MCNA Insurance Settled Class Action Data Breach Lawsuit
The settlement provides reimbursement and monitoring services for nearly 9 million people affected by a 2023 cyberattack.
Updated on Oct. 5, 2026 in Cybersecurity
Live Poll
Do you trust that major companies are doing enough to protect your private personal information?
MCNA Insurance Company has reached a class action settlement following a massive 2023 data breach that exposed the sensitive information of nearly 9 million individuals. The agreement offers eligible class members up to $2,500 for out-of-pocket losses and two years of medical data monitoring.
Why it matters
The settlement addresses claims that the insurer maintained inadequate security protocols, which allowed the LockBit ransomware group to access and publish internal files. It provides a path for victims to recover financial losses stemming from the exposure of their personal health information.
The incident involved unauthorized system access between February 26 and March 7, 2023, during which the LockBit group allegedly demanded a $10 million ransom. The breach resulted in the exfiltration of personal information that was later published online by the attackers.
The players
MCNA Insurance Company
This is a health insurance provider that manages dental and orthodontic benefits for millions of enrollees.
LockBit
This is a prominent and prolific ransomware syndicate known for targeting large enterprises to exfiltrate and publish sensitive data.
The details
The lawsuit alleged that MCNA failed to protect sensitive data, leading to the unauthorized access and subsequent publication of files after the company refused to pay the ransom demand. Eligible class members can now pursue compensation for documented financial damages and enroll in protective monitoring services.
Timeline
Unauthorized system access occurred from February 26 to March 7, 2023.
MCNA discovered the data breach in March 2023.
The deadline for affected individuals to file claims or opt out is October 19, 2026.
A final court hearing to approve the settlement is set for November 16, 2026.
The Tech Race
This incident highlights the growing necessity for robust cybersecurity infrastructure as digital record-keeping replaces legacy paper systems in the healthcare industry. The transition forces insurance providers to defend against sophisticated ransomware syndicates that now view medical data as high-value leverage in digital extortion schemes.
Affected individuals should verify their eligibility to claim up to $2,500 in reimbursement for documented out-of-pocket expenses before the October 2026 deadline. Participants can also secure two years of professional medical data monitoring to help protect against potential identity theft and fraudulent medical claims.
The takeaway
Large-scale data breaches often leave victims vulnerable to long-term identity risks that extend well beyond the immediate loss of personal information. Staying informed about class action settlements and proactively enrolling in provided credit or health monitoring services remains the best defense for affected consumers.
Further reading
For more information on the evolving threat landscape in the healthcare sector, visit our Cybersecurity section.
Live Poll
Do you trust that major companies are doing enough to protect your private personal information?
