In May 2023 Norton Healthcare disclosed a cybersecurity incident that exposed personally identifiable information (PII) and protected health information (PHI) for as many as about 2.5 million patients and employees. Plaintiffs sued claiming negligence, breach of implied contract, unjust enrichment and invasion of privacy; Norton denied wrongdoing but agreed to an $11 million settlement to avoid protracted litigation. The settlement offers three years of medical-monitoring services, reimbursement for up to $2,500 of unreimbursed losses, modest lost-time payments and a pro rata cash distribution, with claim deadlines and a final-approval hearing scheduled in 2026. This case matters because it reinforces legal and financial pressures on healthcare providers to secure sensitive data under laws such as HIPAA and state breach-notification statutes, and it follows a string of large healthcare-data settlements (e.g., Anthem, Premera) that commonly provide medical monitoring and out-of-pocket relief. Beyond individual compensation, these outcomes push hospitals to strengthen cybersecurity, incident response and regulatory compliance—both to protect patient trust and to limit exposure to OCR enforcement, FTC scrutiny and costly class actions when ransomware and data theft occur.