Legal News

Verkada Surveillance Camera Hacker Indicted on Multiple Counts of Conspiracy, Wire Fraud and Aggravated Identity Theft

Posted by HIPAA Journal

The Swiss hacktivist who gained access to the security cameras of the California startup Verkada in March 2021 has been indicted by the US. government for computer crimes from 2019 to present, including accessing and publicly disclosing source code and proprietary data of corporate and government victims in the United States and beyond.

Till Kottmann, 21, aka ‘tillie crimew’ and ‘deletescape’ resides in Lucerne, Switzerland and is a member of a hacking collective self-named APT 69420 / Arson Cats. Most recently, Kottman admitted accessing the Verkada surveillance cameras used by many large enterprises, including Tesla, Okta, Cloudflare, Nissan, as well as schools, correctional facilities, and hospitals. Live streams of surveillance camera and archived footage were accessed between March 7 and March 9, 2021, screenshots and videos of which were published online.

Ethical hackers often exploit vulnerabilities and gain access to systems and their efforts often result in vulnerabilities being addressed before they can be exploited by bad actors. The vulnerabilities are reported to the entities in question, and steps are taken to fix the vulnerabilities before details are publicly disclosed. In the case of Kottmann, responsible disclosure procedures were not followed. Sensitive information obtained from victims’ networks was publicly disclosed, with no attempts made to notify the breached entities directly prior to the disclosure of stolen data.

On March 18, 2021, Kottmann was indicted by a grand jury in the Western District of Washington for a string of computer intrusion and identity and data theft activities from 2019 to present. The indictment, which only names Kottmann, includes charges of one count of conspiracy to commit computer fraud and abuse, several counts of wire fraud, one count of conspiracy to commit wire fraud, and one count of aggravated identity theft.

Conspiracy to commit computer fraud and abuse carries a maximum jail term of 5 years, the wire fraud and conspiracy to commit wire fraud charges have a maximum jail term of 20 years, and the aggravated identity theft charge has a mandatory 24-month jail term, which runs consecutively to other sentences.

According to the indictment, Kottmann and co-conspirators hacked the systems of dozens of companies and government entities and published data stolen from more than 100 companies on the Internet. Kottmann most often targeted git and other source code repositories, and cloned the source code, files, and other confidential information, which often included access codes, and hard-coded credentails, and other means of gaining access to corporate networks. Kottmann then used the stolen credentials for further intrusions, often copying additional information from victims’ networks before leaking the stolen data online.

According to the indictment, Kottmann would speak with the media and publish information on social media networks about her role in the hacks “to recruit others, grow the scheme, and further promote the hacking activity and Kottmann’s own reputation in the hacking community.”

The FBI’s cyber task force led the investigation into Kottmann, with Swiss law enforcement executing a search warrant of Kottmann’s property in Lucerne on March 12, 2021 that resulted in computer equipment being seized. The FBI recently seized a domain that was operated by Kottmann and used to publicly disclose stolen data.

“Stealing credentials and data, and publishing source code and proprietary and sensitive information on the web is not protected speech–it is theft and fraud,” said Acting U.S. Attorney Tessa M. Gorman.  “These actions can increase vulnerabilities for everyone from large corporations to individual consumers.  Wrapping oneself in an allegedly altruistic motive does not remove the criminal stench from such intrusion, theft, and fraud.”

The post Verkada Surveillance Camera Hacker Indicted on Multiple Counts of Conspiracy, Wire Fraud and Aggravated Identity Theft appeared first on HIPAA Journal.

More Health Insurers Confirmed as Victims of Accellion Ransomware Attack and Multiple Lawsuits Filed

Posted by HIPAA Journal

The number of healthcare organizations to announced they have been affected by the ransomware attack on Accellion has been increasing, with two of the latest victims including Trillium Community Health Plan and Arizona Complete Health.

In late December, unauthorized individuals exploited zero-day vulnerabilities in Accellion’s legacy File Transfer Appliance platform and stole data of its customers before deploying CLOP ransomware.

