Woman whose photos were leaked on dark web files class action over LVHN ransomware hack [The Morning Call]

A Philadelphia law firm has filed a class action suit against Lehigh Valley Health Network alleging the hospital has prioritized money over patient privacy after photos of cancer patients were posted on the internet in a ransomware hack.

The suit filed by Saltz Mongeluzzi & Bendesky focuses on photos that were published by hackers with the ransomware collective BlackCat over the last couple of weeks of cancer patients who received treatment through the network. The suit does not name a financial amount being sought for damages, instead requesting that the amount be determined by trial or the court.

The hackers acquired the photos through a ransomware attack on a physician’s practice owned by LVHN. The attack occurred in February and caused a leak of 132 gigabytes of patient data and photos. LVHN leaders have stated they refuse to pay the ransom, a tactic often touted by law enforcement and some cybersecurity experts, but in response, the hackers posted some of the photos online and have threatened to release more sensitive information if their demands are not met.

The suit filing states not only was the leak of these photos regrettable but that LVHN engaged in the “knowing, reckless, and willful, decision to let the hackers post the nude images” of Doe and others to the internet. And it accuses LVHN of “publicly patting itself on the back for standing up to the hackers” but “consciously and intentionally ignoring the real victims.”

The lead plaintiff, a woman from Lackawanna County referred to as Jane Doe, was informed by the network March 6 that photos of her receiving breast cancer treatment, which showed her exposed chest and face, had been posted by the hackers. In the suit, it is stated that Doe did not even know that the photos were taken or stored by the network.

She was also told other information was likely stolen, including her address, email address, date of birth, Social Security number, health insurance provider, medical diagnosis and treatment information, medications, and lab results, the suit states. Doe is the only person named or described in the suit.

However, in a news release, Patrick Howard, an attorney with the firm, said the exact number of affected patients would be determined through pre-trial discovery process. The lawsuit also acknowledges that Doe does not have the money to pay for legal services nor would the damages as a result of an individual suit likely be substantial for her or anyone else, thus they are pursuing the case as a class action.

The suit also states that the hack itself was easily preventable and that by failing to do more to protect sensitive patient information it violated the Health Insurance Portability and Accountability Act of 1996.

LVHN representatives did not immediately respond to a request for comment Monday evening.

©2023 The Morning Call. Visit mcall.com. Distributed by Tribune Content Agency, LLC.