Cigna Faces Class Action Lawsuit Over Data Breach Exposing Patient Information A new class action lawsuit filed against The Cigna Group Inc. alleges the company failed to adequately secure sensitive patient data, leading to a breach that exposed personally identifiable information (PII) and protected health information (PHI). The complaint, brought by plaintiff Karina Lopez, was filed on December 17, 2024, in the U.S. District Court for the District of Connecticut (Case No. 2:25-cv-02113). Lopez claims the breach occurred between October 2024 and January 2025, when an unauthorized actor accessed the network of one of Cigna’s vendors. The compromised data allegedly includes names, healthcare IDs, dates of service, treatment costs, and claims numbers. Cigna reportedly discovered the breach in November 2025 but is accused of delaying notifications to affected individuals. The lawsuit further alleges that Cigna’s negligence in implementing reasonable security measures allowed the exposed data to surface on the dark web, increasing the risk of identity theft for affected patients. Lopez seeks damages for identity theft risks, financial harm, lost time, and privacy violations, among other claims, on behalf of all U.S. individuals impacted by the breach. The complaint includes counts of negligence, breach of implied contract, unjust enrichment, and requests for injunctive relief, with Lopez demanding class certification, monetary damages, legal fees, and a jury trial. Legal representation is provided by Siri & Glimstad LLP, Milberg PLLC, and Kopelowitz Ostrow P.A. Separately, Cigna previously agreed to a $1.07 million settlement in a separate class action over allegations of misclassifying out-of-network providers as in-network. The current lawsuit remains ongoing.

On April 19, 2012, the California Office of the Attorney General reported a data breach involving Cigna Dental that occurred on March 23, 2012. An unencrypted document containing customers' first names and social security numbers was emailed to an unauthorized personal email address. Approximately UNKN individuals were affected, and the only specified types of information compromised were first names and social security numbers.