People whose information was taken in the 2026 Quantum Health data breach, including members of employer health plans that use the Ohio care-coordination company, may be covered by a proposed class action alleging Quantum Health, Inc. failed to protect their Social Security numbers and health information. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes class action complaints. The statements below are unproven allegations. Quantum Health, Inc. has not admitted wrongdoing and has not been found liable, there is no certified class, and there is nothing to claim at this time. This page is informational. It is not legal advice.
What the Quantum Health Lawsuits Are About
Quantum Health, Inc. is a healthcare coordination company based in Dublin, Ohio. It provides healthcare coordination, or navigation, services to members of employer-sponsored health plans through their employers, and the complaint says that work gives it personal and health information about current and former plan members. According to the company’s breach notice, as quoted in the first lawsuit, an unauthorized party got into certain Quantum Health systems between May 29 and June 1, 2026 and took files from them.The first proposed class action over the breach was filed on August 14, 2026 in the U.S. District Court for the Southern District of Ohio, where Quantum Health has its headquarters. It alleges the company did not train its employees adequately on cybersecurity or keep reasonable safeguards in place, and that it waited about two months to tell people their data had been taken. More suits followed in the same court, and orders entered in early September found at least two of them related to the first case.
The cases have not been consolidated, and no class has been certified. Quantum Health has not admitted wrongdoing, and no court has ruled on whether any of the allegations are true.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Timeline: From the Intrusion to the Lawsuits
The dates below come from the first complaint, which quotes Quantum Health’s notice letter, and from the court dockets.- May 29 – June 1, 2026 — An unauthorized party accesses and takes files from certain Quantum Health systems, according to the company’s notice as quoted in the complaint.
- On or around June 1, 2026 — Quantum Health discovers the breach, the complaint says.
- July 29, 2026 — Quantum Health begins notifying affected people. The complaint calls this “a full 61 days” after the breach began.
- August 14, 2026 — The first class action complaint, No. 2:26-cv-00978, is filed in the Southern District of Ohio in Columbus.
- August – early September 2026 — Further suits are filed in the same court, beginning with No. 2:26-cv-00983 and including Nos. 2:26-cv-01000 and 2:26-cv-01024, with filings continuing through at least September 3.
- September 2 and September 4, 2026 — Orders find Nos. 2:26-cv-01000 and 2:26-cv-01024 related to the first-filed case.
- October 19, 2026 — Quantum Health’s answer to the first complaint is due, after the company waived formal service.
What Information Was Involved
The first complaint lists these categories of personal and health information as compromised in the breach:- Names, dates of birth, email addresses, mailing addresses and phone numbers
- Social Security numbers
- Health insurance information
- Health information, including medical and treatment information, diagnoses, prescriptions, provider names and dates of service
The complaint does not say that every category was exposed for every person, and individual notice letters may describe a narrower set. In its notice, as quoted in the complaint, Quantum Health said it is strengthening its existing security protocols and adding new security measures. The complaint also acknowledges that the company offered some affected people credit monitoring and identity-related services, which it alleges fall short of covering the harm.
Who Is Affected
The people at issue are current and former members of the employer-sponsored health plans that Quantum Health works with. The company serves them through their employers rather than selling to them directly.The first complaint does not give a count of affected people. It says the precise number is unclear, that Quantum Health’s own records can identify them, and that the class has more than 100 members. Citing Quantum Health’s website, it says the company has more than 20 million members across more than 570 employer clients nationwide, but that figure describes the size of the business, not the number of people whose data was taken.
The named plaintiff in the first case, a Maryland resident, says she is a current member through her employer’s health plan and that her name, Social Security number, contact details, date of birth and health insurance information were held by Quantum Health, along with information about dependents on her coverage.
What the Complaint Alleges
The complaint’s core allegation is that Quantum Health left its systems open to attack by failing to train its workforce on cybersecurity and failing to maintain reasonable security safeguards. It measures the company’s practices against data security guidance from the Federal Trade Commission, the National Institute of Standards and Technology’s Cybersecurity Framework 2.0 and the Center for Internet Security’s Critical Security Controls, and it lists a series of HIPAA safeguards it says the company did not meet.It also faults the timing of the notice. By the complaint’s count, Quantum Health took 61 days from the start of the breach to begin notifying people, which it says kept them from taking steps to protect themselves sooner. It points to language in the notice urging recipients to watch their account statements and credit reports for fraud as an acknowledgment that the breach created an ongoing risk of identity theft.
The complaint says the named plaintiff now spends time monitoring her accounts and has experienced anxiety, stress and sleep disruption. Across the proposed class, it alleges lost time, out-of-pocket costs, a loss in the value of the stolen information and a continuing risk of identity theft and fraud, particularly because Social Security numbers were involved. It alleges, on information and belief, that the data has been or soon will be published on the dark web.
