The Endeavor Health lawsuit is one of the biggest healthcare data breach cases moving through federal court in 2026. Hundreds of thousands of patients had their personal and medical information exposed. That breach sparked a wave of class action filings.
If you got a notification letter from Endeavor Health, you’re likely wondering what happens next. This article breaks down the 2026 case status, who qualifies, how much you might receive, and exactly how to file a claim.
Here’s one number worth knowing: more than 800,000 patients may have been affected. That makes this one of the largest hospital system breaches in recent Illinois history.
You’ll find timelines, payout estimates, eligibility rules, and side-by-side comparisons with similar cases. Everything is current as of 2026.
What Is the Endeavor Health Lawsuit
The Endeavor Health lawsuit is a series of legal actions filed against the Illinois-based hospital system after a data breach exposed sensitive patient records. Plaintiffs claim the organization failed to protect private health and financial information from unauthorized access.
Endeavor Health was formed from the merger of NorthShore University HealthSystem and Edward-Elmhurst Health. The combined entity operates hospitals and outpatient facilities across the Chicago suburbs. When the breach occurred, it impacted patients across multiple locations.
The lawsuits allege that Endeavor Health did not have adequate cybersecurity measures in place. Plaintiffs say the organization stored patient data without proper encryption. They argue this amounted to negligence.
| Detail | Info |
|---|---|
| Defendant | Endeavor Health (formerly NorthShore/Edward-Elmhurst) |
| Location | Northern District of Illinois |
| Type of Case | Data breach, class action |
| Patients Affected | 800,000+ |
| Data Exposed | Medical records, SSNs, financial info |
Several law firms filed individual complaints that were later consolidated. The consolidated case is being handled in the U.S. District Court for the Northern District of Illinois.
At its core, this case asks a simple question: did Endeavor Health do enough to protect your data? The plaintiffs say no.
Endeavor Health Lawsuit Update 2026
As of 2026, the Endeavor Health lawsuit is in the active litigation phase with settlement discussions underway. The court has certified the class, meaning the case can proceed on behalf of all affected patients as a group.
Discovery wrapped up in late 2025. Both sides exchanged documents, deposition transcripts, and expert reports during that process. Plaintiffs’ attorneys gathered internal emails showing that Endeavor Health had been warned about cybersecurity gaps before the breach.
Settlement mediation sessions were scheduled for early 2026. These talks happen behind closed doors, so exact figures have not been made public yet. If mediation fails, a trial date could be set for late 2026 or early 2027.
Key 2026 milestones to watch:
- Class certification confirmed
- Discovery completed
- Settlement mediation in progress
- Potential trial date: Q4 2026 or Q1 2027
- Claims filing window expected to open after any settlement approval
The judge overseeing the case has pushed both sides to reach a resolution. That pressure typically speeds things up. Based on how similar cases have played out, a settlement announcement could come within the next several months.
Patients do not need to take any action right now unless a formal claims process opens. When it does, there will be a specific deadline and a simple online form to submit.
Endeavor Health Data Breach Lawsuit Explained
The Endeavor Health data breach lawsuit centers on a cyberattack that gave unauthorized parties access to patient databases. Hackers accessed systems containing protected health information, Social Security numbers, addresses, dates of birth, and insurance details.
This wasn’t just a minor security hiccup. The breach exposed the kind of information that identity thieves can use for years. Medical identity theft is especially dangerous because it can lead to fraudulent insurance claims, corrupted health records, and financial ruin.
The attack reportedly went undetected for several weeks before Endeavor Health discovered the intrusion. During that window, patient data may have been copied or sold on dark web marketplaces.
Plaintiffs argue three main points:
- Endeavor Health stored sensitive data without adequate safeguards
- The organization failed to detect the breach in a reasonable timeframe
- Patients were not notified quickly enough to protect themselves
The delay in notification is a critical issue. Under Illinois law and HIPAA regulations, healthcare organizations must notify affected individuals within a specific timeframe. Plaintiffs say Endeavor Health waited too long.
