Lawsuit Investigation into BrightSpring Health Services Data Breach

Attorneys working with ClassAction.org want to hear from anyone who received a letter from BrightSpring Health Services stating that their personal information may have been compromised in a data breach.

The Kentucky-based health services provider recently notified state attorneys general that an unauthorized party had hacked into its computer systems between March 12 and 13, 2023 and accessed “employee information,” some of which belonged to former and current employees of Equus Workforce Solutions, a former subsidiary of BrightSpring.

The data breach reportedly affected 535,203 individuals and may have exposed their names, Social Security numbers and, for some, addresses and dates of birth.

The attorneys believe BrightSpring may have failed to take adequate steps to protect consumers’ personal information and are investigating whether a class action lawsuit can be filed to help compensate victims.

BrightSpring, Equus Workforce Solutions Data Breach: What Happened?

BrightSpring, which provides home- and community-based health services nationwide, notified the attorneys general of several states in mid-August 2023 of a data breach that affected more than 535,000 individuals. According to these reports, BrightSpring first learned of the breach on March 14 and, after investigating, determined that consumers’ personal information had been obtained from its computer systems on March 12 and 13.

Two sample data breach letters provided by the company indicate that BrightSpring “recently discovered” that the compromised data contained “employee information,” including payroll data from former subsidiary Arbor E&T, LLC, doing business as Equus Workforce Solutions. Per the letters, BrightSpring learned between late May and mid-June that the stolen files included consumers’ names, Social Security numbers and, for some, addresses and dates of birth.

BrightSpring has not indicated whether this incident is related to a previously reported data breach that took place on the same days and impacted subsidiary PharMerica. The national pharmacy network reported in May that “suspicious activity” was detected on its network on March 14 and determined that personal information had been stolen between March 12 and 13.

According to DataBreaches.net, ransomware group Money Message claimed responsibility for the PharMerica breach – which reportedly impacted over 5.8 million patients – and added both PharMerica and BrightSpring to their leak site. Money Message published what they claimed was all 4.7 terabytes of the stolen data on April 9, and the files were still available for download as of May 15, according to BleepingComputer.com.

How Could a Lawsuit Help Data Breach Victims?

A lawsuit could also force BrightSpring to implement stronger data security to ensure that consumers’ information is protected from future attacks.

Before commenting, please review our comment policy.