Integris Health reaches $30M class action data breach settlement

Integris Health settled a class action data breach lawsuit to resolve claims alleging that it failed to protect the sensitive data of its patients. The data breach in question occurred in November 2023, impacting nearly 2.4 million individuals, including 224,000 minors.

The Oklahoma-based health system, which operates 16 hospitals and other healthcare facilities throughout the state, agreed to pay $30 million to settle the lawsuit.

According to Integris Health's initial breach notice, an unauthorized party accessed Integris files on Nov. 28, 2023. The impacted information varied by individual and included a combination of names, contact information, demographic information and Social Security numbers.

Integris also indicated in its February 2024 breach notice that some patients had received communications from a group claiming responsibility for the cyberattack. Integris Health urged impacted patients not to respond to or click any links contained in these communications.

According to the class action complaint, the hacker allegedly demanded a ransom from patients to keep their information safe from being posted on the dark web.

The Integris breach was one of the largest reported to HHS in 2024, standing out among the others due to the unusual occurrence of hackers reaching out to patients directly demanding ransom payments.

Class members who can prove out-of-pocket losses directly tied to the breach will be eligible to receive a one-time cash payment of up to $25,000. Alternatively, class members can receive a pro rata cash payment of $100, to be paid after all other expenses and claims have been paid out.

All class members will be eligible for three years of credit monitoring services from three credit bureaus, including up to $1 million in identity theft insurance.

The final approval hearing for the case will be held on Dec. 16, 2025.