Apria Healthcare Hit with Class Action Over Data Breach Affecting 1.8M People [UPDATE]

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit claims negligence on the part of Apria Healthcare is to blame for a data breach that compromised the personal information of more than 1.8 million individuals nationwide.

Did you receive a data breach notice from Apria Healthcare? Let us know here.

The 45-page lawsuit says that Apria, a provider of home medical equipment and services for sleep apnea, wound care and diabetes, announced in May 2023 that unauthorized third parties had accessed its network at various times between April 5 and May 7, 2019, and again between August 27 and October 10, 2021.

The suit relays that the hackers “went undetected” and had unchecked access to the private data stored in Apria’s system for weeks during those periods in 2019 and 2021.

According to the case, the data compromised in the cyberattack included, without limitation, Apria customers’ personal and medical information, health insurance details, Social Security numbers and financial information.

The complaint argues that the breach was a direct result of Apria’s failure to implement adequate cybersecurity protocols to protect customers’ data, which the company apparently stored unencrypted in its computer systems.

What’s more, Apria, who the suit says served more than two million patients in 2021 alone, only began to notify victims of the breach in May 2023, a delay of more than four years, the filing charges.

As the lawsuit tells it, the company’s negligence was particularly egregious in light of the frequency of cyberattacks in the medical industry in recent years. Despite public warnings and media coverage of high-profile cybersecurity incidents, Apria neglected to take basic precautions to secure its data against unauthorized disclosure, the suit alleges.

“[As] a result of [Apria’s] conduct, [victims] are forced to live with the anxiety that their [private information] may be disclosed to the entire world,” the case claims, “thereby subjecting them to embarrassment and depriving them of any right to privacy whatsoever.”

The plaintiff, a California resident and Apria customer, received notice on June 6 of this year informing him that his personal information had been compromised in the breach, the complaint says. Like other victims, the man now faces a significantly increased risk of identity theft, fraud and other illegal schemes and “must live with that threat forever,” the filing contends.

The lawsuit looks to represent anyone in the United States whose personal information was compromised in the data breach announced by Apria Healthcare in May 2023.

Did you receive a data breach notice from Apria Healthcare? Let us know here.