The Massachusetts-based health center is planning to pay a settlement rather than take the class action suit to court.

 

What happened

Brockton Neighborhood Health Center, which manages three clinics in Brockton, Massachusetts, recently agreed to pay an $825,000 settlement after a data breach in 2024.

According to the settlement agreement, the data breach impacted 97,488 individuals and was first identified on November 3rd, 2024. Soon after the breach, multiple class action lawsuits were filed, broadly alleging that the breach could have been prevented and that Brockton failed to adequately implement cybersecurity measures. Ultimately, these lawsuits were consolidated into the complaint Howard, et al. v. Brockton Neighborhood Health Center, Inc.

 

The backstory

The lawsuit stems from a 2024 ransomware attack believed to be linked to the threat group Interlock. The group allegedly obtained patient data, including names, addresses, dates of birth, diagnoses/conditions, lab test results, medications, other treatment information, medical record numbers, and additional health insurance information. According to Ransomware Live, Interlock had leaked screenshots of data to prove they had it. The screenshots no longer appear available, which could imply that the data has been sold or that the ransom was paid, but it is impossible to know for sure.

 

In the know

According to Ransomware Live, which collects data from around the world on ransomware attacks, Interlock has approximately 140 known victims and frequently targets healthcare groups alongside manufacturing industries and educational institutions.

The group first emerged in 2024 but has accelerated rapidly, especially because they also work with affiliates to attack more organizations. The FBI has described Interlock’s methods as “uncommon,” like encouraging downloads from compromised websites, which can make it harder for organizations to prevent their attacks.

The group has claimed numerous victims, with one of the most prominent attacks against DaVita health in 2025, which led to over two million individuals having their data exposed and costing DaVita an estimated $13.5 million in expenses, not even including the $15 million lawsuit the organization settled.

 

The big picture

Every data breach has consequences far beyond the initial attack. While the attack is immediately felt by patients and service providers, who may have to delay treatment or cancel appointments, the organization as a whole takes a financial hit as they revamp their cybersecurity, potentially pay a ransom, or go through legal battles. According to Paubox reports, it’s estimated that the average cost of a data breach is $10.93 million.

Brockton’s class action lawsuit settlement is relatively low, compared to settlements in the millions, but it’s only one part of the story. Brockton Neighborhood Health is a non-profit, which means they likely have tighter margins and may not be able to regularly afford cybersecurity updates. Despite generally having lower budgets, these community hospitals serve a great need in the area, providing care to people who may not otherwise be able to afford it. Brockton’s financial health won’t just impact the company and employees; it also impacts their ability to provide care.

 

FAQs

Do data breach lawsuits always get consolidated? Why do multiple lawsuits get filed?

It’s become very common for class action suits to be filed following a data breach, and these suits are generally successful. Furthermore, the class representatives receive an additional monetary award for their service, incentivizing individuals to file and leading to multiple lawsuits.

 

Does the public find out when ransomware groups are paid?

It’s possible for the public to become aware, but many organizations avoid publicizing it because it is strongly advised against by the FBI, as it can lead to being targeted again and embolden threat actors to continue their work. Despite the risks, many organizations pay the ransoms because of the significant pressure and in hopes of avoiding data being sold.