Cardiovascular Associates to Blame for Data Breach Affecting 400K People, Class Action Claims

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit claims Cardiovascular Associates (CVA) failed to protect the personal information of more than 400,000 people during a “massive” data breach purportedly discovered by the practice in December 2022.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 85-page lawsuit says that the Alabama-based cardiovascular practice—one of the largest in the Southeast—detected on December 5 that its computer systems had been hacked, and a subsequent investigation revealed that cybercriminals had unauthorized access to the systems since November 28 of last year.

The suit relays that patient and employee information compromised in the breach included full names, dates of birth, home addresses, patient numbers, Social Security numbers, driver’s license number or state ID financial account numbers, medical and treatment information, billing details and health insurance specifics.

The case argues that the cyberattack was a result of the defendant’s failure to employ reasonable cybersecurity practices to safeguard patients’ and employees’ private data. Per the complaint, CVA also neglected to adequately monitor the computer network on which this sensitive information was stored.

“Had CVA properly monitored these electronic systems, it would have discovered the intrusion sooner or prevented it altogether,” the filing charges.

According to the lawsuit, CVA began to send out notices to victims of the breach in February 2023, almost two months after the cyberattack was purportedly discovered. The delayed notification meant that impacted individuals were unable to take early steps to mitigate the harms caused by the disclosure of their data, the suit contends.

As the case tells it, the notices themselves—“cryptically written” and offering few details—did not explain the nature of the ransomware attack, how the hackers gained access, why CVA delayed notifying victims or what measures are being implemented to prevent cybersecurity incidents in the future.

In light of recent, well-publicized data breaches within the healthcare industry, the complaint argues, CVA should have understood that it would be a “prime target[] for cyberattacks” and taken security steps commensurate with the threat.

CVA has reportedly offered affected individuals one year of identity and credit monitoring services—an “inadequate” gesture in the face of the lifelong risks that victims now face, the filing claims.

The plaintiff, an Alabama resident who has visited CVA numerous times since 2015, received notice on February 3 of this year that his personal information had been compromised in the Cardiovascular Associates data breach, the lawsuit says. The plaintiff and other victims must now cope with a significantly increased risk of fraud, identity theft and other unwanted schemes because of CVA’s conduct, the suit relays.

“This present risk will continue for the course of their lives,” the case stresses.

The lawsuit looks to represent anyone in the United States whose personal information was compromised as a result of the Cardiovascular Associates data breach discovered in December 2022.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.