The Yale New Haven Health data breach settlement is an $18 million class action resolution that received final court approval on March 3, 2026, covering roughly 5.6 million patients whose personal and medical information was stolen in a March 2025 cyberattack. Eligible class members could claim up to $5,000 for documented losses or an estimated $100 without documentation, plus two years of free medical data monitoring. Payments began going out on May 27, 2026, and the claim filing period is now closed.1YaleNewHavenSettlement.com. Yale New Haven Settlement Home
What Patients Could Claim
The $18 million fund covered class member payments along with attorneys’ fees, $2,500 service awards for the two named plaintiffs, and administration costs.2HIPAA Journal. Yale New Haven Health System Data Breach Eligible class members could choose from three benefits:
- Reimbursement of up to $5,000 for documented out-of-pocket expenses tied to the breach, including identity theft losses, credit freeze fees, and related costs. Claimants had to submit receipts, correspondence, or other supporting documentation.
- An estimated $100 alternate cash payment for class members without documented losses. The final amount was subject to adjustment based on how many valid claims were filed against the remaining fund.
- Two years of free medical data monitoring, available in addition to either cash option.3YaleNewHavenSettlement.com. Frequently Asked Questions
Class members who chose electronic payment received funds through PayPal, Venmo, or Zelle. Paper checks were mailed within several days of the May 27, 2026 disbursement date. Medical monitoring activation codes went out by email or mail.1YaleNewHavenSettlement.com. Yale New Haven Settlement Home
Yale New Haven Health also agreed, separately from the fund, to implement security enhancements at its own cost. The specific technical measures were not publicly detailed in the settlement documents.4ClassAction.org. In Re Yale New Haven Health Services Corp. Settlement Agreement
Who Was Eligible
The class included all living individuals residing in the United States who received a notice from Yale New Haven Health stating that their personal information may have been compromised in the March 8, 2025 breach. Notification letters began going out on April 14, 2025.5Yale New Haven Health System. Legal Notices
Excluded from the class were officers and directors of Yale New Haven Health, government entities, the presiding judge and court staff, and anyone found guilty of participating in the cyberattack.6ClassAction.org. In Re Yale New Haven Health Services Corp. Notice
Key Deadlines and Payment Dates
The important dates in the case:
- January 20, 2026: deadline to object or opt out.
- February 18, 2026: deadline to file a claim.
- March 3, 2026: final approval hearing and order by Judge Stefan R. Underhill in the U.S. District Court for the District of Connecticut.3YaleNewHavenSettlement.com. Frequently Asked Questions
- May 27, 2026: payments began.1YaleNewHavenSettlement.com. Yale New Haven Settlement Home
Epiq served as the settlement administrator. The publicly available records show no notable objections and no appeals. As of mid-2026, all claims have been processed.1YaleNewHavenSettlement.com. Yale New Haven Settlement Home
What the Breach Involved
Yale New Haven Health detected unusual activity on its IT systems on March 8, 2025. An investigation determined that an unauthorized third party had accessed the network and copied patient data that same day. The exposed information included names, addresses, dates of birth, phone numbers, email addresses, race or ethnicity, Social Security numbers, patient types, and medical record numbers.3YaleNewHavenSettlement.com. Frequently Asked Questions
The health system reported that the breach did not reach its electronic health record system and that financial account details and employee HR data were not affected. Patient care and the patient portal continued to operate normally.7Healthcare Dive. Yale New Haven Health Data Breach Affects 5.6 Million The incident was reported to the U.S. Department of Health and Human Services Office for Civil Rights on April 11, 2025, listing up to 5,556,702 individuals as potentially affected. Yale New Haven Health also offered complimentary credit monitoring and identity protection to individuals whose Social Security numbers were involved.2HIPAA Journal. Yale New Haven Health System Data Breach
Plaintiffs alleged negligence, breach of implied contract, unjust enrichment, and breach of fiduciary duty. Yale New Haven Health denied all allegations of wrongdoing, and the parties reached settlement through mediation in August 2025.8Connecticut Law Tribune. Federal Judge Approves $18M Yale New Haven Health Data Breach Settlement
Regulatory Status
Yale New Haven Health reported the incident to law enforcement and to the HHS Office for Civil Rights. Affected individuals were advised they could also contact the Federal Trade Commission or their state attorney general if they believed their information had been misused.9Massachusetts Attorney General’s Office. Yale New Haven Health System Data Breach Notification No publicly reported HIPAA enforcement action or separate government investigation against Yale New Haven Health has emerged as of 2026.