Trillium Community Health Plan recently notified 50,000 of its members that protected health information such as names, addresses, dates of birth, health insurance ID numbers, and diagnosis and treatment was obtained by the individuals behind the attack and the data was posted online between January 7 and January 25, 2021.

Trillium said it has now stopped using Accellion, has removed all data files from its systems, and has taken steps to reduce the risk of future attacks, including reviewing its data sharing processes. Trillium is offering affected members complimentary credit monitoring and identity theft protection services for 12 months.

Arizona Complete Health has notified 27,390 of its plan members that they were affected by the attack and the same types of data have been compromised. The health plan has also stopped using Accellion and removed its data from its systems and offered plan members complimentary credit monitoring and identity theft protection services for 12 months.

Previously, the Ohio-based supermarket and pharmacy chain Kroger announced that it had been affected by the attack and the protected health information of 368,000 customers had been compromised. The University of Colorado and Southern Illinois University School of Medicine have also said they have been affected.

Lawsuits Filed Against Accellion and its Customers

Multiple lawsuits have now been filed against Accellion and its customers over the breach. Centene Corp. has filed a lawsuit against Accellion alleging it refused to comply with several provisions of its business associate agreement (BAA). The cyberattack resulted in the theft of the protected health information of “a significant number” of its health plan members. Centene believes it will suffer significant costs as a result of the breach and has requested the courts order Accellion to comply with the terms of its BAA and cover all breach-related expenses. Cenene said in the lawsuit that 9 gigabytes of its data was obtained by the attackers.

A federal lawsuit has also been filed against Kroger over the breach. The lawsuit, which seeks class action status, alleges Kroger was negligent and was fully aware of the potential security issues with the legacy file transfer solution, yet failed to upgrade to a more secure solution even after being encouraged to do so by Accellion. Kroger offered its customers 2-years of credit monitoring and identity theft protection services; however, since names, addresses, dates of birth, medical information and Social Security numbers were compromised, 2 years is not viewed as anywhere close to sufficient to protect kroger customers from identity theft and fraud.

The post More Health Insurers Confirmed as Victims of Accellion Ransomware Attack and Multiple Lawsuits Filed appeared first on HIPAA Journal.

NY Nurse Pleads Guilty to Tampering with a Consumer Product in HIPAA Case

Posted by HIPAA Journal

A former Roswell Park Comprehensive Cancer Center nurse has pleaded guilty to tampering with a consumer product in a case involving fraud and HIPAA violations.

In 2018, 6 patients of Roswell Park Comprehensive Cancer Center contracted a Sphingomonas paucimobilis bloodstream infection within the space of a few weeks. An investigation found syringes of hydromorphone had been contaminated with the bacteria. The cancer center suspected a nurse had removed some of the medication and replaced it with an equal volume of water.

Kelsey Mulvey, 28, of Grand Island, NY, was placed on administrative leave in June 2018 after it was discovered she had stolen pain medication and resigned from her position at the cancer center in July 2018. Appropriate authorities were notified including the New York State Department of Health, the NYS Department of Education, Bureau of Narcotics and Tobacco Enforcement, and the U.S. Drug Enforcement Agency and  in July 2019, Kelsey was charged by the U.S. Attorney’s office with tampering with a consumer product, acquiring controlled substances by fraud, and criminal violations of the HIPAA Rules.

Mulvey was accused of taking drugs such as hydromorphone, methadone, oxycodone and lorazepam intended for patients, adding water to the vials to hide the theft, and placing the vials with the diluted medication into the automated medication system. She is believed to have failed to administer pain medication to 81 patients between February 2018 and June 2018.

Mulvey admitted to accessing patient records without authorization to find patients who had been prescribed the drugs she wanted, then using the drugs, and refilling the vials with water.

