Akeela Data Breach Settlement Gets First Nod from the Court

Posted by Steve Alder

In June of last year, we reported that a settlement had been agreed to resolve a class action lawsuit against Akeela, Inc., over a June 2023 cybersecurity incident and data breach. The case was stayed until July 18, 2025, and ahead of that date, the plaintiff was required to move for preliminary approval of class certification. Ahead of that date, the plaintiff, Jessica McRorie, dismissed her complaint without prejudice and immediately joined a separate complaint, Batin et al. v. Akeela, Inc., which made substantially similar allegations. The Batin case, filed in the Superior Court for Anchorage, Alaska, has recently been settled, and the settlement has received preliminary approval from the court.

The Batin case lists Jessica McRorie, Elynnie Batin, Jane Doe, Rocky Hawley, Andrew Metcalf, Thomas Maxim, and Kathleet Yarr (Personal Representative for the Estate of Ian Christiansen) as plaintiffs, who allege that their names, Social Security numbers, dates of birth, and medical diagnosis and treatment information were exposed to cybercriminals as a result of the negligence of Akeela. Akeela is alleged to have failed to adequately secure its network, which allowed cybercriminals to access patients’ sensitive data.

The defendant denies the claims and contentions in the lawsuit and disputes the facts, including that any damages have been suffered as a result of the data breach or that the action satisfies the requirements to be certified or tried as a class action. To avoid continuing with the litigation, which would likely be protracted and expensive, and to avoid the uncertainty of a trial, a settlement was agreed.

Compared to most settlement agreements to resolve class action data breach lawsuits, the benefits are limited. Class members may submit a claim for two years of credit monitoring and identity theft protection services, and a pro rata cash payment may be claimed. The cash payments will be paid from the remainder of a $50,000 settlement fund after credit monitoring costs have been deducted.  Attorneys’ fees and other costs and expenses will be paid separately by Akeela. The deadline for objection and exclusion is April 13, 2026; the claims deadline is May 25, 2026, and the final approval hearing has been scheduled for April 13, 2026.

June 4, 2025: Akeela Inc. Agrees to Settlement to Resolve Class Action Data Breach Litigation

Akeela Inc., an Anchorage, AK-based provider of mental health and substance use disorder treatment services, has agreed to settle a class action lawsuit filed in response to a 2023 data breach that exposed the protected health information of more than 284,000 individuals.

On or around June 22, 2023, Akeela experienced a disruption to its IT network. The forensic investigation confirmed there had been unauthorized network access and the exfiltration of administrative files containing patients’ protected health information. The stolen information included names, dates of birth, diagnosis and treatment information, and Social Security numbers.

In August 2024, a class lawsuit – Jessica McRorie v. Akeela Inc. – was filed in the United States District Court for the District of Alaska over the data breach. The lawsuit alleged Akeela was negligent by failing to secure and safeguard patients’ personally identifiable and protected health information and did not comply with industry-standard data security practices, even though there was a known risk that cybercriminals actively target healthcare providers. The lawsuit claims Akeela maintained sensitive data in a reckless manner, and as a direct consequence of its negligence, sensitive patient data is now in the hands of cybercriminals.

Further, when the breach was detected, Akeela delayed issuing notification letters to the affected individuals, who were informed that their sensitive data had been stolen more than a year after the data breach was identified. The lawsuit claims that the delay diminished the plaintiff and class members’ ability to timely and thoroughly mitigate and address the harms resulting from the data breach.

The lawsuit claims the plaintiff and class members have suffered concrete injuries as a result of the data breach, including financial costs from mitigating the risk and imminent threat of identity theft and fraud, lost of time and productivity, actual identity theft and fraud, deprivation of the value of their private information, loss of privacy, and emotional distress, anxiety, and stress. In addition to claims for negligence and negligence per se, the lawsuit asserted claims of breach of implied contract, breach of fiduciary duty, invasion of privacy, and unjust enrichment.

Akeela maintains there was no wrongdoing and denies all of the claims and contentions in the lawsuit; however, the healthcare provider agreed to settle the litigation to avoid further legal costs and the uncertainty of trial. Details of the settlement agreement have yet to be made public; however, the plaintiff and Akeela have reached an agreement in principle on an appropriate settlement. Notices for class members and the motion for preliminary approval from the court are now being prepared.

This post will be updated when the settlement receives preliminary approval from the court.

The post Akeela Data Breach Settlement Gets First Nod from the Court appeared first on The HIPAA Journal.

Navia Benefit Solutions Discloses Data Breach Affecting 2.7 Million Individuals

Posted by Steve Alder

Over a three-week period between December 2025 and January 2026, hackers had access to the network of a Washington-based employee benefits administrator and potentially acquired the data of almost 2.7 million current and former participants and their dependents.

Renton, WA-based Navia Benefit Solutions, Inc., provides employee benefits administration services, including Health Care Flexible Spending Accounts and COBRA benefits. The company works with employers to manage tax-advantaged healthcare and dependent care accounts, and as such, maintains large amounts of employee data. The company has more than 10,000 clients nationwide and more than 1 million participants. The intrusion was identified on or around January 15, 2026, and the forensic investigation confirmed that its computer environment was subject to unauthorized access from December 22, 2025, to January 15, 2026. According to the breach notice provided to the Maine Attorney General, 2,697,540 individuals have been affected.

Navia Benefit Solutions uploaded a substitute breach notice to its website on March 13, 2026, and individual notification letters started to be mailed to the affected individuals on March 18, 2026. Data potentially compromised in the incident included names, email addresses, phone numbers, and Social Security numbers. The affected individuals have been offered complimentary credit monitoring and identity theft protection services for 12 months.

