Ascension Data Breach Lawsuit: The Hospital Ransomware Attack

The Attack

Ascension is one of the largest health systems in the US, running scores of hospitals across many states. In May 2024, it was hit by a ransomware attack that not only exposed sensitive data but disrupted patient care — forcing some hospitals onto paper records, diverting ambulances and delaying procedures. The breach exposed information on about 5.6 million people, which could include Social Security numbers, medical information and financial details. Investigators reported the intrusion began when a contractor unknowingly clicked a malicious link, letting attackers spread through Ascension’s systems.

A cyberattack that both leaks patient data and knocks out hospital systems is doubly dangerous, because it threatens privacy and safety at once.

The Litigation

Patients filed class-action lawsuits alleging Ascension failed to adequately protect their sensitive personal and medical information and to prevent a foreseeable attack. In 2025, a federal judge allowed key claims — including negligence and state consumer-protection claims — to move forward, trimming some others, and sending the case into discovery. As with most data-breach litigation, a central question is whether patients suffered concrete harm or an increased risk of identity theft. There was no settlement at the time of writing.

Health-care breaches are especially sensitive because medical data is permanent and highly valuable to criminals.

What Patients Should Know

If you received notice that your data was involved, take the standard protective steps: consider a credit freeze, monitor your credit reports and any medical statements for unfamiliar activity, and use any free credit-monitoring the provider offers. Watch for phishing that references your care or insurance. Legitimate breach notices and any future settlement come through official channels — never through a site demanding a fee.