Patients of St. Louis Behavioral Medicine Institute and other healthcare providers that use the medical billing company Kovo+ may be covered by four proposed class actions alleging Kovo+, and in three of them SLBMI, failed to protect personal and health information that the Pear ransomware group claims it took. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action complaint. The statements below are unproven allegations. Kovo+ (USA), Inc. and St. Louis Behavioral Medicine Institute, Inc. have not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
Kovo+ (USA), Inc., an Eau Claire, Wisconsin company that handles medical billing and revenue cycle management for healthcare providers, was hit with two proposed class actions on October 1, 2026 in the U.S. District Court for the Western District of Wisconsin, and a third on October 2. Its client St. Louis Behavioral Medicine Institute, Inc. (SLBMI), a behavioral health practice serving the St. Louis area, is named as a defendant in all three of those first suits. The cases are Michalski v. Kovo+ (USA), Inc., Case No. 3:26-cv-00992, Hodgson v. Kovo+ (USA), Inc., Case No. 3:26-cv-00993, and Ehmcke v. Kovo+ (USA), Inc., Case No. 3:26-cv-01001.The first two lawsuits were brought by Missouri residents who say they are patients. The third was filed by a New York resident who says he is a former SLBMI patient. Those three complaints are nearly identical. They allege the two companies did not adequately protect patients’ personal and health information before a ransomware attack on Kovo+. One plaintiff says she has received a noticeable increase in spam calls, texts and emails since the breach, and the Ehmcke plaintiff says an identity monitoring service alerted him that his personal information had been found on the dark web. Neither company has responded to any of the lawsuits, and none of the allegations has been tested in court.
A fourth proposed class action, Friello v. Kovo+ (USA), Inc., Case No. 3:26-cv-01036, was filed in the same court on October 15, 2026 by a New York resident who says he is a patient of a healthcare provider that uses Kovo+’s billing services. Unlike the first three, it names only Kovo+ as a defendant and does not mention SLBMI. The court noted the earlier three cases as related when it assigned the new one to Magistrate Judge Anita M. Boor.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What the Complaints Say Happened
According to the complaints, the Pear ransomware group claimed responsibility on or about September 5, 2026 for a cyberattack on Kovo+’s network and systems. The complaints cite a report by the threat-intelligence firm SOCRadar, which lists the target as Kovo Healthtech Corp, the company behind kovoplus.com.The complaints say, on information and belief, that the attackers took personally identifiable information and protected health information. It bases that on the kind of work the defendants do rather than on a notice or disclosure from either company. It also says the defendants have not denied that the data was accessed, and that they did not quickly tell patients their information had been stolen. The Friello complaint goes further on the data, alleging on the basis of Kovo+’s billing role that the files included patient names, dates of birth, insurance information, billing records and other claims-processing data. It also says Kovo+ had not publicly confirmed the incident or disclosed when it happened as of October 15, 2026.
What the Ransomware Group Claims
Threat-intelligence trackers SOCRadar, DeXpose and HookPhish each reported that Pear added Kovo Healthtech Corp to its dark web leak site on September 5, 2026. Pear is described in those reports as an extortion group that steals data and threatens to publish it unless a ransom is paid.In late September, the dark web monitoring account DailyDarkWeb reported that about 2.7 terabytes of data said to come from Kovo Healthtech was being advertised on an underground forum. The sellers claim it includes personal and health information for millions of patients, along with financial records. None of those claims has been independently verified. Because Kovo+ handles billing for medical practices, clinics and hospitals, any patient data in the files would most likely belong to patients of its healthcare clients.
As of October 17, 2026, no breach notice letter, state attorney general filing or HHS breach report from Kovo+ or SLBMI had been located, and neither company had publicly confirmed the attack or said how many people were affected. The first three complaints estimate only that the proposed class includes “thousands” of people; the Friello complaint, on information and belief, estimates “millions.”
Who Could Be Affected
The proposed classes are nationwide: everyone whose personal information was compromised as a result of the breach. They are not limited to SLBMI patients. The Friello class covers all individuals whose private information “was or may have been accessed, acquired, or disclosed without authorization” in the Kovo+ incident reported in September 2026. The complaints say Kovo+ provides billing services to healthcare providers and medical billing firms, and that its contracts with those clients are virtually identical across the country. That suggests patients of other Kovo+ clients could be involved, though no other clients are named.Only the Friello complaint names likely data fields, and it does so on information and belief. Medical billing records commonly include names, contact details, dates of birth, insurance information and treatment or billing codes. Whether any of that was actually taken has not been confirmed. The clearest way to know whether you are affected is a breach notice letter that names Kovo+ or your provider.
The Legal Claims and What the Case Asks For
The first three lawsuits assert the same five claims:- Negligence, against both defendants
- Negligence per se, against both defendants, based on Section 5 of the FTC Act
- Unjust enrichment, against both defendants
- Breach of implied contract, against SLBMI
- Breach of a third-party beneficiary contract, against Kovo+, on the theory that patients were intended beneficiaries of Kovo+’s contracts with its healthcare clients
The complaints allege the defendants did not meet FTC data security guidance, HIPAA’s Privacy and Security Rules, or industry frameworks such as the NIST Cybersecurity Framework. It says they failed to use multi-factor authentication and to train staff. Each asks the court to certify the class and to award damages, statutory damages where available, restitution and interest, and each demands a jury trial. All three plaintiffs are represented by Shamis & Gentile, P.A.; the Hodgson plaintiff is also represented by Kopelowitz Ostrow P.A., and the Michalski plaintiff by Milberg, PLLC.
