2023 Northwell Health Data Breach Lawsuit Says Info of Roughly 3.9M People Was Stolen in Cyberattack

New to ClassAction.org? Read our Newswire Disclaimer

Northwell Health and Perry Johnson & Associates have been hit with a proposed class action lawsuit in the wake of a massive 2023 data breach in which the sensitive personal and health information of around 3.9 million people was accessed by hackers. 

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here. 

The 45-page lawsuit states that Perry Johnson & Associates, a medical service vendor for Northwell Health, became aware of the data breach on May 2. According to a notice letter sent to victims, the incident occurred between March 27 and May 2, a time during which cybercriminals allegedly had “unrestricted and unrestrained” access to proposed class members’ private information for up to five weeks or longer. 

Specifically, the suit says, the cybercriminals behind the attack accessed data belonging to patients of Northwell Health, the largest health system in New York, between April 7 and April 19, 2023. 

The data breach lawsuit chides the defendants for “inexplicably” waiting six months before informing consumers that their sensitive information had been stolen, depriving victims of valuable time needed to remedy or mitigate the fallout from the cyberattack. 

As the lawsuit tells it, Northwell Health and Perry Johnson & Associates’ data breach notice included no details on how many people were impacted by the breach or why it took the companies nearly two months to begin to notify victims. 

According to one news outlet, it is estimated that nearly 3.9 million people were affected by the data breach impacting Northwell Health. The lawsuit states that victims’ names, Social Security numbers, dates of service, medical record numbers, diagnoses and clinical test details were among the data stolen during the cyberattack. 

“In failing to adequately protect Plaintiffs’ and the Class’s Sensitive Information, failing to timely and adequately notify them about the breach, and by obfuscating the nature of the breach, Defendants violated state and federal law and harmed an unknown number of their consumers,” the lawsuit summarizes. 

The filing shares that Northwell Health treats more than two million New Yorkers each year, and Perry Johnson & Associates provides the health system with transcription and dictation services. In maintaining the sensitive information of consumers, the defendants “implicitly promise to safeguard” the data against unauthorized access, the case stresses. 

The suit accuses the defendants of failing to implement reasonable cybersecurity measures and supervise their IT or data security agents to prevent, detect and stop breaches of their systems. 

The lawsuit looks to cover all United States residents whose sensitive information was compromised in the Northwell Health and Perry Johnson & Associates data breach, including those who received notice of the incident. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.