Top Class Actions reports a settlement in a lawsuit stemming from a 2019 phishing incident that reportedly impacted or potentially impacted 68,039 patients: The Methodist Hospitals Inc. has agreed to pay up to $425,00 to settle a class action lawsuit that alleges it failed to adequately protect patients’ personal information from being exposed in a…
Category: Health Data
Anonymous mental health app Feelyou accidentally exposed 70,000 personal emails
Mikael Thalen reports Owned by the Japan-based company bajji, Feelyou is self-described as the first journaling and social mood tracking app. It allows users to share their feelings with others either publicly or anonymously. It’s tagline is, “It’s O.K. not to be O.K.” …. Up until last week, however, anyone could obtain the personal email addresses of…
Justice Department Seizes and Forfeits Approximately $500,000 from North Korean “Maui” Ransomware Actors and their Conspirators
The Justice Department today announced a complaint filed in the District of Kansas to forfeit cryptocurrency paid as ransom to North Korean hackers or otherwise used to launder such ransom payments. In May 2022, the FBI filed a sealed seizure warrant for the funds worth approximately half a million dollars. The seized funds include ransoms…
In yet another long gap to notification, a covered entity notifies patients of a May 2021 cyberattack
On May 5, 2021, Benson Health in North Carolina (formerly known as Benson Area Medical Center) discovered that it was the target of a cyberattack. According to their notification dated July 7, 2022, they immediately launched an investigation, engaged a law firm specializing in cybersecurity and data privacy, and engaged third-party forensic specialists to assist….
BJC HealthCare settles class action litigation
In May 2020, DataBreaches noted that BJC Healthcare in Missouri was alerting patients to a data breach. The breach had first been discovered on March 6, shortly after three employee email accounts were compromised. At the time of notification, BJC Healthcare reported that investigators were unable to determine if any emails or attachments had actually…
This post provides substitute breach notification to one patient Oregon Health & Science University could not otherwise directly notify
Federal regulations requjire substitute notice when notification by postal mail or other direct means cannot be made, but I cannot recall ever seeing a substitute notice that announced it was only being made for one particular patient. The following was published by the Oregon Health & Science University: On May 16, 2022, a computer belonging…