Rady Children’s Hospital sued over Blackbaud breach

Law360 is reporting that Rady Children’s Hospital has been sued over the Blackbaud ransomware breach. The complaint alleges violations of California’s Confidentiality of Medical Information Act .

The hospital had reported in October that they were notifying 19,788 about the breach.

Access to the Law360 article is restricted to subscribers, but DataBreaches.net’s tracking file on the Blackbaud breach indicates that Rady had reported that the types of data involved included:

Names, addresses, physician, date of admission, department of service, and date of birth. In a minority of instances, procedure name was also involved. Finally, a single financial account number for one individual also was involved.

This is not the first civil suit as a result of the Blackbaud incident. By November 3, BleepingComputer had reported that there were already 23 potential class action lawsuits filed.

The lawsuit against Rady’s was brought by a John Doe minor through his guardian, Latasha Pope.

Update:  A commenter added a link which provides some additional details on the lawsuits facing Blackbaud:.

Blackbaud is also dealing with many other class action lawsuits in relation to the breach. A minimum of 23 putative class action lawsuits have been initiated against Blackbaud according to its 2020 Q3 Quarterly Filing with the U.S. Securities and Exchange Commission. The legal actions have been submitted in 17 federal courts, 4 state courts, and 2 Canadian courts.  Each claims victims of the breach have been impacted due to the theft of their personal data.

Blackbaud also claimed that over 160 claims have been registered from its customers and their attorneys in the U.S., U.K., and Canada. Blackbaud is also being audited by government bodies and regulators, including 43 state Attorneys General and the District of Columbia, the Department of Health and Human Services, Federal Trade Commission, Office of the Privacy Commissioner of Canada, and the U.K GDPR data protection authority, the Information Commissioner’s Office.