Over the past 18 months, many healthcare providers have settled class action lawsuits over their use of website tracking and analytics tools. The list continues to grow with a further five settlements recently announced; however, class action lawsuits stemming from the use of tracking and analytics tools do not always result in settlements.

A proposed class action lawsuit against CRH Healthcare, doing business as Peachtree Immediate Care in Georgia, that alleged violations of the federal Electronic Communications Privacy Act and asserted claims for negligence/negligence per se, breach of implied contract, breach of express contract, breach of fiduciary duty, and unjust enrichment, has been dismissed with prejudice.

The judge ruled that the complaint was speculative, as the plaintiff failed to explain what damages had been suffered as a result of the defendant’s actions. The plaintiff has been given 14 days to file an amended complaint, or the lawsuit will be permanently dismissed. The decision shows that while tracking and analytics tools may result in disclosures of sensitive data to third parties, the plaintiff(s) must demonstrate that the disclosures resulted in a compensable injury.

Emanate Health Medical Center Pixel Settlement

Emanate Health Medical Center, a nonprofit healthcare organziation based in Covina, California, Emanate Health Medical Center faced multiple class action lawsuits over the use of tracking tools such as pixels. The lawsuits were consolidated into a single complaint – Ortega, et al., v. Emanate Health Medical Center – in the Superior Court of the State of California, County of Los Angeles.

The consolidated lawsuit asserted claims for violations of the California Invasion of Privacy Act, California Confidentiality of Medical Information Act, invasion of privacy under the California Constitution, and common law invasion of privacy – intrusion upon seclusion. Emanate Health Medical Center denies all allegations of wrongdoing and liability, and all material allegations in the lawsuit; however, it agreed to a settlement to avoid the risks and costs of lengthy litigation and the uncertainty of a trial and appeals.

Emanate Health has agreed to establish a $777,000 settlement fund to cover attorneys’ fees and expenses, settlement administration costs, and service awards for the four class representatives. The net settlement fund after costs and expenses have been deducted is expected to be approximately $433,709, which will be divided pro rata between all individuals who submit a claim. In the unlikely event that every class member submits a claim, that would equate to a payment of $11 per class member.

The class consists of individuals who logged in to the Emanate Health patient portal, and/or submitted an online form and/or scheduled an appointment on the Emanate Health website between August 30, 2019, and April 30, 2024. The deadline for objection and opting out is August 31, 2026. Claims must be submitted by September 29, 2026, and the final fairness hearing has been scheduled for November 19, 2026.

Bayhealth Medical Center Pixel Settlement

Bayhealth Medical Center, a hospital system serving patients in central and southern Delaware, faced multiple class action lawsuits over its use of third-party tracking pixels on its website, resulting in disclosures of website users’ sensitive data to third parties. The lawsuits were consolidated into a single complaint – Doe et al. v. Bayhealth Medical Center Inc., d/b/a Bayhealth – in the Superior Court of the State of Delaware

Bayhealth denies all wrongdoing and liability and sought to have the lawsuit dismissed; however, the motion to dismiss was denied, and the claims for negligence, breach of implied covenant of good faith and fair dealing, unjust enrichment, breach of confidentiality, and violation of the Delaware Consumer Fraud Act were allowed to proceed. After prolonged and extensive arm’s length negotiations and mediation, all parties agreed to a settlement to avoid the cost and time required for continued litigation and the uncertainties associated with a trial and related appeals.

Bayhealth has agreed to cover the cost of attorneys’ fees and expenses, settlement administration and notification costs, and service awards for the class representatives, and will pay for two benefits for the class members. Class members are eligible to enroll in one year of medical data monitoring services and may submit a claim for a one-time cash payment of $25 per class member. The class consists of all patient portal users who used Bayhealth websites and patient portal websites between January 1, 2019, and December 31, 2025. The deadline for objection and opting out is September 4, 2026. Claims must be submitted by October 5, 2026, and the final fairness hearing has been scheduled for October 29, 2026.

Mount Sinai Medical Center of Florida Pixel Settlement

Mount Sinai Medical Center of Florida, aka Mount Sinai Medical Center, a Miami, FL-based hospital and the largest private, independent not-for-profit teaching hospital in the state, faced multiple class action lawsuits over its use of tracking, analytics, and advertising technologies on its website and patient portal. The lawsuits were consolidated into a single action – Boggiano, et al. v. Mount Sinai Medical Center of Florida a/k/a Mount Sinai Medical Center – in the Circuit Court for Broward County, Florida.

