One Brooklyn Health System (OBH)—a New York City nonprofit network that includes Brookdale University Hospital, Interfaith Medical Center, and Kingsbrook Jewish Medical Center—was hit by a cyber incident that allegedly exposed patients’ sensitive data between July 9 and Nov. 19, 2022. According to the case, the compromised information could include names, Social Security numbers, and medical details—exactly the kind of “high-value” combination that can fuel identity theft, medical fraud, and long-lasting privacy harms. Healthcare organizations are frequent targets because they rely on complex IT systems and third-party vendors while handling some of the most regulated and sensitive personal information. The class action was filed on the theory that OBH failed to implement reasonable safeguards to prevent the breach and to protect patient data, seeking compensation and changes to security practices; OBH has agreed to a $1.5 million settlement without admitting wrongdoing. Eligible patients who received notice may choose a cash payment or claim reimbursement for documented out-of-pocket losses up to $2,500, plus compensation for up to four hours of lost time at $25/hour, and they can also receive 24 months of credit monitoring—reflecting how these cases often focus on both direct financial losses and the ongoing burden of monitoring for fraud. The settlement is significant because it puts a dollar value on alleged lapses in healthcare cybersecurity and creates a standardized path for affected patients to seek relief, with a claim deadline of March 10, 2025. More broadly, this case fits a growing wave of healthcare data-breach class actions where plaintiffs argue that hospitals and health systems should have anticipated ransomware and intrusion risks and invested accordingly, even when the immediate theft is carried out by outside criminals. The industry operates under a patchwork of obligations—most notably HIPAA’s Privacy and Security Rules (enforced by HHS’ Office for Civil Rights) requiring administrative, technical, and physical safeguards, along with New York’s SHIELD Act and state breach-notification rules that can raise the stakes for organizations handling resident data. Similar settlements across the healthcare sector often offer credit monitoring and capped reimbursements, highlighting a continuing legal debate over what “harm” means in data-breach cases and how much accountability courts and consumers will demand as cyberattacks against medical providers keep accelerating