Mulvey entered into a plea deal with prosecutors for one count of tampering with a consumer product, with the fraud and HIPAA violations both dropped. Under the terms of the plea deal, Mulvey will be sentenced to a maximum of 97 months in jail, have supervised release at the end of the jail term, and will be required to pay restitution to the victims. She has also had her medical license permanently revoked.

The post NY Nurse Pleads Guilty to Tampering with a Consumer Product in HIPAA Case appeared first on HIPAA Journal.

Multistate Settlement Resolves 2019 American Medical Collection Agency Data Breach Investigation

Posted by HIPAA Journal

A coalition of 41 state Attorneys General has agreed to settle an investigation into Retrieval-Masters Creditors Bureau dba American Medical Collection Agency (AMCA) over a 2019 data breach that resulted in the exposure/theft of the protected health information of 21 million Americans.

Retrieval-Masters Creditors Bureau is a debt collection agency, with its AMCA arm providing small debt collection services to healthcare clients such as laboratories and medical testing facilities.

From August 1, 2018 until March 30, 2019, an unauthorized individual had access to AMCA’s systems and exfiltrated sensitive data such as names, personal information, Social Security numbers, payment card information and, for some individuals, medical test information and diagnostic codes. The AMCA data breach was the largest healthcare data breach reported in 2019.

AMCA notified states about the breach starting June 3, 2019, and individuals affected by the breach were offered two years of complimentary credit monitoring services. The high cost of remediation of the breach saw AMCA file for bankruptcy protection in June 2019.

The multi-state investigation into the breach was led by the Indiana, Texas, Connecticut, and New York Attorneys General, with the Indiana and Texas AGs also participating in the bankruptcy proceedings to ensure that the investigation continued, and the personal and protected health information of breach victims was protected. AMCA received permission from the bankruptcy court to settle the multistate action and filed for dismissal of the bankruptcy on December 9, 2020.

The multistate investigation confirmed information security deficiencies contributed to the cause of the breach and despite AMCA receiving warnings from banks that processed AMCA payments about fraudulent use of payment cards, AMCA failed to detect the intrusion.

Under the terms of the settlement, AMCA is required to create and implement an information security program, develop an incident response plan, employ a qualified chief information security officer (CISO), hire a third-party assessor to perform an information security assessment, and continue to assist state attorneys general with investigations into the data breach.

A financial penalty of $21 million has been imposed on AMCA which will be distributed pro rata between the affected states; however, due to the financial position of the company, the $21 million financial penalty has been suspended. That payment will only need to be made if AMCA defaults on the terms of the settlement agreement.

“AMCA is a cautionary tale: When a company does not adequately invest in information security, the costs associated with a data breach can lead to bankruptcy – destroying the business and leaving affected individuals in harm’s way,” said Connecticut Attorney General Tong. “My office will continue to work to protect personal information even where the business that had the responsibility to do so cannot.”

“AMCA’s security failures resulted in 21 million Americans having their data illegally accessed. I am committed to protecting New Yorkers’ personal data and will not hesitate to hold companies accountable when they fail to safeguard that information,” said New York Attorney General Letitia James. “Today’s agreement ensures that the company has the appropriate security and incident response plan in place so that a failure like this does not take place again.”

Indiana, Texas, Connecticut, and New York led the investigation and were assisted by Florida, Illinois, Maryland, Massachusetts, Michigan, North Carolina, and Tennessee. The Attorneys General of Arizona, Arkansas, Colorado, the District of Columbia, Georgia, Hawaii, Idaho, Iowa, Kansas, Kentucky, Louisiana, Maine, Minnesota, Missouri, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Utah, Vermont, Virginia, Washington, and West Virginia also joined the settlement.

The post Multistate Settlement Resolves 2019 American Medical Collection Agency Data Breach Investigation appeared first on HIPAA Journal.

FTC Urged to Enforce Breach Notification Rule When Fertility Tracking Apps Share User Data Without Consent

Posted by HIPAA Journal

On March 4, 2021, Senator Robert Menendez (D-New Jersey), and Reps. Bonnie Watson Coleman (D-New Jersey) and Mikie Sherrill (D-New Jersey) wrote a letter urging the Federal Trade Commission (FTC) to start enforcing the Health Breach Notification Rule.

