ALN Medical Management, a Nebraska-based revenue cycle management firm acquired by Health Prime in 2023, suffered a March 2024 cyberattack that initially reported a HIPAA breach affecting 501 individuals but later revised the estimate to 1.8 million victims. The unauthorized actor accessed ALN’s third-party hosted systems between March 18–24, 2024, exfiltrating sensitive patient data, including names, Social Security numbers, driver’s license numbers, government-issued IDs (passports, state IDs), financial details (account/credit/debit card numbers), medical records, and health insurance information. The breach led to a $4 million class-action settlement, with eligible victims able to claim up to $5,000 for documented losses or a $50 pro rata cash payment, alongside one year of free credit and medical identity monitoring. The incident underscores the rising threat to third-party healthcare vendors, where compromised systems expose vast troves of protected health information (PHI) and personally identifiable information (PII), triggering regulatory scrutiny, financial penalties, and reputational damage. The court’s preliminary settlement hearing is pending.