Capital Health Settles $4.5M Lawsuit Over 2023 Data Breach

Got story updates? Submit your updates here. ›

Capital Health has agreed to pay $4.5 million to settle a class action lawsuit stemming from a 2023 ransomware attack that exposed the personal and medical data of over 500,000 patients. The settlement includes cash payments and credit monitoring services for affected individuals, as well as commitments by Capital Health to enhance data security measures.

Why it matters

This case highlights the significant legal and financial consequences healthcare providers can face when patient data is compromised in a cyberattack. The settlement underscores the importance of robust cybersecurity practices to protect sensitive information and the need for transparency when data breaches occur.

The details

In November 2023, Capital Health's systems were infiltrated by the LockBit ransomware group, which claimed to have stolen 7 TB of patient data. The breach exposed names, contact information, Social Security numbers, and medical records of over 500,000 individuals. Multiple class action lawsuits were filed, which were eventually consolidated. After negotiations, Capital Health agreed to pay $4.5 million to settle the case, with no admission of wrongdoing. Class members can claim up to $5,000 for documented losses or a $100 cash payment, as well as three years of credit monitoring.

• On or around November 26, 2023, Capital Health identified unauthorized activity within its computer systems.
• The LockBit ransomware group claimed responsibility for the attack and threatened to publish the stolen data on January 9, 2024.
• The first class action lawsuit over the attack was filed on December 19, 2023.
• The consolidated class action lawsuit was filed in May 2025.
• The final fairness hearing for the settlement is scheduled for July 14, 2026.

What’s next

The deadline for objection to and opting out of the settlement is March 9, 2026. The deadline for submitting a claim is April 6, 2026.