Where the Cases Stand in Ohio Federal Court
All of the Quantum Health suits identified so far are pending in the Eastern Division of the U.S. District Court for the Southern District of Ohio, in Columbus. The first-filed case, No. 2:26-cv-00978, was brought under the Class Action Fairness Act, which allows class actions with more than $5 million in controversy, at least 100 proposed class members and parties from different states to proceed in federal court. Court records on CourtListener show roughly ten suits over the breach.In orders dated September 2 and September 4, 2026, signed by Chief District Judge Sarah D. Morrison and District Judge Algenon L. Marbley, the court found Nos. 2:26-cv-01000 and 2:26-cv-01024 related to the first-filed case. A related-case finding generally keeps overlapping lawsuits before the same judge. It is not a consolidation order, and none had been entered as of October 15, 2026.
In the first case, Quantum Health waived formal service of the complaint. Its answer or other response is due October 19, 2026.
The Proposed Class
The first complaint seeks to represent a nationwide class of all individuals living in the United States whose personal or health information was compromised in the breach Quantum Health discovered in June 2026, including everyone who received a notice letter. Excluded are Quantum Health and its agents, affiliates, parents and subsidiaries, entities it controls, its officers and directors, its successors, and any judge on the case along with the judge’s staff and immediate family.Certification is requested under Federal Rule of Civil Procedure 23(a), 23(b)(2) and 23(b)(3), and the plaintiff reserves the right to amend the definition. The other suits may define their classes differently, and if the cases are later combined, a consolidated complaint could change the definition again. No class has been certified.
Claims and Relief Sought
The first complaint brings eight counts on behalf of the proposed class:- Negligence
- Negligence per se, based on Section 5 of the Federal Trade Commission Act
- Breach of implied contract
- Negligent invasion of privacy under Ohio law
- Unjust enrichment
- Breach of fiduciary duty
- Breach of confidence
- Declaratory judgment under the federal Declaratory Judgment Act
It asks the court to certify the class, to declare that Quantum Health owes and has breached a duty to use reasonable data security, and to order the company to use security consistent with industry standards to protect the data it still holds. It also seeks compensatory, exemplary, punitive and statutory damages as allowed by law, restitution, pre- and post-judgment interest, and attorneys’ fees and costs, and it demands a jury trial. No dollar amount is attached to any of it. The other complaints filed over the breach may plead different counts or seek different relief.
What Happens Next
When several suits over the same data breach land in one federal court, the plaintiffs’ lawyers commonly ask the court to consolidate them and to appoint interim lead counsel, who then file a single consolidated complaint. The defendant typically responds with an answer or a motion to dismiss, and the court decides which claims, if any, can go forward. Cases that survive move into discovery and, later, a contested request for class certification.Many data breach class actions end in a negotiated settlement rather than a trial, but that is not a given in any particular case, and some are dismissed. If the Quantum Health litigation settles, the court would have to approve the terms, and class members would generally be notified and given a chance to file a claim, object or opt out. None of that has happened here.
Is There Anything to Claim?
There is nothing to claim. The cases are at the complaint stage, no class has been certified, and there is no settlement, claim form, settlement website or deadline. The credit monitoring and identity-related services described in connection with Quantum Health’s notice are the company’s own offer and are separate from the lawsuits.Questions
Is there a Quantum Health data breach settlement?
There is no settlement. The proposed class actions over the 2026 Quantum Health data breach are pending in the U.S. District Court for the Southern District of Ohio and are at the complaint stage. No class has been certified, and there is no settlement fund, claim form or deadline.
What information was taken in the Quantum Health data breach?
The first complaint lists names, Social Security numbers, dates of birth, email addresses, mailing addresses, phone numbers, health insurance information and health information such as medical and treatment details, diagnoses, prescriptions, provider names and dates of service. Not every category was necessarily involved for every person.
When did the Quantum Health data breach happen?
Quantum Health's notice, as quoted in the first complaint, says an unauthorized party accessed and took files from certain company systems between May 29 and June 1, 2026. The complaint says Quantum Health discovered the breach on or around June 1, 2026 and began notifying people on July 29, 2026, which it alleges was 61 days after the breach began.
How many people were affected by the Quantum Health data breach?
The first complaint does not give a number. It says the precise count is unclear and alleges only that the class has more than 100 members. Citing Quantum Health's website, it says the company has more than 20 million members across more than 570 employer clients, but that figure describes the company's size, not the number of people affected by the breach.
Why would Quantum Health have health plan members' information?
Quantum Health is a healthcare coordination company that provides services to members of employer-sponsored health plans through their employers. The complaint says that work requires it to receive and keep personal and health information about current and former plan members.
Have the Quantum Health lawsuits been consolidated?
The suits had not been consolidated as of October 15, 2026. Orders dated September 2 and September 4, 2026 found Nos. 2:26-cv-01000 and 2:26-cv-01024 related to the first-filed case, No. 2:26-cv-00978. A related-case finding is a case-management step and says nothing about whether the allegations are true.
Sources
• Pietrowski v. Quantum Health, Inc., No. 2:26-cv-00978 (S.D. Ohio) — CourtListener docket• Class action complaint, ECF No. 1 (filed August 14, 2026) — PDF via CourtListener RECAP
