84 million fund after attorneys’ fees, administrative costs, service awards, and documented-loss reimbursements are paid out. The exact per-person amount depends on how many valid claims are approved.⁴

What Was Exposed in the Breach

An unauthorized party accessed MNGI’s network on August 20, 2023, and MNGI discovered the intrusion five days later. The ALPHV/BlackCat ransomware group claimed responsibility, though MNGI did not confirm the attacker’s identity in its own notices.⁵

The information potentially accessed was broad: names, dates of birth, Social Security numbers, driver’s license and state ID numbers, passport numbers, medical records, health insurance details, payment card and financial account information, biometric data, taxpayer identification numbers, patient account numbers, and login credentials.³ MNGI reported the breach affected 765,937 individuals to the Maine Attorney General’s Office.⁶

MNGI did not complete its investigation into which records were affected until June 7, 2024, and began mailing notices on July 15, 2024. The company stated it had found no evidence that the compromised data had actually been misused.³⁵

Plaintiffs alleged MNGI failed to implement reasonable cybersecurity measures and that the breach was preventable. MNGI denied all liability and entered the settlement to avoid the cost and uncertainty of continued litigation, not as an admission of fault.⁷⁴

When Payments Are Being Made

The case, In re MNGI Digestive Health, P.A., Case No. 27-CV-24-10788, was litigated in Hennepin County District Court. Judge Nelson Peralta granted final approval on October 15, 2025. One class member appealed, but the appeal was dismissed by court order.⁸

The court approved a stipulation on March 27, 2026 clearing the way for disbursement. Epiq Class Action and Claims Solutions is administering claims and calculating awards, with payments to valid claimants set to begin May 11, 2026.¹²

1
MNGI Settlement Website. MNGI Data Incident Litigation Settlement
2
ClassAction.org. Austin et al. v. MNGI Digestive Health, P.A. Settlement Agreement
3
MNGI Digestive Health. Data Security Incident Notice
4
MNGI Settlement Website. Frequently Asked Questions
5
SecurityWeek. MNGI Digestive Health Data Breach Impacts 765,000 Individuals
6
Maine Attorney General. MNGI Digestive Health Data Breach Notification
7
HIPAA Journal. MNGI Digestive Health Data Breach Settlement
8
MNGI Settlement Website. Case Documents