University Hospitals patients in Northeast Ohio may be covered by a proposed class action alleging the Cleveland health system failed to protect personal and health information that the complaint says was stolen in the cyber incident UH detected on October 22, 2026. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action complaint. The statements below are unproven allegations. University Hospitals Health System, Inc. has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Happened at University Hospitals?
University Hospitals, the Cleveland-based health system that runs UH Cleveland Medical Center, UH Rainbow Babies & Children’s and a network of hospitals and outpatient centers across Northeast Ohio, says it detected unusual activity on its servers on Thursday, October 22, 2026. In a cybersecurity incident notice on its website, UH says it activated its response protocols and, “out of an abundance of caution,” disconnected its systems from the internet. MyChart and certain other digital services have been offline since, and UH says it has no estimated timeline for restoring them.UH’s notice does not say whether patient information was accessed or taken, how the intrusion happened or how many people may be affected. On October 28, 2026, six days after the incident was detected, a Cleveland patient filed a proposed class action in the U.S. District Court for the Northern District of Ohio. The case is Darden v. University Hospitals Health System, Inc., No. 1:26-cv-02830. No court has ruled on any of the allegations.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What the Lawsuit Alleges
The plaintiff, a current UH patient from Cleveland, says she gave University Hospitals her name, Social Security number, date of birth, home address, health insurance information, medication information and treatment information as a condition of care. The complaint alleges that:- cybercriminals accessed, exfiltrated and stole patients’ personal and protected health information in the incident, which the complaint says, on information and belief, affects more than a million current and former patients
- UH did not use reasonable cybersecurity safeguards or adequately train and supervise its IT and data security staff, despite years of warnings about attacks on health care providers
- UH had not begun notifying patients when the suit was filed, and instead made statements to news outlets that did not explain how the breach happened or who was affected
- the plaintiff lost access to MyChart, began receiving spam calls that used her name and asked her to “verify” her date of birth, Social Security number and address, and on October 26, 2026 received a credit bureau alert about an unauthorized request to access her credit report
The complaint also says, on information and belief, that UH offered several months of complimentary credit monitoring, which it calls inadequate. UH’s public notice reviewed for this page does not mention a credit monitoring offer. None of the allegations has been tested, and UH had not responded in court as of October 29, 2026.
What UH Is Telling Patients
According to UH’s notice, the vast majority of appointments and procedures have continued as normal, and patients should plan to attend unless they hear otherwise from their doctor, scheduling office or care team. Lab results cannot currently be viewed in MyChart, though clinicians still have access to them; UH says patients tested through Quest Diagnostics can still see results on Quest’s site, while results from a UH specialty lab or an inpatient stay are available only through MyChart or the doctor. UH says its phone system was not affected, that payment at the time of service is not currently possible, and that its servers are working internally but cannot send or receive information outside UH.The notice also warns about scams: UH says it will not call or text patients asking for banking information, and that it asks only for demographic information to confirm identity before discussing appointments or medical information.
Who Is in the Proposed Class?
The complaint proposes a nationwide class of all individuals residing in the United States whose sensitive information was compromised in the data breach, including everyone who receives a breach notice. UH, its affiliates, officers and directors, and the judge assigned to the case are excluded. The definition is a proposal; a court would have to certify a class before anyone is formally part of the case.Legal Claims and What the Lawsuit Seeks
The complaint brings four claims: negligence, breach of implied contract, unjust enrichment and breach of fiduciary duty. It points to the Federal Trade Commission’s data security guidance and the HIPAA Security Rule as the standards it says UH failed to meet. It asks for damages, including punitive and statutory damages where allowed, restitution, an order requiring UH to improve its data security, and attorneys’ fees, and demands a jury trial. Those are requests, not amounts anyone has been awarded.What Happens Next
UH is still investigating, and the scope of any data exposure is not public. If UH determines that patient information was involved, federal and state law generally require it to send individual notices and report the breach to regulators; those filings usually state how many people were affected and what types of data were exposed.In the lawsuit, UH must be served and respond, often with a motion to dismiss. Large health system breaches usually draw several suits, which are commonly consolidated into one case. Another Ohio system, Kettering Health, faced more than 200 suits after its 2025 ransomware attack, and Central Ohio Primary Care was sued after a breach it reported affected 1.4 million people. There is nothing to file in the University Hospitals case now.
Questions
Is there a University Hospitals data breach class action?
Yes. Darden v. University Hospitals Health System, Inc., No. 1:26-cv-02830, was filed October 28, 2026 in the U.S. District Court for the Northern District of Ohio. It is at the complaint stage. No class has been certified, there is no settlement and there is nothing to claim.
Has University Hospitals confirmed that patient data was stolen?
Not in its public statement reviewed for this page. University Hospitals says it detected unusual activity on its servers on October 22, 2026, disconnected its systems from the internet and is investigating. The claim that patient information was accessed and stolen comes from the complaint, which says it is based on information and belief.
Why is UH MyChart down?
University Hospitals says MyChart and certain other digital services remain offline while it investigates the October 22, 2026 cyber incident, and it has given no timeline for restoring them. It says most appointments and procedures are going ahead as scheduled and that patients should contact their provider’s office directly with questions.
Have University Hospitals patients received breach notification letters?
Not as of the October 28, 2026 complaint, which says University Hospitals had not begun notifying patients. Health care providers generally must send individual notices after determining that protected health information was involved, and those letters normally describe what was exposed and any credit monitoring offered.
Sources
• Class Action Complaint, Darden v. University Hospitals Health System, Inc., No. 1:26-cv-02830 (N.D. Ohio, filed October 28, 2026): complaint (PDF).• University Hospitals, cybersecurity incident notice: uhhospitals.org.