The lawsuit alleged that these tools resulted in the impermissible disclosure of personal and protected health information to third parties, without the knowledge or consent of patients. The lawsuit asserted claims for invasion of privacy and unjust enrichment. The defendant denies wrongdoing and liability, and disagrees with the claims and contentions in the lawsuit; however, after several months of negotiation and mediation, the terms of a settlement were agreed upon.

Mount Sinai Medical Center of Florida will pay attorneys’ fees and expenses, settlement administration and notification costs, and service awards for the class representatives, as well as benefits for the class members. The class consists of individuals who accessed the Mount Sinai Medical Center’s Website or Patient Portal between June 10, 2021, and September 18, 2025.

Class members will receive an activation code for one year of medical data monitoring services without submitting a claim. Claims may be submitted for a one-time cash payment from a $220,000 settlement fund. Based on a typical claim volume, the cash payments are expected to be around $20 per class member but may be higher or lower depending on the number of valid claims received. The deadline for objection and opting out is September 14, 2026. Claims must be submitted by September 28, 2026, and the final fairness hearing has been scheduled for October 13, 2026.

University of Pennsylvania Health System (Penn Medicine) Pixel Settlement

The University of Pennsylvania Health System, doing business as Penn Medicine, was sued over its use of Meta Pixel, Google Analytics code, and other tracking, analytics, and advertising tools, which were alleged to have disclosed sensitive website user data to third parties such as Meta and Google.

Several lawsuits were filed in response to the alleged unlawful disclosures of personal and protected health information. The lawsuits were consolidated into a single complaint – Mohr, et al. v. The Trustees of The University of Pennsylvania as Owner and Operator of The University of Pennsylvania Health System (d/b/a Penn Medicine) – in the Court of Common Pleas of Philadelphia County, Pennsylvania. The lawsuit alleged the disclosures of personal and protected health information via these tools violated the Pennsylvania Wiretapping and Electronic Surveillance Control Act. Penn Medicine denies the claims and contentions in the lawsuit, including those related to negligence, fault, wrongdoing, and liability.

All parties agreed to a settlement to avoid the cost and risk of a trial, and the settlement has received preliminary approval from the court. Penn Medicine will establish a $9,500,000 settlement fund to cover attorneys’ fees and expenses, settlement administration costs, and service awards for the class representatives. Class members may claim a one-time cash payment of up to $15. The defendant has stopped using Meta Pixel on its website, and will not use analytics and advertising technologies on the website for a period of at least two years.

The settlement class consists of individuals who used the myPennMedicine Patient Portal between January 23, 2021, and January 23, 2023. The deadline for objection and opting out is September 1, 2026. Claims must be submitted by September 16, 2026, and the final fairness hearing has been scheduled for November 12, 2026.

Concord Hospital Pixel Settlement

Concord Hospital Health System, a health system based in Concord, New Hampshire, was sued over its use of website tracking tools. The lawsuit – Branson v. Concord Hospital Inc. et al – names Concord Hospital, Inc., Concord Hospital – Laconia, Concord Hospital – Franklin, and Capital Region Healthcare Corporation as defendants, and was filed in the Hillsborough Superior Court, Manchester, New Hampshire.

The lawsuit alleges that the deployment of these tools resulted in disclosures of personal and protected health information to third parties such as Google and Geonetric, without the knowledge or consent of patients, in violation of the New Hampshire Wiretapping and Electronic Surveillance Act and New Hampshire Patient Privacy Law. The defendants deny all allegations in the lawsuit. The parties agreed to a settlement to avoid the costs and risk of a trial.

The settlement class consists of individuals whose information was allegedly intercepted by the tools between May 9, 2021, and the date of the preliminary settlement agreement. The defendants have agreed to establish an $800,000 settlement fund to pay benefits to the class members, after attorneys’ fees and expenses, settlement administration costs, and service awards have been deducted.  Each individual who submits a valid claim will receive an equal pro rata share of the remaining funds. The deadline for objection, opting out, and submitting a claim is September 11, 2026. The final fairness hearing has been scheduled for November 3, 2026.

The post Five Healthcare Providers Settle Pixel Class Action Lawsuits appeared first on The HIPAA Journal.

