🔒Yale New Haven Health reaches preliminary settlement in data breach class action lawsuit

Yale New Haven Health Services Corp., parent of the state’s largest healthcare system, has reached a preliminary agreement to settle a class action lawsuit over a data breach that occurred in March and affected nearly 5.6 million people. The notice of a settlement was filed Monday in the U.S. District Court for the District of Connecticut. The notice asked the court to stay all case deadlines in order to “allow the (p)arties sufficient time to draft and finalize the settlement agreement,” as well as for the plaintiffs to prepare and file their motion for preliminary approval of the settlement. Terms of the proposed settlement agreement weren’t disclosed. On Tuesday, U.S. District Judge Stefan R. Underhill issued an order granting the stay for 30 days until Sept. 11. Yale New Haven Health said in early March that it was investigating a cybersecurity incident that affected information technology services across its system. At the time, Yale New Haven Health said the issue was immediately identified by its digital and technology solutions team, “who quickly began working to mitigate the issue and launched an investigation into its source.” The health system said it also worked with Mandiant, a Virginia-based cybersecurity firm, to determine that the issue was, in fact, “a cybersecurity incident.” Yale New Haven Health said it was notifying federal authorities of the incident and that Mandiant was conducting an investigation. In a letter to those potentially affected, the health system stated that it determined that “an unauthorized third-party gained access to our network and, on March 8, 2025, obtained copies of certain data.” It said the copied information varies by patient, “but may include demographic information (such as name, date of birth, address, telephone number, email address, race or ethnicity), Social Security number, patient type, and/or medical record number.” Several lawsuits seeking class action status were subsequently filed against Yale New Haven Health. The lawsuits were consolidated into one case that includes 15 named plaintiffs as well as four parents or guardians representing eight unnamed minors, on behalf of the rest of the class. Yale New Haven Health did not immediately respond to a request for comment.