The Federal Trade Commission (FTC) has a mandate to protect Americans from bad actors that betray consumer trust and misuse consumers’ healthcare data and has the authority to take enforcement action but is not enforcing compliance with the Health Breach Notification Rule.

The Health Breach Notification Rule was introduced as part of the American Recovery and Reinvestment Act of 2009 and requires vendors of personal health records, PHR related entities, and third-party service providers to inform consumers about unauthorized disclosures of personal health information.

The Health Breach Notification Rule applies to entities not covered by the Health Insurance Portability and Accountability Act (HIPAA), and has similar provisions to the HIPAA Breach Notification Rule. While the HHS’ Office for Civil Rights has enforced compliance with the HIPAA Breach Notification Rule, the FTC has yet to take any enforcement actions against entities over violations of the Health Breach Notification Rule.

In the letter to the Honorable Rebecca Kelly Slaughter, FTC Acting Chair, the lawmakers urged the FTC to take enforcement actions against companies that fail to notify consumers about unauthorized uses and disclosures of personal health information, specifically disclosures of consumers’ personal health information to third parties without consent by menstruation tracking mobile app providers.

Over the past couple of years, several menstruation and fertility tracking apps have been found to be sharing app user data with third parties without consent. In 2019, a Wall Street Journal investigation revealed the period tracking app Flo was disclosing users’ personal health information to third parties without obtaining consent. While the Flo Health explained in its privacy policy that the personal health data of consumers would be safeguarded and not shared with third parties, consumer information was in fact being shared with tech firms such as Google and Facebook.

The FTC filed a complaint against Flo over the privacy violations and a settlement was reached between Flo Health and the FTC that required the app developer to revise its privacy practices and obtain consent from app users before sharing their health information, however, the complaint did not address the lack of notifications to consumers.

Flo is not the only period tracking app to disclose consumers’ personal health information without obtaining consent. The watchdog group International Digital Accountability Council determined the fertility tracking app Premom’s privacy policy differed from its actual data sharing practices, and the app was sharing user data without consent. In 2019, Privacy International conduced an investigation into privacy violations at another period tracking app and found user data was provided to Facebook before users could view changes to its privacy policy and provide their consent.

“Stronger [Health Breach Notification Rule] enforcement would be especially impactful in the case of period-tracking apps, which manage data that is both deeply personal and highly valuable to advertisers,” wrote the lawmakers. “Looking ahead, we encourage you to use all of the tools at your disposal, including the Health Breach Notification Rule, to protect women and all menstruating people from mobile apps that exploit their personal data.”

The post FTC Urged to Enforce Breach Notification Rule When Fertility Tracking Apps Share User Data Without Consent appeared first on HIPAA Journal.

Arizona High Court Revives Privacy Lawsuit Stemming from Pharmacy ED Medication Disclosure

Posted by HIPAA Journal

This week, the Arizona Supreme Court revived a HIPAA violation lawsuit filed by a Phoenix man over a privacy violation by a pharmacy employee related to an erectile dysfunction medication prescription.

Greg Shepherd, 50, had visited his doctor for a routine medical appointment in January 2016 and his doctor provided him with a erectile dysfunction medication sample. He received a call from the Costco pharmacy later and was told that the full prescription for the ED medication was available to collect. Shepherd explained that he did not want the medication and cancelled the prescription.

Shepherd called the pharmacy a month later to check whether an unrelated prescription was ready to collect, and the pharmacy informed again him that his ED prescription was still waiting to be collected. Shepherd declined the medication a second time and told the pharmacy to cancel the prescription for the second time.