The Friello complaint sues Kovo+ alone and brings four claims: negligence, negligence per se, breach of implied contract and unjust enrichment. It asks the court to certify the class and to award damages, restitution and disgorgement, along with an order requiring Kovo+ to change its data practices and account for and purge the information involved. It also demands a jury trial. The plaintiff is represented by Cafferty Clobes Meriwether & Sprengel LLP and Lowey Dannenberg, P.C.
What Patients Can Do Now
There is nothing to file in the lawsuit. People who were treated by SLBMI, or who think a provider that uses Kovo+ may have their information, can take steps that do not depend on the case:- Watch for a breach notice letter from Kovo+ or your provider, and keep it, since data breach settlements usually ask for the ID printed on the notice
- Review explanation-of-benefits statements from your health insurer for visits, prescriptions or services you did not receive
- Place a free credit freeze with Equifax, Experian and TransUnion, which blocks new accounts from being opened in your name
- Report any misuse at the FTC’s IdentityTheft.gov, which builds a recovery plan
Our guide to credit freezes versus fraud alerts explains which one fits your situation.
What Happens Next?
A third suit, Ehmcke, was filed on October 2, 2026, the day after the first two, and a fourth, Friello, on October 15. When it assigned Friello on October 16, the court listed the three earlier cases as related. As of October 17, 2026, the public dockets showed complaints, summonses and disclosure statements, and no response from Kovo+ or SLBMI in any of the cases. Because all four cases are in the same court over the same alleged breach, they are likely to be consolidated, and more suits may follow if Kovo+ or its clients send breach notices. This page will be updated if a breach notice is issued or the cases move forward.Read the Complaint
The Hodgson v. Kovo+ (USA), Inc. complaint is embedded below. The Michalski and Ehmcke complaints are nearly identical. The separate Friello complaint is available on CourtListener.Hodgson v. Kovo+ (USA), Inc. — Class Action Complaint (PDF, October 1, 2026)
Questions
What is Kovo+?
Kovo+ (USA), Inc. is a healthcare technology and AI process automation company based in Eau Claire, Wisconsin. According to the complaints, it provides medical billing and revenue cycle management services to healthcare providers and medical billing firms. St. Louis Behavioral Medicine Institute is one of its clients.
Has Kovo+ confirmed a data breach?
Not publicly, as of October 17, 2026. Ransomware trackers reported that the Pear group listed Kovo Healthtech Corp on its leak site on September 5, 2026, and about 2.7 terabytes said to come from the company was later advertised on an underground forum. The fourth lawsuit, filed October 15, says Kovo+ still had not confirmed the incident. No breach notice letter or government breach filing from Kovo+ or St. Louis Behavioral Medicine Institute had been located.
What information may have been exposed in the Kovo+ breach?
No company has confirmed what, if anything, was taken. The first three complaints say only, on information and belief and based on the services the defendants provide, that the stolen files include personally identifiable information and protected health information. The fourth complaint, Friello, alleges the data included patient names, dates of birth, insurance information and billing records, based on Kovo+’s role as a billing vendor.
Am I affected if I was not a St. Louis Behavioral Medicine Institute patient?
Possibly. The complaints say Kovo+ works for healthcare providers and billing firms around the country, and the proposed classes cover everyone whose information was compromised in the breach, not just SLBMI patients. The fourth suit, Friello, does not mention SLBMI at all; it was filed by a patient of a provider that uses Kovo+. The clearest sign would be a breach notice letter naming Kovo+ or the provider.
Is there a Kovo+ data breach settlement or claim form?
No. Four lawsuits were filed between October 1 and October 15, 2026, no class has been certified, and there is no settlement, fund or claim form. Anyone who receives a breach notice about Kovo+ may want to keep it, because data breach settlements usually ask for the ID printed on the notice.
Sources
• Class Action Complaint — Hodgson v. Kovo+ (USA), Inc., U.S. District Court for the Western District of Wisconsin, Case No. 3:26-cv-00993 (filed October 1, 2026): Complaint (PDF)• SOCRadar — Kovo Healthtech Corp listed as a Pear ransomware victim, September 5, 2026: SOCRadar report
• DeXpose and HookPhish ransomware trackers (September 5–6, 2026) and DailyDarkWeb (late September 2026) on the leak-site listing and the 2.7 TB data advertisement
• Class Action Complaint — Michalski v. Kovo+ (USA), Inc., U.S. District Court for the Western District of Wisconsin, Case No. 3:26-cv-00992 (filed October 1, 2026), via CourtListener: CourtListener Docket
• Docket for Hodgson v. Kovo+ (USA), Inc., No. 3:26-cv-00993 (W.D. Wis.), via CourtListener: CourtListener Docket
• Class Action Complaint — Ehmcke v. Kovo+ (USA), Inc., U.S. District Court for the Western District of Wisconsin, Case No. 3:26-cv-01001 (filed October 2, 2026): Complaint (PDF) · CourtListener Docket
• Class Action Complaint — Friello v. Kovo+ (USA), Inc., U.S. District Court for the Western District of Wisconsin, Case No. 3:26-cv-01036 (filed October 15, 2026): Complaint (PDF) · CourtListener Docket
• Federal Trade Commission — identity theft reporting and recovery: IdentityTheft.gov