The Belarusian cybercriminal behind the Ransom Cartel ransomware group has been sentenced to 16 years in prison for his role in ransomware attacks on at least 18 companies worldwide.

Maksim Silnikau, 40, was the creator and administrator of the Ransom Cartel ransomware-as-a-service operation and recruited other cybercriminals to conduct ransomware attacks globally. According to court documents, Silnikau began developing the ransomware operation in May 2021, initially under a different name, before rebranding it as Ransom Cartel in 2022. Between 2021 and 2023, along with his co-conspirators, at least 18 companies fell victim to attacks, including companies in California, New York, and Nebraska. The attacks caused more than $6.7 million in losses, and the group attempted to extort at least $5.2 million from victims.

Silnikau did not conduct many of the intrusions himself. He was the administrator of the operation and purchased stolen credentials from initial access brokers, recruited affiliates to conduct attacks, negotiated with victims, used cryptocurrency mixers to hide the proceeds from the attacks, and split the money with the group’s affiliates.

Silnikau has a long history of cybercrime, having reportedly been a core member of the REvil ransomware operation, a member of Russian-speaking cybercrime forums since at least 2005, and a member of the cybercrime website Direct Connection from 2011 until the site was shut down in 2016. Silnikau was involved in the distribution of the Angler exploit kit and various malvertising and malware distribution schemes between October 2013 and March 2022. Along with a Ukrainian national and a Russian national, Silnikau was charged with participation in the distribution of the Angler exploit kit in a separate indictment in New Jersey.

Following an international law enforcement investigation, Silnikau was arrested in Spain on July 18, 2023; however, fled while awaiting extradition to the United States to face the charges. He was recaptured attempting to return to Belarus from Poland and was extradited to the U.S. from Poland in 2024 to face the charges in the Eastern District of Virginia. Prosecutors charged Silnikau with seven counts, although he was only convicted on three: conspiracy to commit offenses against the United States, wire fraud, and aggravated identity theft, and was sentenced to 16 years in jail.

The post Ransom Cartel Mastermind Sentenced to 16 Years in Prison appeared first on The HIPAA Journal.

Settlements have been agreed to resolve class action data breach lawsuits against McKenzie Health System in Michigan and Aspire Health Alliance in Massachusetts.

McKenzie Health System Data Breach Settlement

McKenzie Health System, the operator of the McKenzie Memorial Hospital, a critical access hospital in Sanilac County, Michigan, has settled a class action lawsuit that was filed in response to an April 2025 cyberattack and data breach. McKenzie Health identified unauthorized access to its computer network on April 15, 2025. The forensic investigation determined that an unauthorized third party accessed its network between April 14, 2025, and April 15, 2025, and potentially obtained files containing patient information.

Data potentially compromised in the incident included names, addresses, birth dates, Social Security numbers, patient account numbers, medical record numbers, diagnosis and treatment information. The data breach was reported to the HHS’ Office for Civil Rights as affecting 58,839 individuals, who started to be notified on or around July 24, 2025.

Several class action lawsuits were filed in response to the data breach, which were consolidated into a single action – In Re: McKenzie Memorial Hospital d/b/a McKenzie Health System 2025 Data Breach Litigation – in the Circuit Court for Sanilac County, Michigan. The consolidated lawsuit alleges that the cyberattack and data breach should have been prevented and occurred due to the defendant’s negligence.

McKenzie Health denies wrongdoing and liability; however, it agreed to a settlement to avoid the litigation costs and expenses, distractions, burden, expense, and disruption to its business operations associated with further litigation. McKenzie Health has agreed to pay attorneys’ fees and expenses, settlement administration costs, and service awards for the eight class representatives.

Under the terms of the settlement, all class members are eligible to enroll in two years of credit monitoring and identity theft protection services. In addition, they may either submit a claim for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $4,000 per class member or claim a one-time $50.00 cash payment. The deadline for opting out, objecting, and submitting a claim is August 24, 2026. The final fairness hearing has been scheduled for October 6, 2026.

Aspire Health Alliance Data Breach Settlement

South Shore Mental Health Center, Inc., doing business as Aspire Health Alliance, a state-designated community behavioral health center with facilities in Quincy, Braintree, and Marshfield in Massachusetts, has agreed to settle class action litigation stemming from a September 2023 cybersecurity incident that affected 17,490 individuals.