Shepherd, who had been trying to reconcile with his ex-wife, authorized her to collect an unrelated, regular prescription refill from the pharmacy. When she visited the pharmacy, the pharmacy worker provided both prescriptions to Shepherd’s ex-wife, and the pharmacy worker and his ex-wife allegedly joked about the ED medication. The ED medication was refused by his ex-wife, and when she returned to Shepherd and gave him his regular medication, she informed him that she knew about the ED medication and told him there was no chance of reconciliation. The lawsuit also alleges his ex-wife discussed the ED medication with Shepherd’s children and her friends.

Shepherd filed a complaint with Costco about the privacy violation, and Costco responded and admitted that the discussion between the pharmacy worker and Shepherd’s ex-wife about the ED medication was in violation of the HIPAA Privacy Rule and company policies and issued an apology. Shepherd then took legal action over the privacy violation, with the lawsuit citing a violation of the HIPAA Privacy Rule.

There is no private cause of action in the Federal HIPAA legislation, which means individuals do not have the right to sue for a HIPAA violation. Only the HHS’ Office for Civil Rights and state Attorneys General can take legal action against HIPAA-covered entities for violations of the Health Insurance Portability and Accountability Act Rules.

The lawsuit was dismissed by the Maricopa County Superior Court, as HIPAA does not permit private lawsuits and because state laws provide immunity for healthcare providers over privacy violations that occur when they are acting in good faith. Shepherd appealed, but the Court of Appeals affirmed the dismissal of Shepherd’s claims, aside from the claim of negligent disclosure of medical information.

While there is no private cause of action in HIPAA, Supreme Court Justice William G. Montgomery ruled that the standards of HIPAA can be used in state court to establish privacy violations have occurred in negligence claims. Costco had sought to dismiss the lawsuit based on the lack of a private cause of action, but Montgomery said in his ruling that Shepherd’s lawsuit was not solely filed over violations of the HIPAA Privacy Rule. The lawsuit also alleged violations of regulations governing pharmacies, therefore Superior Court Judge Aimee L. Anderson had dismissed the lawsuit in error.

Costco argued that state laws provide protection for companies acting in good faith, and that without a claim of bad faith it is not possible to show negligence. Montgomery ruled that the lawsuit did not have to include a claim of bad faith, as Shepherd was not aware that Costco would claim immunity under state law.

The case has now been returned to the lower court for further proceedings. While the case has been revived, Shepherd must provide clear and convincing evidence that the pharmacy and the pharmacy worker acted in bad faith by making the disclosure about the ED medication to his ex-wife.

Shepherd’s attorney, Joshua Carden, believes it is possible to demonstrate that this was a bad faith disclosure, as the prescription was cancelled twice by Shepherd and it can be proven that the Costco pharmacy was aware that Shepherd did not want the prescription.

The post Arizona High Court Revives Privacy Lawsuit Stemming from Pharmacy ED Medication Disclosure appeared first on HIPAA Journal.

Virginia Consumer Data Protection Act Signed into Law

Posted by HIPAA Journal

The Virginia Consumer Data Protection Act (CDPA) has been signed into law by Governor Ralph Northam. CDPA requires persons conducting business in the Commonwealth of Virginia to comply with new data privacy and security requirements. The CDPA comes into effect on January 1, 2023.

The CDPA mirrors some of the privacy and security provisions of the EUs General Data Protection Regulation (GDPR) that took effect on March 25, 2018, and the California Consumer Privacy Act (CCPA) that took effect on January 1, 2020. While there are similarities with the GDPR and the CCPA, there are some differences, so compliance with either the CCPA or the GDPR does not guarantee compliance with the CDPA.

Like the CCPA, the CDPA only applies to organizations that control or process significant amounts of consumer data, with the data threshold twice as high as the CCPA, although there is no minimum revenue threshold in the CDPA.

The CDPA applies to any person or business that:

  • Controls or processes the personal data of 100,000 or more Virginia residents in a calendar year; or
  • Controls or processes the data of 25,000 or more Virginia residents in a calendar year and also derives 50% or more of its gross revenue from the sale of personal data.