Every day that passed between the breach and the notification was a day patients couldn’t freeze their credit, monitor their accounts, or take steps to prevent identity theft.
Key Takeaway: The Endeavor Health lawsuit stems from a massive data breach affecting 800,000+ patients, and the case is actively moving toward a potential settlement in 2026.
Endeavor Health Class Action Lawsuit Details
The Endeavor Health class action lawsuit consolidates individual claims from thousands of patients into one case. This allows a single legal team to represent everyone who was harmed by the data breach.
Class action status was granted after plaintiffs demonstrated that the claims share common questions of law and fact. The core question for every class member is the same: did Endeavor Health’s negligence cause your data to be exposed?
The named plaintiffs in the case are patients who received breach notification letters. They represent the broader class of all individuals whose data was compromised.
| Class Action Detail | Status |
|---|---|
| Class Certified | Yes |
| Lead Counsel Appointed | Yes |
| Number of Named Plaintiffs | Multiple |
| Class Size | 800,000+ potential members |
| Opt-Out Option | Yes, with deadline TBD |
If you received a notification letter, you are likely an automatic class member. You don’t need to do anything to “join” the class. You are already included unless you choose to opt out.
Opting out means giving up your share of any class settlement. People typically opt out only if they plan to file their own individual lawsuit. For most affected patients, staying in the class action is the simplest path to compensation.
The class action structure means attorneys handle everything. You won’t pay legal fees upfront. Lawyers get paid from the settlement fund if they win.
What Happened in the Endeavor Health Patient Data Breach
The Endeavor Health patient data breach occurred when cybercriminals infiltrated the hospital system’s electronic health records and administrative databases. The attack compromised records belonging to patients across all Endeavor Health facilities.
The breach was not a single-point failure. Investigators found that the attackers used a combination of phishing emails and exploited software vulnerabilities to gain access. Once inside, they moved laterally through the network for weeks.
Types of data exposed included:
- Full legal names
- Social Security numbers
- Dates of birth
- Home addresses
- Health insurance policy numbers
- Medical record numbers
- Diagnosis and treatment information
- Financial account details
That combination of personal, medical, and financial data is sometimes called the “full identity package.” It’s the most valuable type of stolen data because it enables multiple forms of fraud.
Think of it like someone stealing not just your wallet but also your medical chart and your tax return all at once. The damage potential is enormous.
Endeavor Health reported the breach to the U.S. Department of Health and Human Services Office for Civil Rights, as required by HIPAA. The report confirmed that the breach affected a population well above the 500-person threshold that triggers public disclosure requirements.
Patients across Skokie, Evanston, Highland Park, Naperville, and Elmhurst were among those impacted.
Endeavor Health Settlement Overview
The Endeavor Health settlement is the anticipated resolution of the class action lawsuit through a negotiated agreement rather than a full trial. Settlement talks are underway in 2026, though no final deal has been publicly announced yet.
In most healthcare data breach class actions, settlements include three components. First, a cash fund for direct payments to affected patients. Second, free credit monitoring and identity theft protection services. Third, changes to the defendant’s data security practices.
Based on precedent from comparable cases, the total settlement fund could range from $10 million to $50 million or more. The exact amount depends on the strength of the evidence, the number of class members, and how aggressively both sides negotiate.
| Settlement Component | Likely Included |
|---|---|
| Cash Payments to Class Members | Yes |
| Credit Monitoring (2 to 3 years) | Yes |
| Identity Theft Insurance | Yes |
| Cybersecurity Improvements | Yes |
| Attorney Fees (from fund) | Yes |
Once a settlement is reached, the court must grant preliminary approval. After that, class members receive formal notice and a window to file claims, object, or opt out. Final approval comes after a fairness hearing where the judge reviews everything.