Aspire Health Alliance detected unauthorized network access on September 13, 2023, and confirmed that an unauthorized third party accessed and acquired files containing patient information, including names, dates of birth, dates of service, health insurance information, condition or treatment information, Medicare/Medicaid numbers, and patient account numbers. The affected individuals started to be notified about the data breach on April 26, 2024.

On May 10, 2024, a class action lawsuit was filed in the Superior Court of the Commonwealth of Massachusetts, Norfolk County, which was subsequently moved to the Superior Court of the Commonwealth of Massachusetts, Suffolk County. The lawsuit – Joan Tozzi v. South Shore Mental Health Center, Inc. d/b/a Aspire Health Alliance – alleged that the data breach could have been prevented as it occurred as a result of the failure to implement reasonable and appropriate cybersecurity measures. The lawsuit asserted claims for negligence, breach of implied contract, breach of fiduciary duty, and unjust enrichment. Aspire Health Alliance denies wrongdoing or liability.

All parties agreed to a settlement to avoid further legal costs and the uncertainty of a trial and related appeals. Under the terms of the settlement, Aspire Health Alliance has agreed to establish a $400,000 settlement fund to cover class member benefits, attorneys’ fees and expenses, settlement administration costs, and a service award for the class representative.

Class members are entitled to a one-year membership to the CyEx Medical Shield medical data monitoring service and may also submit a claim for one of two cash payments: reimbursement of documented, unreimbursed losses up to a maximum of $2,500 per class member, or a pro rata cash payment, the value of which will depend on the number of valid claims received. The deadline for objection, opting out, and submitting a claim is September 16, 2026. The final fairness hearing has been scheduled for October 1, 2026.

The post Settlements Resolve Data Breach Lawsuits Against McKenzie Health System & Aspire Health Alliance appeared first on The HIPAA Journal.

Settlements have been agreed to resolve class action data breach lawsuits against Omni Healthcare Financial Holdings and its subsidiaries, and Western Montana Clinic.

Omni Healthcare Financial Holdings Data Breach Settlement

Omni Healthcare Financial Holdings, along with defendants Omni Healthcare Financial, LLC, and Injury Finance, LLC (Omni Healthcare), have settled class action litigation over a January 2024 cybersecurity incident involving the protected health information of 16,852 individuals.

Omni Healthcare, a provider of financial solutions to healthcare organizations and patients, experienced a cybersecurity incident involving unauthorized network access between January 18 and January 19, 2024. Information exposed in the incident included names, contact information, dates of birth, Social Security numbers, diagnosis & treatment information, medical record numbers, treatment costs, provider names, and other information. The affected individuals were notified in April 2025, 15 months after the breach was first detected. In total, Omni Healthcare mailed around 42,000 notifications.

The first class action lawsuit was filed by plaintiff Latasha Hammond on April 16, 2025, followed by a second lawsuit by plaintiff Dawn Hairston. Both lawsuits were filed in the District Court for the Western District of North Carolina, and were consolidated, adding a further two plaintiffs – Hammond et al. v. Omni Healthcare Financial Holdings et al. The litigation was subsequently moved to the Superior Court of Mecklenburg County, North Carolina, where it is pending.

The consolidated lawsuit alleged that the data breach could have been prevented and occurred as a result of the defendants’ failure to implement appropriate industry-standard cybersecurity measures, and its failure to comply with the standards of the HIPAA Privacy and Security Rules. The lawsuit asserted claims for negligence/negligence per se, breach of implied contract, and unjust enrichment. The defendants deny all claims and contentions in the lawsuit, including claims of wrongdoing, fault, and liability.

The parties determined that a settlement was the best outcome, as it avoids further legal costs and the uncertainties of a trial and related appeals. The defendants will cover the cost of attorneys’ fees and expenses, settlement administration costs, service awards for the class representatives, and benefits for the class members.

Class members are entitled to enroll in three years of medical data monitoring and medical identity theft services and may submit a claim for one of two cash payments:

• Cash Payment A – Reimbursement of documented, unreimbursed losses due to the data breach up to $5,000 per class member, or
• Cash Payment B – A one-time cash payment of $40 per class member

The final approval hearing has been scheduled for August 13, 2026, and the claims deadline is September 3, 2026.

Western Montana Clinic Data Breach Settlement

Western Montana Clinic, a medical group practice in Missoula, MT, has settled a class action lawsuit stemming from a breach of its email environment in Spring 2025. Suspicious email activity was detected on April 15, 2025, and the forensic investigation confirmed unauthorized access to certain employee email accounts between March 11, 2025, and April 15, 2025.

