LVHN to Pay $65 Million Over Data Breach That Led to Cancer Patient Photos Being Posted Online

The agreement would settle a class action lawsuit filed after it was revealed confidential information, including photos of cancer patients, were stolen and then published online.

Lehigh Valley Health Network has reached a tentative agreement to pay a total of $65 million to patients affected by a data breach that occurred in February 2023.

The agreement would settle a class action lawsuit filed after it was revealed confidential information, including photos of cancer patients, were stolen and then published online by hackers with the ransomware collective BlackCat. The original plaintiff of the lawsuit has only ever been identified as “Jane Doe,” and is a woman who had pictures of her exposed chest and face, taken during treatment for breast cancer, released by the hackers.

However, according to court documents, as many as 135,000 individuals had their personal information accessed by hackers and all will be eligible to seek at least some of the money from the settlement.

An LVHN spokesperson confirmed that the network had tentatively resolved the class action, and class members would each receive separate written notices with additional information about the settlement.

Before the settlement receives final approval, the Lackawanna County Court of Common Pleas has scheduled a final fairness hearing Nov. 15.

In a news release from law firm Saltz Mongeluzzi Bendesky, Patrick Howard, lead class counsel of the case, said he and others at the firm were pleased by the large settlement and commended LVHN for reaching the agreement.

People who already were notified they are a members of the settlement class are not required to take any action to receive compensation, which will range from $50 to $70,000 depending on the relief tiers they belong to. Howard said this is the largest class action settlement of its kind on a per capita basis, meaning that class members will individually receive larger shares of the total relief amount.

Under the settlement agreement, there are four relief tiers, of which class members are able to belong to as many as three.

Howard said everyone is a member of relief tier one, the group that had their names, addresses or other personal information leaked. Each member of this tier will receive $50. Those who incurred out-of-pocket costs due to the data breach also are entitled to file a claim and receive up to $5,000 or a proportionally determined sum if the claim exceeds $500,000.

Relief tier two comprises those who had sensitive medical diagnosis or employment data leaked during the data breach; they will each receive a share of the $1.3 million that will be set aside for this tier.

Members of tier three are those who had sensitive but non-nude photos of themselves leaked to the web by BlackCat and will receive a proportional share of $4.55 million. Members of tier four are those who had nude images of themselves published online, and they will receive a proportional share of $52 million.

Howard said “Jane Doe”, the original plaintiff, will receive $125,000.

“Had the case gone to trial she would have lost her anonymity and she would have had to sit there in front of a courtroom full of people while we displayed her nude images to the jury, to the judge,” Howard said. “She was taking a risk. She’s obviously very sensitive about what happened here and it’s been a lot emotionally for her. For her to step out and bring the lawsuit knowing that’s the risk, we wanted to see her properly compensated.”

LVHN has not admitted fault related to the data breach and has maintained that it responded appropriately.

“During our response in 2023, LVHN identified the unauthorized activity, immediately launched an investigation, engaged leading cybersecurity firms and experts, and notified law enforcement. After investigating, we provided notices to individuals whose information was involved. BlackCat demanded a ransom payment, but LVHN refused to pay this criminal enterprise. Patient, physician and staff privacy is among our top priorities, and we continue to enhance our defenses to prevent incidents in the future,” a statement from LVHN said.

To start a claim, and for more information on the settlement, visit lvhndatabreachsettlement.com/.