2024 Data Breach Caused Days-Long Shutdown of Octapharma Plasma Donation Centers, Class Action Lawsuits Say

New to ClassAction.org? Read our Newswire Disclaimer

Octapharma Plasma faces at least two proposed class action lawsuits over a 2024 data breach that caused a days-long shutdown of nearly 200 of the pharma company’s blood plasma donation centers nationwide last month. 

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here. 

The Octapharma Plasma data breach lawsuits allege that lax cybersecurity on the part of the company is to blame for the incident, which, according to the suits, began when Octapharma detected suspicious activity in its computer systems on April 17, 2024. The cases relay that the company temporarily closed its centers from April 17 to April 22 while it investigated the cyberattack. 

An Australian cyber news outlet reported on April 24 that a ransomware gang known as BlackSuit had claimed responsibility for the breach and posted on its dark web leak site a list of purportedly stolen information. The cybercriminal group claimed to have exfiltrated Social Security numbers, addresses and dates of birth belonging to current and former Octapharma donors, the article relays, adding that patient names, laboratory data and certain financial, employee and business information was also reportedly stolen. 

A news update posted on Octapharma’s website on April 29 announced that its donation centers had since reopened and that the investigation into the cyberattack was still ongoing. 

As one of the data breach lawsuits puts it, the Octapharma ransomware attack was the “foreseeable, and even likely, consequence” of the pharmaceutical company’s “woefully inadequate” cybersecurity and failure to implement proper encryption protocols. 

“[Octapharma’s] use of outdated and insecure computer systems and software that are easy to hack, and its failure to maintain adequate security measures and an up-to-date technology security strategy, demonstrates a willful and conscious disregard for privacy, and has exposed the [personally identifying information] and [protected health information] of [the plaintiff] and members of the proposed Class to unscrupulous operators, con artists, and outright criminals.” 

The complaints also note that, as of the date they were filed, the defendant has yet to notify victims of the breach. One suit points out that impacted individuals were entirely unaware of the incident until they read about it in the news. 

In similar fashion, Octapharma was hardly forthcoming when it first announced the incident on its website on April 19 of this year, the cases contend. As one lawsuit states, the company “deliberately underplayed the severity and obfuscated the nature” of the breach, blaming the disruption of its operations on a “network issue,” per the case.

As of the date of the filings, victims “remain in the dark” with regard to critical details about the data breach and are “left wondering how they can protect themselves,” the suits charge. 

The lawsuits look to represent anyone in the United States whose private information was impacted by the data breach discovered by Octapharma on April 17, 2024. 

Are you owed unclaimed settlement money? Check out our class action rebates page full of open class action settlements.