The Cooper Health System Data Breach 2025: 57,412 Affected · One-Year Notification Delay · Class Actions Consolidated in D.N.J.

The Cooper Health System, the largest academic health system in South Jersey, detected unusual network activity on May 14, 2024. Cooper did not notify the 57,412 affected patients until May 23, 2025, more than a year later. Exposed data included names, dates of birth, Social Security numbers, health insurance information, medical record numbers, treatment information, and medical history. Four proposed class actions have been consolidated before Judge Karen M. Williams in the U.S. District Court for the District of New Jersey, with the delay between detection and notice central to the negligence claims.

Timeline

• May 14, 2024 — Cooper detects unusual network activity, engages third-party cybersecurity experts, and reports the incident to the FBI.
• March 26, 2025 — File review concludes. Cooper determines an unknown actor accessed and acquired files containing patient data.
• May 23, 2025 — Cooper mails individual notification letters, files its HHS OCR breach report (57,412 individuals, Hacking/IT Incident, Network Server), and notifies state regulators including the Maine and Vermont Attorneys General. Outside counsel Constangy, Brooks, Smith & Prophete LLP (partner Laura Funk) submitted the state filings.
• Late May 2025 — Plaintiffs file the first class action complaints in federal court (D.N.J.) and New Jersey Superior Court alleging negligence, breach of contract, and unjust enrichment tied to the year-long notification delay.
• July 7, 2025 — Four proposed class actions are consolidated before Judge Karen M. Williams in the District of New Jersey. Lead case: Hernandez v. The Cooper Health System, No. 1:25-cv-05841-KMW-MJS.

What was exposed

Per Cooper’s notification letter and the Maine AG filing, the data set involved:

• Full name
• Date of birth
• Social Security number
• Health insurance information
• Medical record number
• Treatment information
• Medical history information

This is a textbook “full identity plus clinical record” exposure. SSN combined with date of birth supports new-account fraud and tax-refund fraud. Insurance member ID, MRN, and treatment history support medical identity theft, which is materially harder to remediate than financial identity theft because there is no analogue to a credit freeze for clinical records.

What Cooper is offering

• 12 months of credit and CyberScan monitoring through IDX, plus fully managed identity theft recovery support.
• A $1 million identity theft insurance reimbursement policy.
• A dedicated call center at 1-877-623-0094 (Monday through Friday, 9am to 9pm ET).
• Enrollment deadline: August 23, 2025. The enrollment code appears at the top of your individual notification letter. If the deadline has passed and you have not enrolled, call the IDX line or contact Cooper directly.

Twelve months is the floor; the half-life of an SSN exposure is measured in years, not months. Enroll, then place permanent credit freezes that outlast the monitoring window.

Class action posture

The consolidated case is Hernandez v. The Cooper Health System, No. 1:25-cv-05841-KMW-MJS, before Judge Karen M. Williams in the District of New Jersey. Named plaintiff Ana Hernandez, a Camden resident and long-time Cooper patient, is represented by Mark K. Svensson of Milberg Coleman Bryson Phillips Grossman. Additional firms on the consolidated docket include Strauss Borrelli, Kopelowitz Ostrow, Siri & Glimstad, and Brown & Connery as local counsel.

The complaints focus on the roughly one-year gap between Cooper’s May 14, 2024 detection of unusual network activity and the May 23, 2025 notification, alleging that the delay deprived patients of the chance to take protective steps and amounts to negligence and breach of the implied contract to safeguard patient data. Federman & Sherwood, Cole & Van Note, and Edelson Lechtzin have opened parallel investigations.

What to do if you may be affected

1. Read your notification letter carefully. It identifies whether your SSN was specifically in the exposed file set and contains your IDX enrollment code.
2. Enroll in IDX before the deadline in your letter. Activate the 12 months of monitoring and the $1M reimbursement policy now; you cannot back-date it.
3. Place free credit freezes at Equifax, Experian, and TransUnion. A freeze prevents new-account fraud and stays in place after IDX monitoring ends.
4. File IRS Form 14039 (Identity Theft Affidavit) if you see suspicious tax activity, and request an IP PIN to protect future tax filings.
5. Watch your Explanation of Benefits statements from your health insurer for treatments you did not receive. Medical identity theft typically surfaces here first.
6. If you wish to join the class action, contact one of the firms of record. There is no fee to be a class member; named-plaintiff status is different and requires direct engagement with counsel.
7. Limit the ongoing flow of your health data. HealthConsent files HIPAA right-to-restrict and right-of-access requests so future encounters do not feed the same data exposure pattern.

Sources on this page

• HHS Office for Civil Rights Breach Portal — federal regulatory record of the breach.
• Maine Attorney General Breach Notice — state filing confirming 57,412 affected and the IDX / $1M policy offering.
• HIPAA Journal coverage — independent summary of the incident and data elements.
• NJBIZ coverage — Cooper’s statements, FBI referral, call-center number.
• SC Media coverage — security-press summary.
• American Bar Association: Cooper University Health Care Data Breach and Legal Investigation — legal-press analysis.
• Camden Daily Voice: Lawsuits filed — local-press coverage of the first complaints.
• InjuryClaims.com: Hernandez v. Cooper, 1:25-cv-05841-KMW-MJS — federal case caption, docket, and claims.
• Law360: Class actions consolidated in NJ — consolidation under Judge Karen M. Williams.
• ClassAction.org: Cooper notice letter (PDF) — the substitute notice itself.
• Strauss Borrelli PLLC investigation — plaintiff-firm investigation summary.
• MobiHealthNews: Cooper Health System reports data security breach — digital health press coverage confirming Cooper’s public statement and FBI referral.
• NBC10 Philadelphia: Cooper Health data breach — what to know — local Philadelphia-area television coverage (NBC10 Responds, May 30, 2025).
• HIPAA Times: Cooper Health System hack exposes data of over 57,000 patients — HIPAA compliance press coverage confirming data elements and monitoring offer.