Lehigh Valley Health Network Agrees To Settle Class Action Over Ransomware Attack

Dark Daily reports that Lehigh Valley Health Network (LVHN) has agreed to pay $65 million to settle a class action lawsuit, Jane Doe individually and on behalf of all others similarly situated v. Lehigh Valley Health Network,  following a ransomware attack that exposed the personal data of 134,000 patients and staff.

The class action claims that LVHN failed to adequately protect sensitive information, including medical records, Social Security numbers, and clinical images. Notably, the ransomware group ALPHV (BlackCat) posted nude photos of cancer patients online after LVHN refused to pay a ransom.

The settlement is one of the largest of its kind, emphasizing the increasing legal and financial risks associated with healthcare data breaches.

LVHN, one of Pennsylvania’s largest primary care groups, was attacked in early 2023, with cybercriminals demanding a ransom exceeding $5 million. LVHN declined to pay, leading to the online release of stolen data.

The breach revealed systemic vulnerabilities in data security, including the photos of naked cancer patients, which were sometimes taken without their knowledge. The hospital initially offered those affected two years of credit monitoring, but legal action followed, arguing that LVHN prioritized financial concerns over patient privacy.

The settlement categorizes compensation based on the severity of exposure, awarding between $50 and $80,000 per patient. Attorneys for the plaintiffs emphasized that this case highlights the real-world consequences of cyberattacks, especially in healthcare, where breaches can cause lasting harm.

LVHN denied wrongdoing but agreed to the settlement terms, with payments distributed automatically to eligible claimants.

Lawyers advising healthcare companies should emphasize the high number of cyberattacks in that sector and the importance of robust cybersecurity to avoid liability, reputational damage, and costly settlements.