Iroquois Memorial Hospital Data Breach Lawsuit Investigation
Received a December 2025 breach notice from Iroquois Memorial Hospital?
Dapeer Law, P.A. is investigating a potential class action arising from a data breach at Aesto, a technology service provider that stores protected health information for Iroquois Memorial Hospital, on behalf of hospital patients whose personal and medical information may have been exposed in the December 2025 cyber incident.
Who may qualify
You may be eligible to participate in a class action if any of the following applies:
- You received a data breach notification letter from Iroquois Memorial Hospital dated December 2025.
- Your letter offered enrollment in free Epiq Privacy Solutions ID 3B credit-monitoring and identity-theft protection services.
- You had personal or medical information held by Iroquois Memorial Hospital, or by Aesto in its capacity as a service provider to the hospital.
- No proof of harm required to consult with counsel. You do not need to have already suffered identity theft to explore your legal options.
- Excluded: individuals who did not receive a breach notice and whose information was not involved in the incident.
Not sure if you qualify?
Send us your notice, we'll confirm your eligibility at no cost.
What happened
According to a notice filed with the Massachusetts Attorney General, Aesto, a service provider that stores protected health information for Iroquois Memorial Hospital, experienced a network security incident affecting a portion of its Amazon Web Services infrastructure. The notice reports that the unauthorized access occurred between December 2 and December 18, 2025, and that the activity was detected on December 18, 2025. Aesto reports that it engaged external cybersecurity professionals to conduct a forensic investigation and a manual review of the documents involved.
Aesto reports that on May 26, 2026 its investigators confirmed that a limited amount of protected health information relating to Iroquois Memorial Hospital patients had been accessed or acquired. Written notices were mailed to affected individuals on June 26, 2026. The notice states that the information involved may have included full name, Social Security number, date of birth, and medical information, and that affected individuals are being offered complimentary credit-monitoring and identity-theft protection services through Epiq Privacy Solutions ID 3B Credit Monitoring. Regulatory filings indicate approximately 566 individuals were affected, including 19 Massachusetts residents and 547 Texas residents. Aesto reports that it is not aware of any misuse of the information. The roughly six-month gap between the December 2025 detection and the June 2026 notice letters is one of the questions our investigation is examining.
Because the reported categories include Social Security numbers, dates of birth, and medical information held on behalf of a hospital, affected individuals may face an elevated risk of identity theft, medical identity theft, and fraudulent use of health benefits. Medical information can carry heightened sensitivity and may be subject to protections under state law and federal health privacy rules. Where a hospital entrusts patient data to an outside vendor, the hospital's selection and oversight of that vendor can also be relevant to a claim.
What to do if you received a letter
Keep your notice letter
Do not discard it. Your letter contains the enrollment code for credit monitoring and is important evidence if you decide to participate in a lawsuit.
Enroll in the free credit monitoring
Enroll in the Epiq Privacy Solutions ID 3B credit-monitoring and identity-theft protection service offered in your letter before the stated deadline. Accepting this benefit does not waive your right to pursue legal action.
Place a fraud alert or credit freeze
Contact Equifax, Experian, and TransUnion to place a fraud alert or freeze on your file. Request a free weekly credit report from AnnualCreditReport.com, and use the FTC's IdentityTheft.gov recovery guide.
Speak with a data breach attorney
Consultations with Dapeer Law are free and confidential. We'll review your notice, explain your options, and advise whether you may be eligible to join a class action.
Submit your notice for a free review
Two minutes online. A licensed attorney reviews every submission.
Breach timeline
Compensation you may be entitled to
Out-of-pocket expenses
Credit freezes, identity restoration services, and other costs incurred responding to the breach.
Time spent monitoring
Hours spent reviewing accounts, disputing fraudulent charges, and dealing with identity theft issues.
Identity theft & fraud losses
Unreimbursed funds stolen from accounts, unauthorized credit lines, or tax refund fraud tied to the breach.
Statutory damages
Certain state data breach and consumer protection statutes provide for fixed damages regardless of actual loss.
Injunctive relief
Court orders requiring Iroquois Memorial Hospital and its service providers to implement stronger data security practices going forward.
Compensation categories depend on applicable state law, the types of data exposed, and documented losses. No recovery is guaranteed.
Common questions
I received a data breach letter from Iroquois Memorial Hospital. What should I do? +
Keep your notice letter, enroll in the complimentary Epiq Privacy Solutions ID 3B credit-monitoring and identity-theft protection service before the deadline, and review your bank statements, credit-card statements, and health insurance Explanation of Benefits statements for unfamiliar charges or services. Consider placing a fraud alert or security freeze on your credit files, request your free annual credit reports from each of the three major bureaus, and contact a data breach attorney to understand your options.
Am I eligible to join a class action against Iroquois Memorial Hospital? +
If you received a notice letter dated June 26, 2026 about the Aesto incident affecting Iroquois Memorial Hospital patients, or your name, Social Security number, date of birth, or medical information was included in the files involved, you may be eligible. Factors that affect eligibility include your state of residence, the categories of your data exposed, and whether you experienced any economic or emotional harm.
How much money could I receive from a class action lawsuit? +
Data breach class action recoveries vary significantly. Settlements typically range from a few hundred dollars for basic out-of-pocket losses to several thousand dollars for documented identity theft, with class size, damages, and negotiation all affecting the final amount. No payout is guaranteed, and this investigation has not yet resulted in a settlement.
What personal information was exposed in the breach? +
The notice reports that the information involved may have included full name, Social Security number, date of birth, and medical information. The specific medical details were not described in the public filing. Your individual letter may list the categories of your information that were involved, so review it closely and keep it.
Did Iroquois Memorial Hospital offer free credit monitoring? +
Yes. Complimentary credit-monitoring and identity-theft protection services are being offered through Epiq Privacy Solutions ID 3B Credit Monitoring. The duration was not stated in the public filing, so check the letter you received for the length of the membership and the enrollment deadline. Accepting this service does not waive your right to pursue legal action.
How many people were affected by the Iroquois Memorial Hospital breach? +
Regulatory filings indicate approximately 566 individuals were affected, including 19 Massachusetts residents and 547 Texas residents. We will update this page as more becomes known.
Is there a deadline to take legal action? +
Yes. Statutes of limitations for data breach claims vary by state and legal theory, typically ranging from one to six years. Waiting can permanently bar your claim. Contact us as soon as possible for a free evaluation.
How do I get a copy of the official breach notice? +
The notice was filed with the Massachusetts Attorney General and can be downloaded from that office's website. Dapeer Law can also help you obtain a copy of the notice during a free consultation.
Sources & references
- Official breach notice filing · Massachusetts Attorney General, Data Breach Notification
- Credit bureau freezes · Equifax · Experian · TransUnion
- Free weekly credit reports · AnnualCreditReport.com
- Identity theft recovery guide · FTC IdentityTheft.gov
Don't let the deadline decide for you. Submit your claim today.
You only have a limited window to act. Our team will review your notice, explain your options, and tell you whether you may be eligible to recover compensation, at no cost to you.