Virginia Consumer Data Protection Act Exemptions

Entities already covered by certain Federal laws that include data privacy and security provisions are exempt from compliance with the CDPA. These are entities covered by:

  • The Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act.
  • The Gramm-Leach-Bliley Act (GLBA)

HIPAA-and GLBA-covered entities are fully exempt, not only for data collected that is covered by the respective acts, but also any other data which would otherwise be covered by the act.

There are also exceptions for data covered by the Children’s Online Privacy Protection Act (COPPA), the Fair Credit Reporting Act (FCRA), the Drivers Privacy Protection Act, the Farm Credit Act, the Family Educational Rights and Privacy Act, and personal data processed in employment contexts.

Other entities exempt from CDPA compliance are:

  • Any body, authority, board, bureau, commission, district, or Virginian agency or any Virginian political subdivision.
  • Nonprofit organizations.
  • Higher education institutions.

Virginia Consumer Data Protection Act Requirements

The CDPA covers the personal data of any consumer who is “a natural person who is a resident of the Commonwealth acting only in an individual or household context,” but not if they are “acting in a commercial or employment context.” The personal data definition is “any information that is linked or reasonably linkable to an identified or identifiable natural person.”

The CDPA does not apply to deidentified data nor to data in the public domain. The definition of data in the public domain is “information that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer has disclosed the information unless the consumer has restricted the information to a specific audience.”

CDPA prohibits covered entities from selling personal data without consent, with sale defined as “the exchange of personal data for monetary consideration by the controller to a third party.”

CDPA places restrictions on data collection, limiting information to what is “adequate, relevant and reasonably necessary in relation to the purposes for which the data is processed.” Data can only be used for purposes that are reasonably necessary and compatible with the purposes that consumers have consented to.

Covered entities must ensure that reasonable administrative, technical, and physical safeguards are implemented to protect any data collected or processed, and data controllers must conduct data protection assessments, although the frequency that assessments need to be performed is not defined.

Covered entities must also ensure that they provide consumers with a privacy policy that includes the types of data collected and processed, the reason for data processing, consumer rights and how they can be exercised, and consumers must be informed about the third parties with whom personal data are shared and the types of data that will be disclosed to third parties and consent must be obtained before data collection or processing.

Consumer Rights Under CDPA

Virginia residents are given the right to:

  • View the personal data held by a covered entity.
  • Correct errors in the personal data held by a covered entity.
  • Delete personal data held by a covered entity.
  • Obtain a copy of the personal data held by a covered entity.
  • Opt out of processing of personal data for targeted advertising purposes.
  • Appeal the denial of a business to act on a request within a reasonable time frame (45 days). A response to any appeal must be provided within 45 days.

Penalties for Noncompliance with the CDPA

There is no private right of action under the CDPA, so consumers cannot take legal action against a business if they believe their CPDA rights have been violated.  Enforcement of compliance lies with the Virginia Attorney General, which can impose a fine of up to $7,500 per violation. However, the state Attorney General must provide businesses with the opportunity to correct or “cure” the violation, with financial penalties applying only if those violations have not been “cured” within 30 days.

The post Virginia Consumer Data Protection Act Signed into Law appeared first on HIPAA Journal.

Whistleblower Who Falsely Claimed Nurse Violated HIPAA Jailed for 6 Months

Posted by HIPAA Journal

A Georgia man who falsely claimed a former acquaintance had violated patient privacy and breached the HIPAA Rules has been fined $1,200 and sentenced to 6 months in jail.

In October 2019, Jeffrey Parker, 44, of Rincon, GA, claimed to be a HIPAA whistleblower and alerted the authorities about serious privacy violations by a nurse at a Savannah, GA hospital, including emailing graphic pictures of traumatic injuries of hospital patients internally and externally.

According to court documents, Parker “engaged in an intricate scheme” to frame a former acquaintance for violations of the Federal Health Insurance Portability and Accountability Act’s Privacy Rule. To back up the fake claims, Parker created multiple email accounts in the names of real patients and used those accounts to send false accusations of privacy violations. Emails were sent to the hospital where the nurse worked, the Federal Bureau of Investigation (FBI), and the Department of Justice (DOJ).

