Cases & Investigations
University Hospitals Data Breach Litigation

On October 30, 2026, Wolf Popper LLP, together with co-counsel Barnow and Associates, P.C., filed a class action complaint in federal court against University Hospitals Health System, Inc. (“University Hospitals”) arising from a data breach affecting current and former patients. The lawsuit alleges that an unauthorized third party accessed University Hospitals’ computer systems containing patients’ personally identifiable information (“PII”) and protected health information (“PHI”), and that University Hospitals failed to take reasonable steps to protect this sensitive information.
 
University Hospitals is a healthcare system serving northern Ohio. The health system operates 21 hospitals, more than 50 health centers and outpatient facilities, and over 200 physician offices across 16 counties. In the regular course of its business, University Hospitals collects and stores sensitive personal and medical information belonging to its current and former patients.
 
According to the complaint, on or about October 22, 2026, University Hospitals detected unusual activity on its servers. The company subsequently disconnected its systems from the internet. The complaint alleges that an unauthorized third party had gained access to University Hospitals’ network systems containing patients’ PII and PHI. Most of the health system's websites reportedly remained unavailable for approximately a week following the incident. The complaint also alleges that, at the time the lawsuit was filed, University Hospitals had not yet notified individuals whose information may have been affected.
 
The lawsuit alleges that University Hospitals failed to implement and maintain reasonable security measures to protect patients’ sensitive personal and medical information from unauthorized access and disclosure. The complaint further alleges that the exposure of this information puts affected individuals at an increased risk of identity theft and medical identity theft, and may require them to spend time and money monitoring and addressing potential misuse of their information.
 
The class action lawsuit asserts claims for negligence, negligence per se, breach of fiduciary duty, breach of implied contract, and unjust enrichment. The lawsuit seeks monetary damages and other relief on behalf of affected current and former patients, as well as changes to University Hospitals’ data security practices to better protect patients’ personal and medical information.

The case is Lindenbaum v. University Hospitals Health System, Inc., No. 1:26-cv-02868 pending in the U.S. District Court for the Northern District of Ohio.
 
If you are a current or former University Hospitals patient and believe your personal or medical information may have been affected by this data breach, please contact Wolf Popper for a free case evaluation by one of our attorneys to learn more about your legal rights and whether you may have a claim.