The entire process from settlement announcement to first payments typically takes 6 to 12 months. Patience matters here, but the process does eventually deliver results.
Key Takeaway: A settlement in the Endeavor Health case is expected to include cash payments, credit monitoring, and security improvements, with total fund estimates ranging from $10 million to $50 million.
Endeavor Health Data Breach Settlement Amount
The Endeavor Health data breach settlement amount has not been finalized yet, but early estimates based on comparable healthcare breach cases suggest a total fund between $15 million and $50 million. Individual payouts will depend on the total fund size divided among participating class members.
In similar cases involving hospital systems, individual payments have ranged from $50 to $500 for basic claims. Patients who can document actual financial losses from the breach, like out-of-pocket costs for credit monitoring, fraudulent charges, or time spent dealing with identity theft, typically receive higher payments.
Estimated payout tiers:
- Basic claim (no proof of harm): $50 to $150
- Standard claim (some documented losses): $150 to $500
- Enhanced claim (significant documented harm): $500 to $5,000+
These are estimates based on precedent. Actual amounts will be confirmed when the settlement is approved. The claims administrator will publish specific payment categories and documentation requirements.
One factor that affects your individual payout is participation rate. If only 10% of eligible patients file claims, each person gets more. If 50% file, the per-person amount drops.
That’s why filing early and with documentation matters. People who submit thorough claims with receipts, bank statements, and records of time spent on identity protection consistently receive higher payments.
Endeavor Health Lawsuit Payout Expectations
Endeavor Health lawsuit payouts are expected to begin after settlement approval, likely in the second half of 2026 or early 2027. The exact timing depends on how quickly the court approves the deal and how many claims are filed.
Don’t expect a life-changing windfall. Data breach settlements are designed to compensate for actual harm and inconvenience, not to make you rich. The realistic range for most claimants is $50 to $500.
However, some categories of claimants could receive substantially more. If you were a victim of identity theft that you can directly trace back to the Endeavor Health breach, your claim could be worth thousands.
| Claim Type | Estimated Payout | Documentation Needed |
|---|---|---|
| Basic (no documented harm) | $50 to $150 | Proof of class membership only |
| Documented out-of-pocket costs | $150 to $500 | Receipts, bank statements |
| Identity theft victim | $500 to $5,000+ | Police reports, fraud records |
| Time spent on remediation | $25/hour (capped) | Personal log of hours |
Payments are typically issued by check or electronic transfer. The claims administrator handles distribution. You won’t need to chase anyone down.
Attorney fees come out of the total settlement fund before distribution. The standard is 25% to 33% of the fund. That means if the settlement is $30 million, attorneys might take $7.5 million to $10 million. The rest goes to class members and administration costs.
How Much Will I Get From the Endeavor Health Lawsuit
Most class members will receive between $50 and $500 from the Endeavor Health lawsuit, depending on their claim type and supporting documentation. Patients who experienced actual identity theft or financial fraud may receive significantly more.
Your payout is not automatic. You must file a claim form when the window opens. If you do nothing, you get nothing, even though you’re technically part of the class.
Three things determine your specific payout:
- Whether you can prove membership in the class (a notification letter or records showing you were an Endeavor Health patient)
- Whether you have documented out-of-pocket expenses related to the breach
- Whether you experienced identity theft or fraud as a direct result
The highest payouts go to people with the best documentation. Save every receipt. Keep records of time spent on phone calls with banks, credit bureaus, or insurance companies. Note any fraudulent charges, even if your bank reversed them.
If you paid for your own credit monitoring service before Endeavor Health offered one, that cost is reimbursable. If you had to pay for a credit freeze or unfreeze, save that receipt too.
Think of your claim like a tax return. The more organized your paperwork, the better your outcome.
Key Takeaway: Individual payouts from the Endeavor Health lawsuit are estimated at $50 to $500 for most claimants, with documented identity theft victims potentially receiving $5,000 or more.
