A Massachusetts hospital that was cyber-attacked in December is facing a class-action lawsuit over its alleged failure to protect its patients' personal information
See also: Tampa Hospital: Sensitive data of 1.2 million patients stolen
Anna Jaques Hospital in Newburyport experienced a major outage of its electronic health records and networked computers on December 24, 2023. The attack caused ambulances to be redirected to other hospitals on Christmas Day, until service was restored on December 26.
The nonprofit community hospital, a member of the Beth Israel Lahey, acknowledged on January 5 that an attack.
According to an article in “The Record” published by Recorded Future News, a hacker group called Money Message has publicly admitted to being behind the attack on the Anna Jaques Hospital. However, the ransom amount demanded is not stated.
The proposed class action lawsuit, filed by Salisbury resident Gary Cabozzi, seeks damages and attorneys’ fees for court orders in favor of the hospital to improve its data security systems. It alleges negligence and breach of implied contract and good faith by the hospital for failing to protect the data.
See also: Ransomware attack hits large hospital in Barcelona
The complaint also criticizes the hospital for “concealing the fact and extent of the data breach for an unreasonable period of time” and allegedly failing to provide accurate notice of the data breach. According to the lawsuit, the hospital has yet to inform its own patients about the data breach.
On January 5, the hospital announced that if it determines that data has been impacted by this incident, it will send all required notifications under state and federal laws to patients, suppliers, and stakeholders.
Cabozzi complains that he only learned about the cyber incident from local news.
According to the lawsuit, while the total number of people whose data was exposed as a result of the cyberattack is unknown at this time, the number is estimated to be in the dozens, even hundreds.
See also: Two New York hospitals face problems after LockBit ransomware attack
One of the most important security measures is staff training. Staff should be aware of the risks and tactics of cyberattacks, such as phishing, and how to deal with them. It is also essential to have a strong IT security system. This may include installing antivirus programs, using a firewall, and logging and monitoring network traffic.
The use of access control policies is also important. This means that staff only have access to the information they need to perform their duties, thus limiting the possibility of sensitive data being leaked. Finally, creating a response plan in the event of a breach is essential. This should include identifying the breach, addressing it and restoring the system, as well as communicating with patients and authorities.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Source: insurancejournal
