From Philly and the Pennsylvania suburbs to South Jersey and Delaware, what would WHYY News like to cover? Let us know!
A Pennsylvania judge has cleared the way for a $65 million settlement with Lehigh Valley Health Network in a data breach case involving stolen medical records and nude photos of cancer patients taken during exams posted on the dark web by a Russian cyber gang.
During a hearing Friday in Lackawanna County Court, Senior Judge Thomas A. James gave final approval to a deal between the health care system and members of a class-action lawsuit first filed in 2023.
More than 134,000 affected patients will receive a settlement payment depending on the extent to which they were affected by the breach.
“We got the right deal,” said Patrick Howard, lead prosecutor and partner at Saltz Mongeluzzi Bendesky. “The vast majority of that money goes mainly to women whose photos are published online topless, with both their faces visible and their names in the files.”
In February 2023, leaders of Lehigh Valley Health Network issued a public notice to announce that the health care system had been targeted by a Russian ransomware group called BlackCat.
The cyber gang hacked into a computer system that contained “radiation therapy patient images and other sensitive information,” the statement said.
BlackCat demanded a ransom, and when the health care system refused to pay it, the group posted medical records, employment information, and photos of patients on the dark web.
“When you go to a doctor’s office, you expect everyone to work to maintain your privacy, even if you have to open yourself up to be treated,” Howard said. “It was not lost on anyone that this was a very significant breach.”
Stolen and posted information included patients’ medical histories with alcohol and substance use disorders, mental health issues, reproductive and sexual health diagnoses and more, “things that, again, we would all cherish as private,” Howard said.