RUSH UNIVERSITY MEDICAL CENTER was the subject of a data breach notification filed with the IL Attorney General. The AG filing was recorded on October 30, 2025.
Data Exposed
RUSH UNIVERSITY MEDICAL CENTER was the subject of a data breach notification filed with the IL Attorney General. The AG filing was recorded on October 30, 2025.
Rush University Medical Center stands as one of the premier academic health systems in the Midwest, renowned for its cutting-edge patient care, advanced biomedical research, and extensive medical education programs. As a major tertiary and quaternary care provider operating large hospital facilities, outpatient clinics, and specialized research centers, the institution maintains vast repositories of deeply sensitive information. To deliver comprehensive medical treatment, coordinate specialized care, process insurance claims, and manage complex clinical trials, Rush University Medical Center routinely collects and retains extensive personal records, highly confidential health histories, and proprietary administrative data for hundreds of thousands of patients, employees, and research participants across Illinois and the broader region. In 2025, Rush University Medical Center reported a significant security incident to the Illinois Attorney General, highlighting the pervasive and escalating cyber threats facing the healthcare sector. Healthcare institutions are prime targets for malicious actors due to the immense value of medical credentials and personal identifiers on the dark web. Incidents of this nature typically involve sophisticated cyberattacks such as ransomware deployments, unauthorized intrusions into internal clinical databases, or compromises within third-party vendor ecosystems that support electronic health record infrastructure. These breaches often exploit vulnerabilities in network perimeters or administrative controls, allowing unauthorized third parties to infiltrate systems and potentially exfiltrate vast amounts of sensitive digital assets before detection occurs. The exposure resulting from a breach at a major healthcare provider like Rush University Medical Center compromises some of the most private information an individual possesses. Affected files frequently contain a combination of full legal names, dates of birth, Social Security numbers, detailed medical record numbers, health insurance policy identifiers, and comprehensive diagnosis, treatment, and prescription histories. Unlike a standard retail breach involving credit card numbers that can be easily cancelled, the compromise of immutable medical and biometric data creates lifelong risks. Victims face severe, prolonged threats of medical identity theft—where unauthorized actors obtain treatment using a victim's insurance, corrupting vital clinical records—alongside traditional financial fraud, tax refund fraud, and targeted phishing schemes that leverage intimate details regarding a patient's health status to maximize deception. As a covered entity handling protected health information, Rush University Medical Center was bound by strict statutory and regulatory mandates to safeguard the data entrusted to its care. Under the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and applicable Illinois state consumer protection statutes, the medical center had an affirmative legal obligation to implement robust administrative, physical, and technical safeguards. These include maintaining state-of-the-art encryption, conducting regular risk assessments, enforcing stringent access controls, and actively monitoring network traffic for anomalous behavior. The occurrence of a reportable data breach strongly suggests a potential failure in these foundational security duties, indicating that existing protocols proved inadequate to withstand modern cyber threats. Receiving an official data breach notification letter from Rush University Medical Center carries substantial legal significance, serving as formal acknowledgement by the institution that an individual's private records were compromised due to corporate negligence. Under modern class action jurisprudence, receipt of this letter establishes the legal standing necessary to pursue litigation against the organization for failing to protect sensitive data, even before financial or medical fraud materializes. Plaintiffs in these actions seek accountability, enhanced cybersecurity measures, and financial restitution for the time, anxiety, and monetary outlays required to mitigate ongoing risks. Our law firm evaluates these data breach cases on a strict contingency fee basis, meaning affected individuals pay nothing out of pocket, and legal fees are recovered only if a successful recovery or settlement is achieved. As a cornerstone of healthcare and medical education in Illinois, Rush University Medical Center manages an immense scale of operations, amplifying the downstream impact of any security failure. The sheer volume of patient records, clinical data streams, and employee files concentrated within their network means that a single point of failure can expose countless vulnerable individuals to severe privacy violations. In the wake of the 2025 reporting, affected class members have the right to demand rigorous institutional accountability and ensure that healthcare providers prioritize comprehensive data security as an essential component of patient trust and regulatory compliance.
Based on the data types reported, affected individuals face:
Your SSN is the master key to your identity. Once exposed, criminals can open new lines of credit, take out loans, or file taxes in your name.
Combined with a name and other leaked data, date of birth helps criminals pass identity verification questions at banks and government agencies.
What the Illinois Personal Information Protection Act (PIPA) and federal statutes entitle you to recover:
The hours spent responding to a data breach — canceling accounts, contacting credit bureaus, updating passwords, and investigating fraud — represent compensable economic harm in data breach litigation.
Once your SSN is exposed, protection becomes an ongoing expense. Plaintiffs in data breach settlements have recovered costs for credit freezes, identity protection subscriptions, and time spent dealing with fraudulent accounts — sometimes covering multiple years of exposure.
HIPAA violations carry civil penalties between $100 and $50,000 per violation. Where a healthcare organization's negligence led to the exposure of protected health information, class members may recover statutory damages in addition to actual losses.
Data breach victims regularly report anxiety, loss of sleep, and ongoing fear of identity theft. These non-economic harms are cognizable injuries in data breach litigation, particularly in cases involving SSN or medical record exposure.
Note: an attorney general breach filing does not by itself establish a settlement fund, a payment amount, or a claim deadline. If an official settlement notice is later issued, rely on that notice for payment details and deadlines.
No. Under Illinois Personal Information Protection Act (PIPA) and federal law, the unauthorized exposure of your personal data — regardless of whether it has been actively misused — can be sufficient grounds for a claim. The breach itself is the injury.
Nothing. The Law Office of David S. Harris handles data breach cases on contingency — you pay zero upfront and owe nothing unless compensation is recovered.
Immediately place a free credit freeze at all three bureaus (Equifax, Experian, TransUnion). A freeze blocks new accounts from being opened in your name. Then file a complaint with the FTC at IdentityTheft.gov and contact our office — SSN exposure is one of the most serious breach types.
If RUSH UNIVERSITY MEDICAL CENTER is a covered healthcare entity or business associate under HIPAA, affected patients have additional rights — including the right to an HHS complaint. These HIPAA violations also strengthen civil damages claims. Consult an attorney to understand your full remedies.
Statutes of limitations for data breach claims vary by state but typically run 2–4 years. Depending on when you learned of the breach, you may still have time. Contact our office for a free eligibility review — there is no cost to find out.
Accepting free credit monitoring from RUSH UNIVERSITY MEDICAL CENTER does not waive your right to pursue legal action unless you signed a specific release waiving claims. In most cases, victims who accepted monitoring can still file.
Not necessarily. Many data breach victims are never notified directly. If your personal information was held by RUSH UNIVERSITY MEDICAL CENTER during the relevant period, you may still qualify even without receiving a letter. A free eligibility review can confirm your status.
Received a notification letter from RUSH UNIVERSITY MEDICAL CENTER?
What it means and what to do next.
RUSH UNIVERSITY MEDICAL CENTER breach?
Free case review · No fee unless you win