Ascension Cybersecurity Breach Lawsuit Advances with Trimmed but Impactful Case

Summary

• Legal Action Moves Forward: A federal judge ruled that the class action against Ascension Health over its 2024 data breach can proceed.
• Patient Data Exposed: The breach exposed protected health information and personal details of about 5.6 million people.
• Claims Partially Dismissed: The judge dismissed some claims but kept key negligence allegations.
• Health Data Security Under Scrutiny: The case puts hospital security practices in the spotlight.
• Broader Implications: Other health systems could face more legal and regulatory pressure.

Ascension breach lawsuit moves ahead

Healthcare breach litigation matters because it tests how far organizations can be held accountable for the operational, privacy, and trust failures that follow a major incident. Even when courts narrow some claims, the surviving allegations can still shape how breach responsibility is judged in a sector already under heavy pressure.

The breach

In May 2024, Ascension, one of the largest nonprofit health systems in the United States, was hit by a ransomware attack. Attackers took protected health information (PHI) and personal data for about 5.6 million people. Patients now face a higher risk of identity theft and fraud.

The ruling

On September 23, 2025, U.S. District Judge John A. Ross of the Eastern District of Missouri allowed the case to continue in narrower form. He kept the negligence claim, a negligence per se claim based on HIPAA and several state consumer protection claims, while dismissing others, including the contract, unjust enrichment and invasion of privacy claims.

The legal stakes

The surviving claims mean Ascension will have to answer, in discovery and possibly at trial, whether its security met the standard of care. That raises pressure on every provider.

Costs beyond the courtroom

The case matters beyond Ascension. Health systems nationwide may face closer scrutiny, and lawsuit costs plus possible fines give hospitals a financial reason to spend more on security.

Patients’ expectations

Patient advocates want faster breach notices and clearer information. Patients expect better protection and plain answers about what happened to their data.

What to watch

Watch for discovery fights over Ascension’s security practices, any settlement talks and whether other courts follow similar reasoning in healthcare breach cases.

Rulings at this stage do not decide who wins. They decide what a hospital must explain.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.