Parker also alleged that he had been threatened for his actions as a whistleblower and law enforcement took steps to ensure his safety. When questioned about the threats and the HIPAA violations, an FBI agent identified irregularities in his story and upon further questioning, Parker admitted making fake accusations to frame the former acquaintance for fictional HIPAA violations.

“Falsely accusing others of criminal activity is illegal, and it hinders justice system personnel with the pursuit of unnecessary investigations,” said U.S. Attorney Bobby L. Christine, when Parker was charged. “This fake complaint caused a diversion of resources by federal investigators, as well as an unnecessary distraction for an important health care institution in our community.”

Parker pleaded guilty to one case of making false statements and potentially faced a 5-year jail term. He was sentenced to serve 6 months in jail by U.S. District Court Judge Lisa Godbey Wood.

“Many hours of investigation and resources were wasted determining that Parker’s whistleblower complaints were fake, meant to do harm to another citizen,” said Chris Hacker, Special Agent in Charge of FBI Atlanta. “Before he could do more damage, his elaborate scheme was uncovered by a perceptive agent and now he will serve time for his deliberate transgression.”

Parker is not eligible for parole and will serve the full term, followed by 3 years of supervised release.

The post Whistleblower Who Falsely Claimed Nurse Violated HIPAA Jailed for 6 Months appeared first on HIPAA Journal.

Wilmington Surgical Associates Facing Class Action Lawsuit Over Netwalker Ransomware Attack

Posted by HIPAA Journal

Wilmington Surgical Associates in North Carolina is facing a class action lawsuit over a Netwalker ransomware attack and data breach that occurred in October 2020.

As is now common in ransomware attacks, files were exfiltrated prior to the deployment of ransomware. In this case, the Netwalker ransomware gang stole 13GB of data from two Wilmington Surgical Associates’ servers that were used for administration purposes. Some of the stolen was published on the threat actors’ data leak site where it could be accessed by anyone.

The leaked data was spread across thousands of files and included financial information related to the practice, employee information, and patient data such as photographs, scanned documents, lab test results, Social Security numbers, health insurance information, and other sensitive patient information.

Wilmington Surgical Associates sent notifications to affected individuals in December 2020 and reported the data breach to the HHS’ Office for Civil Rights on December 17, 2020 as affecting 114,834 patients.

The lawsuit – Jewett et al. v. Wilmington Surgical Associates – was filed by Rhine Law Firm; Morgan & Morgan; and Mason Lietz & Klinger on February 10, 2021 and was recently removed to the US District Court for the Eastern District of North Carolina.

Plaintiffs Katherine Teal, Sherry Bordeaux, and Philip Jewett allege in the lawsuit that their sensitive personal and health information is now in the hands of cybercriminals, which places them at an elevated risk of identity theft and fraud and other damages such as the lowering of credit scores and higher interest rates. The plaintiffs also allege they have suffered ascertainable losses as a result of the security incident in terms of out-of-pocket expenses and time spent remediating the effects of the data breach.

The lawsuit alleges Wilmington Surgical Associates was negligent for failing to adequately safeguard patient data when it had been put on notice about the elevated risk of ransomware attacks. In addition, it is alleged that the North Carolina healthcare provider failed to adequately monitor its systems for network intrusions and failed to provide timely breach notifications to patients and adequate information on the types of information compromised in the attack.

The plaintiffs seek reimbursement of out-of-pocket expenses, compensation for time spent dealing with the aftereffects of the breach, restitution, injunctive relief, and adequate credit monitoring services for breach victims. The lawsuit also requires the courts to order Wilmington Surgical Associates to improve data security and undergo annual security audits.

The post Wilmington Surgical Associates Facing Class Action Lawsuit Over Netwalker Ransomware Attack appeared first on HIPAA Journal.