Hackers reached a network holding patient information during a July 2025 intrusion at Susan B. Allen Memorial Hospital in Butler, Kansas, and the acute-care facility has now agreed to settle the resulting class action.
Early notices put the toll at up to 12,097 people. The HHS Office for Civil Rights breach portal now lists 11,866 individuals whose protected health information was compromised.
Four proposed class actions consolidated into one complaint, In Re: Susan B. Allen Data Security Litigation, in Butler County District Court. Plaintiffs said the hospital lacked reasonable safeguards, and the hospital denies wrongdoing, saying it settled to avoid further cost and delay.
The agreement centers on two years of monitoring for identity theft, plus smaller cash reimbursements for documented losses and time spent sorting out the fallout. Claims close November 12, and a judge weighs final approval December 7.
Small rural hospitals stay attractive to attackers. They hold rich clinical data yet run lean security teams.
