Etairos will pay approximately $146,500 to victims, even as they work to financially recover from the attack.

 

What happened

Etairos Health has agreed to settle a class action lawsuit stemming from a 2024 data breach. In May 2024, Isabel Garcia Bueno filed a lawsuit asserting that Etairos was negligent and breached its implied contract.

Now, Etairos has reached a settlement of $146,500, which will go towards attorneys’ fees and expenses, the service award for Garcia Bueno, and benefits for the class action members.

The final approval hearing is scheduled for January 20th, 2027, in the Circuit Court for the Sixth Judicial Circuit in Pinellas County, Florida.

 

The backstory

According to the settlement agreement, the breach itself took place on February 20th, 2024, when the ransomware group Qilin breached Etairos’ network and accessed employee information, including names, phone numbers, addresses, government-issued ID numbers and Social Security numbers. Accessed data included information from both current and former employees.

Etairos Health is a home health care company that serves patients throughout Florida and employs over 500 individuals.

 

In the know

According to Ransomware Live, which tracks data breaches and ransomware gangs, the breach was claimed by ransomware group Qilin. According to the Office of Information Security, Qilin is a ransomware-as-a-service (RaaS) provider that has been operating since 2022 with a likely connection to Russia. The group was seen recruiting affiliates via a hacking forum in 2023. The gang was initially called “Agenda,” but rebranded soon after its initial launch.

 

Why it matters

While Paubox covers many different ransomware gangs, recent reports have found Qilin to be one of the most persistent attackers. Qilin is also difficult to protect against because of their varying attack strategies, which frequently evolve and utilize multiple types of encryption. They make a unique case study because they have a defined business structure, even offering customer support and legal counsel in some ransomware negotiations. According to Ransomware Live, they’ve attacked almost 2500 different organizations, and have attacked US organizations 993 times. While they most frequently attack companies in the manufacturing industry, healthcare is also one of their top targets. One of their most prominent attacks was against Synnovis in the United Kingdom, an NHS pathology services provider. The incident resulted in thousands of appointment cancellations and over $30 million in losses.

 

FAQs

Why do hospitals get in trouble when they are attacked?

Hospitals are often victims of healthcare data breaches, forced to recover financially and operationally. Unfortunately, hospitals also have a responsibility to carefully handle data, even though that job gets harder and harder with the continued advent of new attack strategies and methods. With the proper tools, regular risk assessments and auditing, however, it’s possible for organizations to avoid attacks and thus legal repercussions.

 

Are employees of hospitals protected by HIPAA?

No, HIPAA protects patients, but generally does not apply to employees. In this case, health information was not involved in the data breach, but rather other personally identifiable information (PII). However, even though this breach didn’t result in a violation of HIPAA, the lawsuit alleges that Etairos should have also kept employee data safe.

 

Are organizations that sell RaaS worse than normal ransomware gangs?

Organizations that sell their services are typically larger, more robust, and financially stronger than other gangs. These organizations are more dangerous overall because they help less skilled actors carry out attacks. Disrupting RaaS groups tends to be a higher priority for law enforcement than smaller threat gangs.