Just received a notice letter? Cases are filed first-come, first-served. You may be entitled to compensation.
RUSH UNIVERSITY MEDICAL CENTER was the subject of a data breach notification filed with the IL Attorney General. The AG filing was recorded on February 17, 2026.
From the AG filing description
Rush University System for Health and its flagship Rush University Medical Center constitute one of the premier academic medical systems and healthcare providers in the Midwest. Serving hundreds of thousands of patients annually across Illinois, Rush manages an intricate digital infrastructure dedicated to clinical care, biomedical research, and medical education. Because of this vital mission, the institution routinely collects, processes, and stores vast repositories of highly sensitive information. This includes not only comprehensive electronic health records detailing patient diagnoses, treatments, and clinical notes, but also extensive administrative, billing, and personnel records necessary to operate a massive, multi-facility healthcare enterprise. In 2026, Rush University Medical Center reported a major security incident to the Illinois Attorney General, placing patients, employees, and affiliated individuals on high alert. In the healthcare sector, data breaches typically stem from sophisticated cyberattacks, including ransomware deployments, unauthorized intrusions into legacy clinical databases, or compromises within third-party vendor ecosystems that supply software and administrative services to hospitals. These incidents often expose vulnerabilities in network perimeters where vast amounts of interconnected medical and personal data reside, leaving organizations scrambling to secure their systems and determine the full scope of unauthorized access. The exposure of healthcare-related data carries uniquely severe risks for affected individuals. A compromise at an institution like Rush typically threatens sensitive categories of information, including full names, dates of birth, Social Security numbers, medical record numbers, health insurance policy details, and specific clinical treatment records. Unlike financial credentials that can be easily replaced, immutable medical and demographic data cannot be changed. When exposed, this information can be exploited to facilitate targeted medical identity theft—where bad actors fraudulently obtain healthcare services using a victim's insurance—as well as sophisticated phishing schemes, tax fraud, and unauthorized financial account takeovers. As a covered entity under the Health Insurance Portability and Accountability Act (HIPAA), alongside state-level data privacy statutes, Rush University Medical Center had strict legal obligations to safeguard the electronic protected health information entrusted to its care. These regulatory frameworks require healthcare providers to implement robust administrative, physical, and technical safeguards, including continuous network monitoring, rigorous vendor risk management, and state-of-the-art encryption. The occurrence of a data breach of this magnitude serves as a strong indicator that these mandatory security protocols may have failed, raising significant questions regarding whether the institution adhered to the high standard of care required under federal and state law. Receiving an official data breach notification letter from Rush University Medical Center is a formal acknowledgement that your private information was compromised due to institutional security shortcomings. Legally, the receipt of this letter establishes the concrete injury and standing necessary to participate in a class action lawsuit aimed at holding the healthcare provider accountable. Under modern data privacy litigation standards, affected individuals do not need to prove that they have already suffered actual financial loss or medical fraud to seek legal recourse; the mere increased risk of future harm is sufficient. Our law firm is currently investigating potential legal claims on behalf of all impacted individuals, and we handle these cases on a strict contingency fee basis, meaning you pay nothing out of pocket unless we successfully recover compensation on your behalf. Given the elite status of Rush University Medical Center and the sheer volume of patients and personnel that rely on its services, a security incident of this scale represents a critical failure in the protection of confidential medical and personal data. Large academic medical centers are prime targets for cybercriminals precisely because of the immense value and depth of the records they maintain. When institutional defenses crumble, the burden of remediation unfairly falls on the unsuspecting patients and employees whose most intimate details have been exposed. Our legal team is dedicated to ensuring that victims receive the justice, accountability, and long-term protection they deserve.
Based on the data types reported in this filing:
Your SSN is the master key to your identity. Once exposed, criminals can open new lines of credit, take out loans, or file taxes in your name.
Combined with a name and other leaked data, date of birth helps criminals pass identity verification questions at banks and government agencies.
You may have been affected by the RUSH UNIVERSITY MEDICAL CENTER data breach if:
Common categories of compensation in data breach class actions
Courts recognize that the time spent monitoring accounts, placing credit freezes, and dealing with the aftermath of a breach has real economic value. This category of damages is recoverable even without direct financial loss.
Professional credit monitoring services cost $10–$40 per month. Identity theft restoration services, if needed, can cost hundreds of hours and thousands of dollars. Courts have awarded these costs as direct damages in SSN breach cases.
HIPAA violations carry civil penalties between $100 and $50,000 per violation. Where a healthcare organization's negligence led to the exposure of protected health information, class members may recover statutory damages in addition to actual losses.
Data breach victims regularly report anxiety, loss of sleep, and ongoing fear of identity theft. These non-economic harms are cognizable injuries in data breach litigation, particularly in cases involving SSN or medical record exposure.
Note: an attorney general breach filing does not by itself establish a settlement fund, a payment amount, or a claim deadline. If an official settlement notice is later issued, rely on that notice for payment details and deadlines.
Applicable State Law
This breach was reported under the Illinois Personal Information Protection Act (PIPA), which mandates notification and establishes your right to seek damages.
No. Under Illinois Personal Information Protection Act (PIPA) and federal law, the unauthorized exposure of your personal data — regardless of whether it has been actively misused — can be sufficient grounds for a claim. The breach itself is the injury.
Nothing. The Law Office of David S. Harris handles data breach cases on contingency — you pay zero upfront and owe nothing unless compensation is recovered.
Immediately place a free credit freeze at all three bureaus (Equifax, Experian, TransUnion). A freeze blocks new accounts from being opened in your name. Then file a complaint with the FTC at IdentityTheft.gov and contact our office — SSN exposure is one of the most serious breach types.
If RUSH UNIVERSITY MEDICAL CENTER is a covered healthcare entity or business associate under HIPAA, affected patients have additional rights — including the right to an HHS complaint. These HIPAA violations also strengthen civil damages claims. Consult an attorney to understand your full remedies.
State statutes of limitations for data breach claims typically run 2–4 years from the date of the breach or its discovery. Because this breach was recently disclosed, the window is open — but acting early preserves your options and strengthens the case.
Accepting free credit monitoring from RUSH UNIVERSITY MEDICAL CENTER does not waive your right to pursue legal action unless you signed a specific release waiving claims. In most cases, victims who accepted monitoring can still file.
Not necessarily. Many data breach victims are never notified directly. If your personal information was held by RUSH UNIVERSITY MEDICAL CENTER during the relevant period, you may still qualify even without receiving a letter. A free eligibility review can confirm your status.
Received a notification letter from RUSH UNIVERSITY MEDICAL CENTER?
Read our dedicated guide — what the letter means and what to do.
Learn how to participate in the class action and what compensation you may be entitled to.
Join the Class Action →Use our verification tool to confirm your letter matches this official AG filing.
Verify My Notice LetterThis case file references a public filing made with the state filing in IL. This website is not affiliated with, endorsed by, or operated by any state government agency.
RUSH UNIVERSITY MEDICAL CENTER breach?
Free case review · No fee unless you win