Navia Benefit Solutions said it moved quickly to respond to the incident and secure its systems, and an investigation was launched to determine the nature and scope of the incident. Federal law enforcement was notified, and the company has been working to implement additional security measures and provide its employees with additional training to prevent similar incidents in the future. Navia Benefit Solutions did not disclose whether this was a ransomware attack or if it received a ransom demand. No ransomware group has claimed responsibility for the incident.

The data breach is a reportable incident under HIPAA. The Department of Health and Human Services has been notified, and a media notice has also been issued, in compliance with the HIPAA Breach Notification Rule. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal. While it is unclear how many clients have been affected, the Washington State Health Care Authority is one of the affected clients. Navia Benefit Solutions contracted with the Washington State Health Care Authority as the administrator of its Flexible Spending Arrangement (FSA) and Dependent Care Assistance Program (DCAP) for the PEBB and SEBB Programs.

Washington State Health Care Authority, which manages Medicaid in the state, has published its own substitute breach notice. The notice confirms that records going back seven years were compromised in the incident, which relate to approximately 27,000 current and former PEBB members, 5,600 current and former SEBB members, and 3,000 current and former Compacts of Free Association (COFA) islander members. In addition, 37 school districts that contracted with Navia before the SEBB Program was implemented in January 2020 have also been notified that some of their data was potentially compromised in the incident. The impacted data includes first and last names, Navia ID numbers, addresses, phone numbers, email addresses, enrollment start and end dates, employee IDs, Social Security numbers, and dates of birth.

The post Navia Benefit Solutions Discloses Data Breach Affecting 2.7 Million Individuals appeared first on The HIPAA Journal.

Essen Medical Associates Agree to $4 Million Settlement to Resolve Class Action Data Breach Lawsuit

Posted by Steve Alder

Essen Medical Associates has agreed to pay $4,000,000 to resolve class action litigation over a March 2023 cyberattack and data breach that affected 904,672 current and former patients. Essen Medical, a New York-based healthcare provider, experienced a cyberattack that saw hackers access its network between March 14, 2023, and March 22, 2023.

Data exposed in the incident included personally identifiable information and protected health information such as names, driver’s license numbers/state identification numbers, U.S. alien registration numbers, non-U.S. identification numbers, passport numbers, financial account information, dates of birth, Social Security numbers, medical treatment information, and health insurance information.

The data breach sparked several class action lawsuits, which were consolidated – Rivera, et al. v. Essen Medical Associates, P.C – in the Supreme Court of the State of New York, County of Bronx. The consolidated lawsuit alleged that the cyberattack was preventable and was the result of the defendant’s failure to implement adequate and appropriate cybersecurity procedures and protocols. The lawsuit claimed that the defendants recklessly maintained data on systems vulnerable to cyberattacks.

The lawsuit asserted claims for negligence, breach of implied contract, breach of fiduciary duty, unjust enrichment, and violation of the New York Deceptive Trade Practices Act. Essen Medical denies all charges of wrongdoing or liability, and all claims or contentions alleged against it. All parties agreed that a settlement was the best outcome, and class counsel and the six class representatives believe that the settlement is fair. The settlement has recently received preliminary approval from the court and awaits final approval.

Under the terms of the settlement, Essen Medical will establish a $4,000,000 settlement fund to cover attorneys’ fees and expenses, service awards for the class representatives, and all costs related to the settlement. The attorneys’ fees will be no more than 33.33% of the settlement fund, and the service awards will be no more than $3,000 per class representative. The remainder of the fund will be used to pay for class member benefits.

Class members may submit a claim for documented, unreimbursed losses due to the data breach up to a maximum of $5,000 per class member. In addition, a claim may be submitted for a cash payment of up to $100 per class member. The deadline for objecting to the settlement and exclusion is May 4, 2026. Claims must be submitted by June 1, 2026, and the final fairness hearing has been scheduled for July 7, 2026.

The post Essen Medical Associates Agree to $4 Million Settlement to Resolve Class Action Data Breach Lawsuit appeared first on The HIPAA Journal.

FDA Issues Recall Notice for GE HealthCare Centricity Universal Viewer

Posted by Steve Alder

A class 2 recall has been issued by the U.S. Food and Drug Administration (FDA) for certain GE HealthCare Centricity medical imaging products due to a vulnerability that could potentially be exploited by an unauthorized individual to manipulate data or impact system availability. Centricity Universal Viewer is a device that displays medical images such as mammograms and data from various imaging sources. The vulnerability affects the following Centricity Universal Viewer software versions:

  • Versions 5.0 SP6 through UV 5.0 SP7.1
  • Versions 6.0 through 6.0 Sp10.4.1
  • Versions 7.0 through 7.0 Sp2.0.1

The recall was issued as the vulnerability may cause temporary or medically reversible adverse health consequences, but where the probability of serious adverse health consequences is remote. The vulnerability is due to user login credentials being exposed on the local client workstation. As such, an unauthorized individual could obtain the credentials and potentially impact system availability and/or manipulate data; however, the potential for exploitation is limited, as direct physical access to the local workstation is required.

There have been no known cases of exploitation of the vulnerability nor any known unauthorized access to patient data, according to GE Healthcare. The vulnerability was discovered by GE Healthcare during routine testing, and the company is working on a permanent fix. GE HealthCare has issued instructions for customers to follow to allow them to continue using their devices until the fix is issued.

According to the FDA’s recall notice, in order to continue using the affected products, users must ensure that appropriate security controls are implemented, as stated in the product manuals. Network account authentication should be implemented by using Active Directory/LDAP services for user management. If network authentication is not possible, users should contact GE Healthcare to request temporary steps to mitigate the issue.

The post FDA Issues Recall Notice for GE HealthCare Centricity Universal Viewer appeared first on The HIPAA Journal.