NextGen Healthcare Settles $19.4M Class Action Over 2023 Data Breach NextGen Healthcare, a health technology provider serving over 1,600 healthcare organizations, has agreed to a $19.4 million class action settlement to resolve claims stemming from a 2023 data breach that exposed sensitive patient information. The breach, detected on April 28, 2023, resulted from a third-party cyberattack that compromised personal data, including names, addresses, dates of birth, Social Security numbers, health insurance details, and driver’s license numbers. While NextGen has not admitted wrongdoing, the settlement aims to compensate affected individuals. Under the agreement, class members those whose data was exposed can claim: - Up to $7,500 for out-of-pocket expenses (e.g., fraudulent charges, identity theft costs, credit monitoring). - Up to $250 for lost time (10 hours at $25/hour). - A $50 or $150 cash payment (with California residents eligible for the higher amount). - Three years of identity defense and restoration services. Key deadlines: - Exclusion/objection deadline: February 12, 2026. - Final approval hearing: February 17, 2026. - Claim submission deadline: March 30, 2026. The settlement resolves allegations that NextGen failed to adequately protect patient data, marking one of the largest healthcare breach settlements in recent years.

NextGen Healthcare suffered a data breach, the security incident exposed the personal information of approximately 1 million individuals. The compromised information exposed the electronic data accessed during the incident included name, date of birth, address, and social security number. In order to mitigate the security compromise, NextGen Healthcare claimed to have strengthened the security of its systems and reset passwords, among other steps.

The California Office of the Attorney General reported a data breach involving NextGen Healthcare, Inc. on May 5, 2023. The breach occurred between March 29, 2023, and April 14, 2023, affecting a limited set of personal information including names, dates of birth, addresses, and social security numbers, but no health or medical records were compromised.

NextGen Healthcare was added to the leak site by the BlackCat (aka ALPHV) ransomware group. However, they contained the threat, secured our network, and returned to normal operations. The threat actor behind the incident claimed to provide data and all information if the company does not pay.