The New York management service has agreed to pay $1.5 million to resolve a lawsuit.
The billing and professional service provider is paying $1.5 million to resolve a class action suit that stemmed from a ransomware attack.
On April 12th, 2022, the company experienced a ransomware attack that led to unauthorized access to sensitive information, including names, addresses, dates of treatment, health plan numbers, Medicare, medicaid numbers, and medical record numbers.
Practice Resources LLC serves numerous healthcare clients, and the incident reportedly affected patients of at least 28 different healthcare organizations.
The company reported the breach to the Health and Human Services’ Office for Civil Rights, stating that the incident impacted 942,138 individuals.
Following the breach, multiple lawsuits were filed. Ultimately, they were consolidated into the U.S. District Court for the Northern District of New York, titled In re Practice Resources LLC Data Security Breach Litigation.
In the suit, plaintiffs alleged that the data theft could have been prevented if Practice Resources had implemented reasonable and appropriate cybersecurity measures. According to the plaintiffs, the lack of following those measures was negligent.
As part of the settlement, Practice Resources has maintained that the company did not commit any wrongdoing. They also maintain that there is no evidence that any data was actually stolen in the attack.
The $1.5 million settlement fund will go towards covering attorneys’ fees, service awards, legal costs and expenses, and class members’ claims. Attorneys’ fees will be one-third of the settlement fund. Litigation costs and expenses are expected to total $19,253.46. Named plaintiffs are eligible to receive service awards of $2,500. Other class members, who are those who received a notification letter about the breach, will be eligible to submit claims for up to $5,000.
After the incident, Practice Resources has committed to enhancing their security with the goal of preventing similar security incidents in the future. Although the settlement has received preliminary approval from the court, the final fairness hearing has been scheduled for June 11th, 2025.
While the incident comes to a close, Practice Resources will likely feel the impact for years to come. Lawsuits like these not only damage organizational finances, but they can also leave a lasting mark on a company’s reputation.
Most class action suits settle because they are so expensive to litigate and the outcome is always uncertain. In general, organizations being sued weigh the likelihood of the case having a favorable outcome or an unfavorable one. If the company decides the risk of an unfavorable outcome is high, they are more likely to agree to a settlement.
Breaches are almost always preventable with strong cybersecurity measures. However, attackers are always improving their methods, meaning that cybersecurity must constantly evolve. By working with security software companies, like Paubox, organizations are more likely to prevent breaches.