The data review determined that the protected health information of 8,255 individuals was compromised, and 9,506 individuals were affected in total. Data exposed in the incident included contact information, Social Security numbers, dates of birth, treating physician names, internal identification numbers, dates of service, medication information, diagnostic information, and treatment information. The affected individuals were notified on August 8, 2025.

Western Montana Clinic was sued over the data breach, and the lawsuit – Murphy v. Western Montana Clinic – is pending in the Fourth Judicial District of Montana. The lawsuit claimed the data breach occurred as a result of the failure of the clinic to implement reasonable and appropriate cybersecurity measures, and asserted claims for negligence, negligence per se, breach of implied contract, and unjust enrichment. Western Montana Clinic denies wrongdoing and liability; however, it agreed to settle the lawsuit to avoid the litigation costs and expenses, distractions, burden, and disruption to its business operations associated with further litigation.

Western Montana Clinic has agreed to pay attorneys’ fees and expenses, settlement administration costs, $2,500 service awards to the two named plaintiffs, and class member benefits. Class members may claim a one-year membership to a medical data monitoring service, up to three hours of lost time at $20 per hour, and reimbursement of documented, unreimbursed out-of-pocket losses up to a maximum of $5,000 per class member. The deadline for exclusion and objection is August 17, 2026. Claims must be submitted by September 15, 2026, and the final fairness hearing has been scheduled for September 9, 2026.

The post Data Breach Lawsuits Settled by Omni Healthcare & Western Montana Clinic appeared first on The HIPAA Journal.

Two healthcare providers have agreed to settle lawsuits over their use of pixels and other website tracking technologies. The tools allegedly resulted in the disclosure of patient data to the third-party providers of those tools, without the knowledge or consent of website users.

Banner Health Pixel Settlement

Banner Health is a Phoenix, Arizona-based health system that operates 33 hospitals in six U.S. states. Banner Health faced multiple class action lawsuits over its use of pixels and other tracking and analytics tools on its website between June 1, 2020, and November 22, 2023, which were alleged to have disclosed sensitive information to Meta Platforms (Facebook) and Google LLC. The lawsuits were consolidated into a single action – McCulley, et al. v. Banner Health – as they had overlapping claims. The consolidated lawsuit, which names 8 individuals as class representatives, was filed in the District Court for Weld County in the State of Colorado.

The lawsuit asserted claims for breach of confidence, violation of the Electronic Communications Privacy Act (unauthorized interception, use, and disclosure), invasion of privacy-intrusion upon seclusion, unjust enrichment, violations of the Arizona Consumer Fraud Act, California Invasion of Privacy Act, California Confidentiality of Medical Information Act, California Unfair Competition Law, and Colorado Consumer Protection Act. Banner Health denies any wrongdoing and liability.

All parties agreed to a settlement to bring the litigation to an end, and avoid further legal costs and expenses and the uncertainty of a trial. There are approximately 1,028,000 individuals in the settlement class, which consists of individuals who logged into a Banner Health patient account (MyBanner patient portal) between June 1, 2020, and November 22, 2023.

Banner Health has agreed to pay attorneys’ fees and expenses (up to $3,750,000), settlement administration costs, and service awards of $2,500 to each of the 8 class representatives. All class members are entitled to claim a one-time cash payment of $20 and are eligible to receive a one-year membership for the CyEx Privacy Shield Pro service. The deadline for objection, opting out, and submitting a claim is September 5, 2026. The final fairness hearing has been scheduled for September 10, 2026.

LifeStance Health Group Pixel Settlement

LifeStance Health Group is a Scottsdale, Arizona provider of outpatient behavioral health services. Two class action lawsuits were filed alleging that the defendant disclosed information about individuals’ physical and mental health and other sensitive patient information to third parties via tracking tools on its website. The plaintiffs alleged that the tools were used without their knowledge or consent. The lawsuits were consolidated into a single action – Montana Strong, et al. v. LifeStance Health Group Incorporated – in the United States District Court for the District of Arizona.

