Cleveland's University Hospitals, an 18-hospital health system, is still working to fully restore its digital services nearly two weeks after a cybersecurity incident forced it to disconnect its systems from the internet, and it now faces a proposed class-action lawsuit from a patient who alleges that sensitive personal and medical information was stolen in the incident. The health system's MyChart patient portal — the tool patients use to see test results, message their doctors and manage appointments — has remained unavailable since October 22, and University Hospitals has not publicly confirmed whether patient data was compromised or how many people may have been affected.
The incident began on Thursday, October 22, when University Hospitals detected unusual activity on its servers. The system activated its response protocols and, in its own words, disconnected its systems from the internet “out of an abundance of caution,” according to a timeline of the health system's public statements compiled by the advisory firm Withum. The disconnection contained the possible threat, but it also took digital services offline across the system, including MyChart and the public website.
How the outage unfolded, day by day
On the morning of Friday, October 23, University Hospitals said there was no impact on patient care delivery, but warned that digital disruptions could last several days. It directed patients to contact their provider's office directly and to call 866-844-2273 to schedule appointments. By that evening, the system had begun reconnecting to some external partners, but it had also started rescheduling some appointments and elective procedures, and it said the impact would continue into the following week.
On Monday, October 26, University Hospitals publicly confirmed that it had experienced a cybersecurity incident. It reported significant restoration progress over the weekend, but acknowledged challenges that would continue through the week: some locations were struggling to connect to the network, and insurance pre-authorizations — the approvals many procedures need before they can be scheduled or billed — were facing delays. In an October 28 update, the health system said the vast majority of appointments and procedures were continuing as normal, that it was working to restore MyChart access, and that patients should attend scheduled appointments unless contacted by their care teams. With the portal down, staff have been calling patients directly with appointment reminders. As of Monday, November 2, Cleveland Magazine's daily briefing reported that the system's websites and MyChart were still down, a week and a half after the incident began.
The lawsuit: what is alleged, and what is not proven
On October 28, a proposed class-action lawsuit was filed against University Hospitals in the U.S. District Court for the Northern District of Ohio, Becker's Hospital Review reported. The plaintiff, Tanya Darden, is a current University Hospitals patient from Cleveland. The complaint alleges that the health system failed to implement adequate cybersecurity measures to protect patients' personal and medical information, and that sensitive information was stolen during the incident. The complaint alleges, without citing a source, that the incident affected more than 1 million current and former patients, though it elsewhere describes the number of affected patients as hundreds of thousands. The allegations have not been proven in court.
According to the complaint, the information potentially compromised includes names, Social Security numbers, dates of birth, addresses, health insurance information, medication information and treatment information. Ms. Darden alleges that after the incident she began receiving spam calls from callers who identified her by name and asked her to verify personal information, including her date of birth, Social Security number and address, and that she was notified on October 26 of an unauthorized request to access her credit report. The lawsuit alleges that University Hospitals failed to adequately safeguard patient data, train employees on cybersecurity and implement industry-standard security measures, including multifactor authentication, and it claims the system had not begun notifying affected individuals about the alleged breach when the complaint was filed. It brings claims of negligence, breach of implied contract, unjust enrichment and breach of fiduciary duty, and seeks class-action status, a jury trial, damages and injunctive relief.
A spokesperson for University Hospitals told Becker's Hospital Review that the health system does not comment on pending litigation. University Hospitals has said it is investigating the incident with outside experts and is communicating with law enforcement. It has not disclosed the cause or the full scope of the incident.
Attend appointments as scheduled unless your care team contacts you. For scheduling, call 866-844-2273 or contact your provider's office directly. University Hospitals has NOT confirmed that patient data was taken — treat any unsolicited call asking you to verify a Social Security number, date of birth or address as a suspected scam, whether or not it mentions the hospital.
Why one outage reaches so far
The disruption shows how concentrated a modern hospital system's digital risk has become. University Hospitals completed its move to the Epic electronic health record in 2023, converting 5.6 million patient records and its scheduling systems into a single platform at an expected cost of about $400 million, according to Withum's advisory. Consolidation brings real clinical benefits, but when a core platform or its connections go dark, the effects spread at once across patient access, scheduling, authorizations, billing and communication — exactly the pattern patients and staff have reported over the past two weeks, from the silent portal to delayed insurance approvals.
What happens next
University Hospitals has given no timeline for full restoration, and investigations of this kind commonly take weeks. If the investigation finds that protected health information was exposed, federal and state breach-notification rules will set the timing and content of the notices that follow. In court, a judge will first have to decide whether the Darden case can proceed and whether it can be certified as a class action covering other patients. For the region's patients — including the Punjabi and South Asian families across northeast Ohio who use the system — the practical questions remain the two the health system has not yet answered: when MyChart comes back, and whether their information was taken.