LVHN Reaches Proposed $65M Settlement in Class-Action Suit Over Data Breaches of Medical Records of 134,000 Patients
The data breach exposed patients’ personal information to the dark web.
Lehigh Valley Health Network reached a proposed $65 million settlement in a class-action lawsuit over data breaches of medical records of 134,000 patients.
While there have been larger class-action lawsuit settlements in terms of total dollars and numbers of plaintiffs in cases throughout the country, the proposed LVHN pact might be the largest class-action settlement per-capita in the nation, said plaintiffs’ attorney Patrick Howard, of the Saltz Mongeluzzi Bendesky law firm in Horsham.
“We think it’s an excellent result,” Howard said in a phone interview Wednesday. “It’s a lot of money, but the harm was significant. I think the compensation is commensurate with what the law allows.”
The lawsuit stemmed from a cyberattack by the Russian ransomware group BlackCat that targeted Lackawanna County-based Delta Medix Group, part of LVHN’s network.
The data breach exposed patients’ personal information to the dark web. LVHN reported in February 2023 that hackers posted sensitive photos and information on the dark web after the organization refused to pay the ransom the hackers demanded.
Lehigh Valley Health Network issued a statement on Thursday.
“Lehigh Valley Health Network has tentatively resolved a class action pertaining to the 2023 cybersecurity attack by a Russian ransomware gang known as BlackCat. The attack was limited to the network supporting one physician practice located in Lackawanna County. Class members will receive separate written notice with additional information about the settlement. During our response in 2023, LVHN identified the unauthorized activity, immediately launched an investigation, engaged leading cybersecurity firms and experts, and notified law enforcement. After investigating, we provided notices to individuals whose information was involved. BlackCat demanded a ransom payment, but LVHN refused to pay this criminal enterprise. Patient, physician, and staff privacy is among our top priorities, and we continue to enhance our defenses to prevent incidents in the future.”
The lead plaintiff, identified anonymously as “Jane Doe” in the case to protect her privacy, filed the lawsuit in March 2023 seeking damages on behalf of herself and all other patients affected by the breach.
Initially filed in Lackawanna County Court, the case was transferred to federal court, then sent back to county court. The case remains pending in Lackawanna County Court with a final-approval hearing of the proposed settlement scheduled for Nov. 15 before Senior Judge Thomas A. James.
The proposed settlement was reached Aug. 20 and was followed by notices issued to each of the patients who comprise the settlement class.
An informational website for them also has been created at lvhndatabreachsettlement.com.
The website follows the settlement order and explains how each affected patient has been placed into one or more of four “relief tiers” of damages allocated by an independent special master.
The amount of the settlement fund allocated to each tier will be paid to patients proportionately based on damages suffered and up to a specified amount per tier.
Each plaintiff has been assigned a unique identifier to allow them to confidentially view the relief tier(s) in which they are placed and their estimated gross settlement payouts.
The proposed settlement calls for the following payout ranges:
$50 to each person whose medical records were accessed and breached in the cyberattack.
$1,000 to anyone whose information was posted on the internet.
$7,500 to any patient who had non-nude photos posted on the dark web.
$70,000 to $80,000 to any patient who had nude photos posted on dark web.
The lead plaintiff, Jane Doe, would receive $125,000 in damages.
“She stuck her neck out. We really believe she put herself in peril, had it gone to trial,” Howard said.
The plaintiffs’ attorneys would receive one-third of the settlement fund, or about $21.5 million, if the proposed pact is approved by the judge.
Class plaintiffs can submit claims for out-of-pocket losses.
They also can exclude themselves from the settlement by formally “opting out” by Oct. 21, if they choose to pursue their own separate lawsuits individually.
They can submit written comments supporting or opposing the proposed settlement.
Efforts on Wednesday to reach LVHN’s attorney in the lawsuit were unsuccessful.
The settlement website states that LVHN denies any wrongdoing and denies that the settlement class has a viable legal claim.
If the judge approves the pact later this year, settlement checks likely would be issued in early 2025, Howard said.