Breach Breakdown: Yale New Haven Health (YNHHS)

May 1, 2025 · 5 min read

Have you been a patient at a Yale New Haven Health hospital or clinic? If so, a letter about this breach may have arrived in the spring of 2025. Later that year, many of the same people got a postcard about a settlement. This page explains what both of them mean for you today.

5.5 Million Individuals Affected

Last updated: November 1, 2026

What Has Happened Since the Yale New Haven Health Breach

Yale New Haven Health agreed to an $18 million class action settlement over this breach. The deadline to file a claim was February 18, 2026. Here is what has happened since the first reports.

The final count is 5,556,702 people. YNHHS reported the breach to the HHS Office for Civil Rights on April 11, 2025. It listed up to 5,556,702 affected individuals. Then, on April 14, 2025, it began mailing notification letters (HIPAA Journal).
No attacker has been named. YNHHS brought in Mandiant to investigate. Even so, no one has publicly identified the group behind the attack (HIPAA Journal).
The lawsuits now move as one. Patients filed the first lawsuit in March 2025. Then, in June 2025, a federal court in Connecticut combined it with 17 more complaints. The case is In re: Yale New Haven Health Services Corp. Data Breach Litigation (HIPAA Journal).
An $18 million settlement won approval. A federal court granted preliminary approval on October 21, 2025. In addition, YNHHS agreed to separately fund data security measures (GovInfoSecurity). The class covers about 5,383,557 U.S. residents. Class members could claim up to 5,000 dollars for documented losses. Or, instead, they could take a cash payment of about 100 dollars. Also, all class members get two years of medical data monitoring (ClassAction.org).
The claim deadline has passed. Claimants had to file online or by mail, postmarked by February 18, 2026. To do so, they used a unique ID and PIN from their postcard (Patch).
Payments are going out. The settlement received final approval on March 3, 2026. Since May 27, 2026, payments to approved claimants have gone out by mail in batches (OpenClassActions). However, you must cash a settlement check within 90 days of issue (ClassAction.org).

Who Did Hackers Breach?

Hackers breached Yale New Haven Health System (YNHHS), one of Connecticut’s largest healthcare providers. On March 8, 2025, YNHHS detected suspicious activity in its IT systems. The organization immediately contained the threat. Next, it launched an investigation with external cybersecurity experts and notified law enforcement. YNHHS confirmed that the breach did not disrupt patient care. It also said hackers did not access its electronic medical record (EMR) system.

What Information Did Hackers Steal?

The exposed data varies by patient but may include:

Name
Date of birth
Address and phone number
Email address
Race or ethnicity
Social Security number (in some cases)
Medical record number
Patient type (inpatient or outpatient)

The attackers did not steal financial data, payment card information, or employee HR records. YNHHS also confirmed that hackers did not access its EMR system.

How Can Criminals Use This Data?

Steal Medical Identities:
Fraudsters can use stolen information to obtain medical services. They can also file fake insurance claims.

Launch Phishing Attacks:
Hackers now hold patients’ contact information and personal details. As a result, they can craft convincing phishing emails that appear to come from YNHHS or other medical providers.

Target Individuals for Doxxing or Profiling:
Exposed demographic details include race and ethnicity. So malicious actors could use them to target individuals or build personal profiles.

How OptMsg Helps You Stay Secure

You Decide Who Reaches Your Inbox:

OptMsg uses patent-pending opt-in technology. Only people you approve can reach your inbox. Everyone else goes to Trash. So a fake “YNHHS” or “settlement” email from a sender you have not approved lands in Trash, not your Inbox.

Encrypted Messaging:

Messages between OptMsg users are more secure than public email messages.

Privacy by Design:

No data mining. Your data is not sold or shared with advertisers. OptMsg does not scan your emails to sell ads.

Ready to take back your inbox? Create Your Account.

Create Your Account

What Should You Do If You’re Affected?

Find your notification letter from YNHHS. Letters began going out on April 14, 2025. YNHHS offered credit monitoring to people whose Social Security numbers were involved
Did you file a settlement claim? Then watch your mail for a payment, and cash it within 90 days of issue
For settlement questions, use the official site, YaleNewHavenSettlement.com. Type the address yourself rather than clicking a link in an email or text
A message may ask for a fee, your Social Security number or your bank login to release a payment. Treat it as a scam
Check your medical bills and insurance statements for unfamiliar charges
Report any errors or suspicious activity immediately
Update your healthcare account passwords and enable two-factor authentication
Use secure apps like OptMsg for private communication

How to Contact YNHHS for More Information:

Visit: www.ynhhs.org
Call: 1-855-549-2678 (Monday–Friday, 9 AM–9 PM ET, excluding U.S. holidays)

Relevant Links:

Stay Alert. Stay Protected.

This breach shows that even major healthcare providers face serious cyber risks. So take action to secure your personal information. And consider using trusted privacy tools like OptMsg to better protect your digital health.