University Hospitals, the Cleveland based health system that operates 13 hospitals and more than 50 outpatient locations across northern Ohio, detected unusual activity on its servers on October 22. The health system activated its incident response protocols and disconnected its systems from the internet as a precaution, a step it says it is still working to reverse. The shutdown took the MyChart patient portal offline, interrupted insurance preauthorizations, and left University Hospitals unable to process electronic payments at the time of service. University Hospitals has not said what caused the activity or whether ransomware was involved.
Six days later, on October 28, Cleveland patient Tanya Darden filed a proposed class action in the U.S. District Court for the Northern District of Ohio. The complaint accuses University Hospitals of negligence, breach of implied contract, unjust enrichment, and breach of fiduciary duty, and claims the health system failed to deploy adequate safeguards, including multifactor authentication and employee cybersecurity training. It says notifications to affected patients had not begun as of the filing date.
Darden's complaint describes potentially exposed data including names, Social Security numbers, dates of birth, home addresses, health insurance information, and medication and treatment records. It puts the number of affected patients at more than one million in one section and at hundreds of thousands in another, both without a cited source, since University Hospitals has not released a scope figure of its own. Darden says she has since received spam calls from people who knew her name and that she was notified October 26 of an unauthorized attempt to access her credit report. University Hospitals has not confirmed whether her experience is connected to the incident.
The gap between what Darden's complaint alleges and what University Hospitals has verified is now routine in hospital breach litigation. Plaintiffs' firms file within days of a disclosed outage, often before a health system finishes its forensic review and before any breach notification reaches HHS, so a scope figure pulled from a complaint can circulate for months before the real number surfaces. Device manufacturers and hospital security teams watching this incident should treat the million patient figure as a claim, not a finding, until University Hospitals or a regulator says otherwise.
University Hospitals says most appointments and procedures have continued without disruption and that patients should keep scheduled visits unless their care team says otherwise. The health system remains unable to take electronic payments more than a week after the outage began, a detail that shows how deep the shutdown reached into billing and scheduling systems that connect to the same networks hosting clinical applications. University Hospitals has given no estimated date for restoring MyChart or full connectivity.