Who Qualifies for the Endeavor Health Lawsuit
You qualify for the Endeavor Health lawsuit if your personal or medical information was compromised in the data breach. The primary indicator is whether you received a breach notification letter from Endeavor Health.
Qualification is broader than most people realize. You don’t need to prove that someone actually stole your identity. The mere fact that your data was exposed is enough to make you a class member.
You likely qualify if:
- You received a breach notification letter from Endeavor Health
- You were a patient at any Endeavor Health facility during the relevant time period
- Your records were stored in the compromised database systems
- You were a patient at NorthShore University HealthSystem or Edward-Elmhurst Health before the merger
You may not qualify if:
- You were never a patient at any Endeavor Health or predecessor facility
- Your data was not stored in the affected systems
- You opted out of the class action
Even if you never received a notification letter, you might still qualify. Some letters go to old addresses or get lost in the mail. If you were a patient at any of the affected facilities, it’s worth checking your eligibility through the claims process.
The class definition will be formally published when the settlement is announced. At that point, the exact criteria will be crystal clear.
Endeavor Health Lawsuit Eligibility Requirements
Endeavor Health lawsuit eligibility requires that your protected health information or personally identifiable information was part of the compromised dataset. The class definition covers patients whose data was accessed during the breach window.
| Eligibility Factor | Requirement |
|---|---|
| Patient Status | Must have been an Endeavor Health patient |
| Data Exposure | Your records must have been in the affected system |
| Notification Letter | Helpful but not strictly required |
| Geographic Location | Primarily Illinois, but patients from any state qualify |
| Time Period | Patients with records during the breach window |
| Proof of Harm | Not required for basic claims |
You do not need to hire a lawyer to be eligible. Class members are automatically included. The legal team represents everyone in the class.
Minors whose records were exposed are also eligible. A parent or guardian can file a claim on their behalf. This is important because pediatric patients often don’t discover identity theft issues until they turn 18 and apply for credit.
If you’ve moved since you were a patient, your eligibility doesn’t change. The breach affected records in the database regardless of where you live now. A patient who moved from Illinois to Florida is just as eligible as someone still living in Skokie.
Endeavor Health Breach Notification: What It Means
The Endeavor Health breach notification is a formal letter sent to patients whose data was compromised. Receiving this letter confirms that your personal information was part of the breach and that you are a potential class member.
Under HIPAA and Illinois state law, healthcare organizations must notify affected individuals within 60 days of discovering a breach. The notification must describe what happened, what information was involved, and what steps patients can take to protect themselves.
Your notification letter should include:
- A description of the breach incident
- The types of data that were exposed
- Steps Endeavor Health is taking in response
- An offer of free credit monitoring services
- Contact information for questions
- Reference numbers or enrollment codes
If you received this letter, keep it. It’s your proof of class membership. Store it with your other important documents. You’ll likely need it or the reference number when you file your claim.
The letter may also include instructions for enrolling in free credit monitoring. Take advantage of this even if you plan to file a claim later. The two are separate. Credit monitoring protects you now. A claim compensates you later.
Some patients received email notifications instead of physical letters. Both carry the same legal weight.
Key Takeaway: If you received a breach notification from Endeavor Health, you are likely an automatic class member and should keep that letter as proof for your future claim.
How to File an Endeavor Health Lawsuit Claim
To file an Endeavor Health lawsuit claim, you will need to complete a claims form through the official settlement website once the court approves the settlement. The claims process has not officially opened yet as of early 2026, but preparation now saves time later.
When the process opens, filing will typically involve these steps:
- Visit the official settlement website (the URL will be included in the court-approved notice)
- Complete the online claims form with your personal information
- Provide your notification letter reference number or other proof of class membership
- Select your claim tier (basic, documented losses, or identity theft)
- Upload supporting documentation if filing for enhanced compensation
- Submit the form before the filing deadline
Documents to gather now:
- Endeavor Health breach notification letter
- Records of any fraudulent activity on your accounts
- Receipts for credit monitoring services you purchased
- Bank or credit card statements showing unauthorized charges
- Police reports if you filed one for identity theft
- A personal log of time spent dealing with breach-related issues
The entire process is designed to be simple. Most people complete it in 15 to 20 minutes. You won’t need a lawyer to file. You won’t need to appear in court.
