The settlement follows a class action suit over a breach that impacted approximately 115,940 individuals.

 

What happened

Jefferson County Health Department (JCHD) recently agreed to pay a $2.25 million settlement in the case of J.D., et al. v. Jefferson County Health Center d/b/a Jefferson County Health Department. Jefferson County, located in HIllsboro, Missouri, is facing the suit after a large data breach impacted their systems in the fall of 2022. A final fairness hearing, which is expected to pass the settlement, is scheduled for December 10th, 2026.

 

Going deeper

The lawsuit stated that patients would not have sought healthcare services from the health center if they knew their data would not be protected. The lawsuit also made claims that JCHD failed to implement appropriate cybersecurity measures, alongside claims that the company was negligent, in breach of contract, and violated the covenant of good faith and fair dealing, a law stating that every contract includes an unwritten promise that each party will not try to harm or cheat the other.

JCHD initially filed a motion to dismiss the lawsuit, but it was denied by the court. Both the plaintiff and defendant ultimately agreed to a settlement. Under the terms, Jefferson County Health Department does not have to admit any wrongdoing, they also maintain that there was no liability or damages. The $2.25M settlement fund will go towards attorneys’ fees and expenses, service awards for the class representatives, and benefits for the class members.

 

The backstory

The lawsuit follows the data breach Jefferson County Health Department faced in 2022. The incident itself was discovered by JCHD on November 15th, 2022, but through an investigation, the organization discovered the network had been accessed between October 31st and November 15th.

Uniquely, no ransomware or other malicious organization claimed the incident, so it remains unclear what group initiated the attack. It is possible that JCHD’s investigation uncovered who the attacker was, but it is rare for that information to make it to the public.

The incident resulted in the following information being viewed or obtained: names, dates of birth, Social Security numbers, driver’s license numbers, financial account information, medical information, and health insurance information. The incident impacted 115,940 individuals.

 

The big picture

The Department of Health and Human Services is still actively investigating a data breach at the City of St. Joseph’s Health Department (impacting 11,538 individuals) and the Central District Health Department of Nebraska (impacting 58,519 individuals). All of these incidents show that even organizations that would appear to be well-prepared may not be ready for the sophisticated and evolving technology used by attackers. In many cases, these smaller health departments rely on legacy systems or older strategies to prevent attacks, like looking for spelling errors in phishing emails, which is now no longer 100% effective.

 

FAQs

Why would no threat actor claim the attack?

Many malicious actors claim attacks publicly in order to try to garner attention, which can help them pressure organizations into paying ransoms. However, in some cases, threat actors simply sell the data and never claim the attack, attempting anonymity to avoid attention from law enforcement.

 

Are health departments big targets for attackers?

Health departments aren’t necessarily more targeted than other healthcare organizations, but they do hold sensitive data and can be known for having legacy (outdated) systems.