The lawsuit asserted claims for violation of the California Invasion of Privacy Act, California Confidentiality of Medical Information Act, Electronic Communications Privacy Act (unauthorized interception, use, and disclosure), California Unfair Competition Law, Arizona Consumer Fraud Act, New York General Business Law, and common law invasion of privacy-intrusion upon seclusion. LifeStance Health Group denies all claims and contentions in the lawsuit, including claims of liability and wrongdoing. All parties agreed to a settlement to avoid the cost and distraction of continuing with the litigation and the uncertainty of a trial.

There are two settlement subclasses. Subclass 1 includes all individuals who booked at least one session through the LifeStance online booking tool, accessed through the lifestance.com website, between March 1, 2020, and April 30, 2023. Settlement subclass 2 consists of other members of the LifeStance patient population between the same dates, who are not members of subclass 1.

LifeStance has agreed to establish a $3,027,874.44 settlement fund, which will be split into a subclass 1 fund of $1,203,405.00 and a subclass 2 fund of $1,824,469.44. Attorneys’ fees and expenses and other costs such as settlement administration expenses and service awards for the class representatives will be deducted from those settlement funds. The remainder will be paid to individuals who submit a valid claim.

LifeStance has agreed to discontinue the use of all third-party tracking tools, other than tools that are fully compliant with the HIPAA Rules, for a period of five years from the settlement date. The deadline for objection and opting out is August 31, 2026. Claims must be submitted by September 29, 2026, and the final approval hearing has been scheduled for October 16, 2026.

The post Banner Health; LifeStance Health Group Settle Tracking Technology Lawsuits appeared first on The HIPAA Journal.

Healthcare Services Group has agreed to pay $3,000,000 to settle litigation arising from a September 2024 cybersecurity incident that involved unauthorized access to systems containing the personal and protected health information of 624,496 individuals.

Healthcare Services Group is a Bensalem, PA-based provider of environmental, dining, and nutritional support services, and works with more than 3,000 healthcare facilities in 48 U.S. states. Suspicious network activity was identified on or around October 7, 2024, and the forensic investigation determined that its network was first breached by an unauthorized third party on September 27, 2024.

Prompt action was taken to prevent further unauthorized access, but files containing protected health information had already been exfiltrated from its network. Those files contained information such as names, Social Security numbers, driver’s license numbers, state identification numbers, financial account details, full access credentials, and medical and health insurance information.

Notification letters started to be mailed to the affected individuals on August 25, 2025, and on August 27, 2025, the first class action lawsuit was filed. Further lawsuits were filed that made similar claims, and the actions were consolidated into a single complaint – Williamson, et al. v. Healthcare Services Group, Inc. – in the United States District Court for the Eastern District of Pennsylvania.

The consolidated lawsuit asserted claims for negligence, breach of implied contract, breach of contracts to which the plaintiffs and class members were intended third-party beneficiaries, breach of fiduciary duty, unjust enrichment, violations of the New Jersey Consumer Fraud Act and Washington Consumer Protection Act, and declaratory and injunctive relief.

Healthcare Services Group denies any wrongdoing and disagrees with all claims and contentions in the lawsuit. All parties agreed to a settlement as they concluded that further litigation would likely be expensive and protracted, and by settling, all parties avoid the uncertainty and risks of a trial.

Healthcare Services Group has agreed to establish a $3,000,000 settlement from which attorneys’ fees and expenses, settlement administration costs, and service awards for the class members will be deducted. The remaining funds will be used to pay benefits to the class members. Class members are entitled to claim three years of single-bureau credit monitoring services, which include identity theft insurance and identity theft recovery services.

A claim may be submitted for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $5,000 per class member, and a claim may also be submitted for a one-time pro rata cash payment. The cash payments will exhaust the settlement fund, and their value depends on the number of valid claims received. Requests for exclusion and objections must be submitted by September 4, 2026. The deadline for submitting a claim is October 1, 2026, and the final fairness hearing is scheduled for September 24, 2026.

The post $3 Million Settlement Agreed to Resolve Healthcare Services Group Data Breach Litigation appeared first on The HIPAA Journal.

ApolloMD Business Services, a business associate that provides integrated, multispecialty physician, APC, and practice management services, has agreed to settle a class action lawsuit stemming from a May 2025 ransomware attack.

The attack was identified by ApolloMD on or around May 22, 2025, and the forensic investigation determined that a ransomware actor accessed its network between May 22 and May 23, 2025, potentially exfiltrating files containing the protected health information of patients of its healthcare provider clients. The Qilin ransomware group claimed responsibility for the attack.

