Hospital waited a year to notify nearly 60K patients of data breach, sparking class action suit

A class action lawsuit has been filed against Cooper University Health Care, based in Camden, after a data breach potentially exposed the personal information of tens of thousands of current and former patients. The lawsuit alleges that Cooper failed to adequately protect sensitive data and waited a year to notify those affected.

Although the exact number of impacted patients has not been confirmed, the lawsuit claims that more than 57,000 individuals were affected. Cooper, however, stated that it notified individuals whose information was identified during a thorough review of the compromised data.

In a recent press release, Cooper detailed the timeline of the incident. Unusual activity on their network was detected on May 14, 2024, prompting immediate steps to secure their systems. A digital forensics firm was hired to investigate the breach and determine if sensitive data had been compromised. The investigation concluded on March 26, 2025, and notification letters were sent out to potentially affected individuals on May 23, 2025.

Despite Cooper’s assurance that they acted swiftly in identifying the individuals whose data was involved, the lawsuit argues that the delay in notification left patients vulnerable for an extended period. The complaint alleges that the health system waited over a year after becoming aware of the breach to notify impacted individuals, depriving them of the opportunity to protect themselves in a timely manner.

The compromised data may have included a range of personal information such as names, addresses, dates of birth, driver’s license numbers, Social Security numbers, medical information, and health insurance details. Cooper emphasized that not all data elements were exposed for every individual and that there is no evidence of actual misuse of the information involved in the breach.

Ana Hernandez, a Camden resident and Cooper patient, is the lead plaintiff in the case. She claims to have experienced fear, anxiety, and stress as a result of the breach, noting an increase in spam calls, text messages, and emails.

The lawsuit alleges negligence, breach of contract, and unjust enrichment on the part of Cooper and seeks monetary damages as well as demands for stronger data protection measures. Cooper has informed the FBI, the U.S. Department of Health and Human Services, and consumer reporting agencies about the breach and is offering free identity protection services through IDX to those impacted.

Individuals affected by the breach can contact representatives for identity protection services and verification of eligibility for such services. Cooper maintains that they acted promptly once the breach was identified and conducted a thorough review to address the issue.