INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Baptist Health Data Breach Settlement Gets First Nod from Regulators

| 2026-10-28 10:00 CRITICAL HIGH DATA BREACH
JSON
Executive Summary
AI-generated
A cybercriminal actor gained unauthorized access to the computer systems of Baptist Health Medical Center-Drew County in Arkansas between August 22 and July 8, 2024, compromising the protected health information of approximately 5,207 individuals. The entity behind this attack is unknown at this time. This incident involved a targeted sector within the healthcare industry. The attackers likely exploited vulnerabilities in computer systems to acquire sensitive patient data, including names, addresses, birth dates, diagnoses, treatment information, medical record numbers, and other personal details. As of now, no further updates are available on the current status of the settlement or any potential ongoing investigations into this incident.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope healthhealth
Incident Timeline
‎April 22, 2024
Baptist Health agreed to pay a settlement amount in relation to the previously disclosed data breach incident.
industry Health
General Document Context
‎between April 22, 2024
Up to $400 may be claimed as reimbursement for documented, unreimbursed ordinary losses incurred between April 22, 2024, and December 8, 2026.
financial $400 Entities
Up to $400 may be claimed as reimbursement for documented, unreimbursed ordinary losses incurred between April 22, 2024, and December 8, 2026.
‎July 8, 2024
A class action lawsuit was filed by Latanya Frazier against Baptist Health, alleging the healthcare provider failed to follow industry-standard cybersecurity practices and violated HIPAA safeguards.
industry Health
General Document Context
organisation the HHS Office for Civil Rights
The data breach was reported to the HHS Office for Civil Rights as involving the protected health information of 5,207 individuals.
organisation the Pulaski County Circuit Court
A class action lawsuit was filed in the Pulaski County Circuit Court of Arkansas by plaintiff Latanya Frazier, which was followed by a second putative class action.
organisation Latanya Frazier & Chanta Ringo v.
The two lawsuits were consolidated into a single complaint – Latanya Frazier & Chanta Ringo v. Baptist Health – as they made similar claims.
organisation Baptist Health
The two lawsuits were consolidated into a single complaint – Latanya Frazier & Chanta Ringo v. Baptist Health – as they made similar claims.
organisation the Circuit Court
The consolidated lawsuit is pending in the Circuit Court of Lincoln County, Arkansas.
organisation HIPAA
The lawsuit claimed the lack of appropriate safeguards and failure to follow industry-standard cybersecurity practices violated HIPAA.
organisation HIPAA Journal
Get The FREE HIPAA Compliance Checklist Immediate Delivery of Checklist Link To Your Email Address Please Enter Correct Email Address Your Privacy Respected HIPAA Journal Privacy Policy Baptist Health Medical Center-Drew County denies wrongdoing and disagrees with all claims and contentions in the lawsuit, while the plaintiffs believe their claims are valid.
‎Oct 28, 2026
A class action lawsuit against Baptist Health Medical Center-Drew County has been resolved with a settlement.
industry Health
General Document Context
tactic Data Breach
Baptist Health Data Breach Settlement Gets First Nod Posted By Steve Alder on Oct 28, 2026
organisation Baptist Health Data Breach Settlement Gets
Baptist Health Data Breach Settlement Gets First Nod Posted By Steve Alder on Oct 28, 2026
organisation Baptist Health Medical Center-Drew County
A class action lawsuit against Baptist Health Medical Center-Drew County has been resolved with a settlement that provides reimbursement for documented losses, compensation for lost time, and credit monitoring services.
‎Between August 22 and July 8, 2024
A cybercriminal actor accessed Baptist Health Medical Center-Drew County's computer systems between August 22 and July 8, 2024.
‎November 9, 2026
Individuals wishing to object to the Baptist Health data breach settlement must submit their objections by November 9, 2026.
industry Health
General Document Context
‎December 8, 2026
Up to $400 may be claimed as reimbursement for documented, unreimbursed ordinary losses incurred by individuals between April 22, 2024, and December 8, 2026.
industry Health
General Document Context
financial $400 Entities
Up to $400 may be claimed as reimbursement for documented, unreimbursed ordinary losses incurred between April 22, 2024, and December 8, 2026.
financial $4,000 $ reimbursement
Individuals who experienced fraud or identity theft as a result of the incident may also submit a claim for reimbursement of documented, unreimbursed extraordinary losses up to $4,000 per class member.
‎February 4, 2027
The Baptist Health data breach settlement has received preliminary court approval and a scheduled final fairness hearing for February 4, 2027.
industry Health
General Document Context
financial $1 insurance policy
All class members are entitled to claim two years of single-bureau credit monitoring services, which include a $1 million identity theft insurance policy.
Tactical Metrics
Metrics
financial
400
Financial Impact / Stolen Funds
Up to $400 may be claimed as reimbursement for documented, unreimbursed ordinary losses incurred between April 22, 2024, and December 8, 2026.
Metrics
financial
1,000,000
Insurance Policy
All class members are entitled to claim two years of single-bureau credit monitoring services, which include a $1 million identity theft insurance policy.
Metrics
financial
4,000
$ Reimbursement
Individuals who experienced fraud or identity theft as a result of the incident may also submit a claim for reimbursement of documented, unreimbursed extraordinary losses up to $4,000 per class member.
Intelligence Sources
HIPAA Journal 2026-10-28