In a significant legal move, Michelle Smith has filed a class action lawsuit against Marshfield Clinic Health System, Inc., alleging negligence in protecting sensitive patient information. The complaint was lodged on November 19, 2025, in the United States District Court for the Western District of Wisconsin. Smith claims that the health system failed to adequately secure her personal and health-related data, along with that of other patients.
The case revolves around a data breach that occurred between August 26 and August 27, 2025, when an unauthorized party accessed Marshfield Clinic’s systems. According to the complaint, this breach exposed unencrypted private information such as names, addresses, dates of birth, insurance details, medical records, and more. Smith accuses Marshfield Clinic of negligence for not implementing adequate security measures to protect this sensitive data. “Defendant’s conduct amounts to negligence and violates federal statutes,” states the complaint. The plaintiff argues that the clinic’s failure to encrypt or redact sensitive information led to its exploitation by hackers who could use it for identity theft.
Smith seeks justice not only for herself but also on behalf of all affected individuals whose private information was compromised due to what she describes as Marshfield Clinic’s “utter failure” in safeguarding patient data. The lawsuit alleges violations of both the Federal Trade Commission Act (FTCA) and the Health Insurance Portability and Accountability Act (HIPAA), which set standards for protecting electronic health information. Smith is demanding injunctive relief to ensure future protection of patient data and compensation for damages suffered by those affected by the breach.
In terms of relief sought from the court, Smith is requesting damages including restitution and unjust enrichment as well as declaratory and injunctive relief. She also seeks coverage for costs related to credit monitoring services necessary due to increased risks of identity theft following the breach. Additionally, she demands that Marshfield Clinic implement more robust security measures moving forward.
Representing Michelle Smith in this case are attorneys from law firms specializing in class action lawsuits and data privacy issues. The presiding judge over this matter will be from the Western District of Wisconsin court where it was filed under Case ID: 3:25-cv-00953.
Source: 325cv000953_Smith_v_Marshfield_Clinic_Health_System_Inc_Complaint_Western_District_Wisconsin.pdf
