Esse Health has agreed to pay $2,525,000 to resolve a consolidated class action lawsuit arising from a 2025 cyberattack and data breach affecting hundreds of thousands of individuals in Missouri and surrounding regions.
Cyberattack Detection and Breach Scope
American Multispecialty Group, doing business as Esse Health, detected a cyberattack on April 21, 2025. A forensic investigation confirmed that unauthorized actors obtained patient information including names, addresses, birth dates, health information, and medical insurance information. Approximately 5,000 individuals also had Social Security numbers compromised in the incident.
In compliance with HIPAA, the data breach was reported to the U.S. Department of Health and Human Services Office for Civil Rights as involving the electronic protected health information (ePHI) of 23,671 patients. The Maine Attorney General was notified that 263,601 individuals were affected. The consolidated lawsuit states that approximately 521,167 individuals were impacted.
Regulatory Reporting and Public Disclosure Timeline
Esse Health announced the data breach on May 15, 2025. Following the disclosure, litigation commenced in multiple jurisdictions. Plaintiff Casten Clausner filed a class action lawsuit in the U.S. District Court for the Eastern District of Missouri. Seven additional plaintiffs filed similar actions in state court in St. Louis County and the City of St. Louis.
All actions were later consolidated in the 22nd Judicial Circuit Court of St. Louis City, Missouri, in June 2025.
Consolidated Litigation Claims
The consolidated case, Clausner et al. v. American Multispecialty Group, alleged that the data breach resulted from the defendant’s failure to implement reasonable and appropriate cybersecurity measures. Claims asserted in the lawsuit included breach of confidence, negligence, negligence per se, breach of fiduciary duty, breach of implied contract, unjust enrichment, invasion of privacy, requests for declaratory and injunctive relief, and violation of the Missouri Merchandise Practices Act.
Esse Health maintained that there was no wrongdoing and no liability. Following mediation, the parties reached a settlement agreement to avoid litigation costs and associated risks.
Settlement Terms and Structure
The settlement establishes a $2,525,000 fund to cover attorneys’ fees and expenses, settlement administration and notification costs, service awards for eight class representatives, and payments to class members.
After deductions for fees and costs, remaining funds will be distributed as pro rata cash payments to class members. The settlement structure provides an estimated payment of approximately $50 per class member, subject to adjustment based on the number of claims submitted.
Class members are also eligible to enroll in two years of medical identity protection services, including a medical identity theft insurance policy worth $1 million. Esse Health will pay the cost of these services separately.
Court Status and Deadlines
The settlement has received preliminary court approval. The deadline for objections and requests for exclusion is July 5, 2026. Claims must be submitted by August 4, 2026. The final approval hearing is scheduled for August 3, 2026.