The cyberattack was not discovered until October 2025, and a headcount of the victims is still being conducted. However, a patient of Sacramento-based One Community Health argues in a lawsuit that the nonprofit health system failed to secure his data, as required by law. The complaint is seeking class action status.