If you prefer paper forms, those will also be available. You can request one from the claims administrator by phone or mail.
Endeavor Health Data Breach: What to Do Now
Right now, before the settlement claims process opens, you should take immediate steps to protect yourself from identity theft. The single most important thing is freezing your credit with all three major bureaus.
Immediate action steps:
- Freeze your credit with Equifax, Experian, and TransUnion (free by law)
- Enroll in the free credit monitoring offered by Endeavor Health
- Review your medical records for any treatments or prescriptions you don’t recognize
- Check your insurance statements for claims you didn’t make
- Monitor your bank accounts for unusual activity
- Set up fraud alerts on all financial accounts
A credit freeze is the most effective single action. It prevents anyone from opening new accounts in your name. You can temporarily lift it when you need to apply for credit yourself.
Medical identity theft is harder to spot than financial identity theft. Someone might use your insurance to get medical care, filling your records with incorrect diagnoses and treatments. That can affect your future care and insurance rates.
Request a copy of your medical records from Endeavor Health. Compare them to your actual treatment history. Report any discrepancies immediately.
Also file an identity theft report with the Federal Trade Commission. This creates a formal record that can help you dispute fraudulent accounts and support your claim for enhanced compensation later.
Endeavor Health Lawsuit Deadline You Need to Know
The Endeavor Health lawsuit deadline for filing claims has not been officially set yet. Once the settlement receives preliminary court approval, a specific claims deadline will be announced, typically giving class members 60 to 120 days to submit their forms.
| Deadline Type | Expected Timeline |
|---|---|
| Settlement Announcement | Mid-2026 (projected) |
| Preliminary Approval | 30 to 60 days after announcement |
| Claims Filing Window | 60 to 120 days after approval |
| Opt-Out Deadline | Same as claims window |
| Objection Deadline | Same as claims window |
| Final Approval Hearing | 30 to 90 days after claims window closes |
| First Payments | 60 to 120 days after final approval |
Missing the deadline means forfeiting your right to compensation from the settlement fund. There are usually no extensions. Courts enforce these deadlines strictly.
The opt-out deadline runs on the same schedule. If you want to pursue your own individual lawsuit instead of accepting the class settlement, you must formally opt out before this date. Once you miss it, you’re bound by whatever the class receives.
Set a calendar reminder. When the settlement is announced, major legal news outlets will cover it. The claims administrator will also send notices by mail and email to known class members.
Don’t wait until the last week. Filing systems can get overwhelmed near deadlines. Early filers also tend to have smoother experiences with the claims administrator.
Key Takeaway: The claims filing deadline has not been set yet, but once announced, you’ll have a limited window of 60 to 120 days to file. Don’t miss it.
Endeavor Health Negligence Lawsuit: Legal Theories
The Endeavor Health negligence lawsuit rests on the legal argument that the hospital system failed to meet its duty of care in protecting patient data. Negligence is the primary legal theory, but it’s not the only one plaintiffs are pursuing.
Legal theories in the case include:
- Negligence: Endeavor Health had a duty to protect patient data and breached that duty through inadequate security measures
- Negligence per se: Violation of HIPAA and state data protection statutes creates an automatic presumption of negligence
- Breach of implied contract: Patients entrusted their data to Endeavor Health with the reasonable expectation it would be kept safe
- Unjust enrichment: Endeavor Health collected and stored patient data, profiting from the relationship, without providing adequate protection
- Violation of the Illinois Consumer Fraud and Deceptive Business Practices Act: Endeavor Health’s privacy representations were misleading
Each theory supports a different type of damages. Negligence claims cover actual financial losses. Consumer fraud claims can include statutory damages, which are set amounts per violation regardless of actual harm.
