Brightline Settlement Highlights Importance of Cyberattack Damage Documentation

Steve Alder reports in The HIPAA Journal that a $7 million settlement has been reached to resolve a lawsuit, Terrance Rosa et al. v. Brightline, Inc., following a 2023 cyberattack by the Clop threat group.

Brightline is a virtual mental health provider. The breach resulted in the theft of protected health information from up to 1 million individuals.

The settlement covers legal fees, compensation for affected individuals, and identity protection services. Brightline denies wrongdoing.

The attack was part of a broader campaign exploiting a vulnerability in Fortra’s GoAnywhere MFT file transfer solution. Between January 18 and January 30, 2023, Clop actors gained unauthorized access to files by exploiting this flaw, affecting 130 companies, including Brightline.

Brightline explained in its website breach notification that Fortra’s investigation confirmed that files that contained protected health information had been downloaded.

The breach exposed sensitive data such as names, addresses, Social Security numbers, and health insurance details. Brightline disclosed the incident in May 2023, leading to multiple lawsuits that were later consolidated into one case in the US District Court for the Southern District of Florida.

The settlement establishes a $7 million fund to compensate affected individuals. Class members can claim reimbursement for documented financial losses related to the breach or opt for a $100 cash payment.

California residents are entitled to an additional $100 statutory award. Brightline also expanded its credit monitoring services, offering affected individuals up to three years of protection.

This case highlights third-party liability issues and proper documentation of cyberattack damages, both for affected clients and companies facing litigation.