The ApolloMD data breach included names, dates of birth, health information, health insurance information, and for some individuals, Social Security numbers, and was reported to the HHS’ Office for Civil Rights as affecting 626,540 individuals. The first batch of notification letters was mailed to the affected individuals starting in September 2025, with a second wave of notifications issued in March 2026.

The first class action lawsuits were filed shortly after the first round of notification letters were issued. In January 2026, the court granted the motion to consolidate the lawsuits into a single complaint – In re ApolloMD Data Breach Litigation – which was filed in the U.S. District Court for the Northern District of Georgia, Atlanta Division.

The consolidated lawsuit alleged that the ransomware attack occurred as a result of the failure of the defendant to implement reasonable and appropriate cybersecurity measures. ApolloMD denies all claims and contentions asserted in the action, including any wrongdoing and liability. Following mediation in January 2026, the parties agreed on the material terms of a settlement, which has now been finalized and has received preliminary approval from the court.

The defendant has agreed to establish a $4,020,000 settlement fund to pay benefits to the class members, after attorneys’ fees and expenses, settlement administration and notification costs, and service awards for the class representatives have been deducted. All class members are entitled to a one-year membership to a CyEx medical data monitoring service and may claim one of two cash payments. A claim may be submitted for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $5,000 per class member. Alternatively, a pro rata cash payment may be claimed, estimated at $75 per claimant. The cash payments will be subject to a pro rata increase or decrease depending on the number of claims received.

The deadline for objection and opting out is August 31, 2026. Claims must be submitted by September 30, 2026, and the final fairness hearing has been scheduled for October 5, 2026.

The post ApolloMD Agrees to Pay $4.02M to Settle Data Breach Lawsuit appeared first on The HIPAA Journal.

A coalition of 42 state attorneys general has agreed to a $18 million settlement with 23andMe (now Chrome Holding Co.) to resolve alleged cybersecurity failures that led to an October 2023 data breach affecting 6.9 million of its customers. The settlement also includes a commitment to implement new data security measures to better secure consumer data and prevent further data breaches.

The 23andMe data breach occurred as a result of credential stuffing, which is where credentials obtained in a data breach at one or more companies are used to try to gain access to accounts on an unrelated platform. These attacks can only succeed if individuals reuse the same credentials across multiple accounts. When the credential stuffing campaign was discovered, 23andMe maintained that there had not been a breach, and that the compromised accounts were the result of customers’ poor security practices.

While 23andMe customers took risks by reusing their credentials on the 23andMe site, the multistate investigation found that 23andMe was at fault as the company lacked basic cybersecurity measures for preventing credential-based attacks. For instance, 23andMe did not compare users’ passwords against blocklists of known breached passwords, did not require multifactor authentication, and did not have rate limiting or intrusion prevention measures in place. Further, there was insufficient logging and monitoring, which allowed the credential-stuffing campaign to go unnoticed for five months between April 2023 and September 2023, and a failure to investigate and address unusual login patterns, such as a massive spike in login attempts indicative of a credential stuffing campaign. The investigation also identified a failure to fix known vulnerabilities and properly review and test design features of its platform.

23andMe filed for bankruptcy protection in March 2025, and the company’s data was sold to TTAM Research, a company formed by 23andMe founder and former CEO, Anne Wojcicki. The coalition sued 23andMe during the company’s bankruptcy, and the new data security requirements apply to TTAM, which is now registered as 23andMe Research Institute. The $18 million settlement will be paid to the participating states, with New York due to receive more than $705,000.

“Companies have a duty to protect their customers’ personal information from hackers, but 23andMe put millions of its customers at risk with its flimsy security measures,” said Attorney General James. “New Yorkers trusted 23andMe with their sensitive and personal genetic data, only to find that data stolen and put up for sale on the dark corners of the internet. As a result of our coalition’s action, 23andMe will pay for violating the law, and strict rules will be put in place to protect their customers.”

23andMe has previously agreed to pay $46.75 million as compensation to victims of the data breach, and has previously been fined by data protection watchdogs in Spain ($2.75M) and the United Kingdom ($3.1M) over the data breach. California did not participate in the multistate action, having filed its own lawsuit; however, a bankruptcy judge ruled this month that the state cannot seek monetary relief due to its Chapter 11 reorganization plan.

The post 23andMe Pays $18 Million to Settle Multistate Data Breach Lawsuit appeared first on The HIPAA Journal.