The strongest claims typically stack multiple theories together. Plaintiffs who can show both negligence and a consumer protection violation tend to receive higher settlements.
Illinois is a particularly strong state for data breach plaintiffs. The Illinois Biometric Information Privacy Act (BIPA) has created a legal culture where courts take data privacy seriously. While BIPA doesn’t directly apply here, the overall judicial climate favors consumer protection.
Endeavor Health vs Similar Data Breach Settlements
The Endeavor Health case compares favorably to other major healthcare data breach settlements in terms of class size and potential payout. Looking at precedent helps set realistic expectations for what affected patients might receive.
| Case | Patients Affected | Settlement Amount | Per-Person Payout |
|---|---|---|---|
| Advocate Aurora Health (2023) | 3 million | $12.25 million | $50 to $500 |
| CommonSpirit Health (2024) | 623,000 | $6.25 million (proposed) | $50 to $250 |
| HCA Healthcare (2024) | 11 million | Pending | TBD |
| Premera Blue Cross (2020) | 10.6 million | $74 million | $50 to $10,000 |
| Endeavor Health (2026) | 800,000+ | $15M to $50M (estimated) | $50 to $500+ (estimated) |
The Premera Blue Cross settlement stands out because it awarded higher per-person amounts to claimants who documented identity theft. That case set a benchmark that plaintiffs’ attorneys in the Endeavor Health case are likely using as a reference point.
Smaller class sizes generally mean higher per-person payouts. With around 800,000 affected patients, the Endeavor Health class is mid-sized compared to these precedents. That’s actually favorable for individual payouts.
Another factor is geography. Illinois courts have a track record of approving generous data breach settlements. The state’s consumer protection laws give plaintiffs extra leverage that doesn’t exist in every jurisdiction.
Based on these comparisons, a total settlement between $15 million and $50 million seems realistic. Individual payouts will likely mirror the $50 to $500 range seen in similar cases, with higher amounts for documented harm.
Key Takeaway: Based on similar healthcare data breach cases, Endeavor Health claimants can realistically expect $50 to $500 per person, with documented identity theft victims receiving significantly more.
Frequently Asked Questions
Is there a class action lawsuit against Endeavor Health in 2026?
Yes, there is an active class action lawsuit against Endeavor Health in 2026.
The case involves a data breach that exposed the personal and medical records of over 800,000 patients.
Settlement negotiations are currently underway in the U.S. District Court for the Northern District of Illinois.
How much money can I get from the Endeavor Health data breach settlement?
Most class members can expect between $50 and $500.
The exact amount depends on whether you can document financial losses from the breach.
Patients who experienced identity theft could receive $5,000 or more with proper documentation.
What is the deadline to file a claim in the Endeavor Health lawsuit?
The claims filing deadline has not been officially announced yet.
Once the settlement receives court approval, class members will have 60 to 120 days to file.
Watch for a formal notice by mail or email with the exact date.
Do I need a lawyer to join the Endeavor Health class action?
No, you do not need to hire your own lawyer.
Class action attorneys represent all class members and are paid from the settlement fund.
You can file your claim independently through the official settlement website.
What information was exposed in the Endeavor Health data breach?
The breach exposed names, Social Security numbers, dates of birth, addresses, medical records, insurance information, and financial account details.
This combination of personal, medical, and financial data creates serious risks for identity theft and medical fraud.
Patients should freeze their credit and monitor their accounts immediately.
The Endeavor Health lawsuit is moving toward a resolution that could put real money into the hands of affected patients in 2026. The key is being prepared when the claims window opens.
Gather your documents now. Keep your breach notification letter in a safe place. Freeze your credit if you haven’t already.
When the settlement is approved, file your claim early and with as much documentation as possible. That’s how you get the best result from this process.
