Salud Family Health Data Breach Class Action

Salud Family Health, Inc. offers healthcare services for “medically underserved” people and migrant workers. As a healthcare provider, Salud holds a substantial amount of personally identifiable information (PII) and protected health information (PHI) in its systems. But the complaint for this class action alleges that Salud did not take adequate measures to protect that information, leading to a data breach.

The Nationwide Class for this action is all persons in the US whose PII or PHI was compromised in the data breach disclosed by Salud on or around November 4, 2022. A Colorado Subclass has also been proposed, for those in the above class in Colorado.

In its notice announcing the data breach to the Maine Attorney General, Salud said the exposed data included names, Social Security numbers, driver’s license or state ID numbers, financial account information, credit card numbers, information on medical treatment and diagnoses, health insurance information, and biometric data, among other things. The data breach affected more than 427,000 people, the complaint alleges.

The complaint quotes Salud’s website as saying that the company found “suspicious activity in certain computer systems” on September 5, 2022, then began an investigation with third-party experts. The investigation found “that certain data may have been accessed or taken[,]” the website says, according to the complaint, and the company is “reviewing and enhancing [its] policies and procedures to further protect against similar incidents moving forward.”

The complaint alleges that Salud “failed to take appropriate or even the most basic steps to protect the PII/PHI” that it retained on file and prevent it from being exposed.

Once private information has been exposed, the complaint alleges, cybercriminals can sell it on the dark web, sometimes for years afterwards, or even use it to blackmail the persons involved.

Cyberattacks have become increasingly common, the complaint alleges, to the point where the Federal Bureau of Investigation (FBI) and US Secret Service have published warnings. The complaint quotes one report as saying, “Entities like smaller municipalities and hospitals are attractive to ransomware criminals … because they often have lesser IT defenses and a high incentive to regain access to their data quickly.”

“In fact,” the complaint alleges, “according to the cybersecurity firm Mimecast, 90% of healthcare organizations experienced cyberattacks in the past year.”

The individual victims of this data breach, the complaint alleges, must now spend their time monitoring their medical statements, records, credit reports, and financial accounts, change passwords and login information more often, screen phone calls, emails, and other communications more carefully to make sure they do not involve, for example, a spear phishing attack, and pay for credit monitoring and identity theft services.

The complaint claims that the individual victims “will need to maintain these heightened measures for years, and possibly their entire lives, as a result of [Salud’s] conduct.”

Article Type: Lawsuit
Topic: Privacy
Tags: Exposing Private Information, Exposure to cyber crime, Your Privacy