Chicago Urgent Care Center Hit with Pair of Class Actions Over Months-Long Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

A Chicago urgent care center has been hit with two proposed class action lawsuits after announcing in late June 2022 that it had been the victim of a data breach that reportedly compromised the sensitive information of more than 144,000 patients.

According to the two lawsuits, Michigan Avenue Immediate Care, S.C. (MAIC) failed to implement adequate cybersecurity protocols and procedures to ensure patients’ information was protected from unauthorized access. 

One suit alleges MAIC failed to comply with “regulatory, ethical, and industry standards for cybersecurity and confidentiality of patient records,” and prevent, detect and appropriately respond to the foreseeable risk of a data breach by cyber criminals.

“As a result, criminals gained access to, copied, and stole Plaintiff’s and Class members’ [personally identifiable information/protected health information],” the filing says.

Per the cases, the information compromised in the incident included patients’ names; addresses; phone numbers; dates of birth; Social Security and driver’s license numbers; and treatment and health insurance information.

The lawsuits contends that data breach victims now face a heightened risk of identity theft and fraud as a result of MAIC’s “very weak computer security.”

According to the cases, MAIC, after “an unreasonably long silence,” informed affected patients in late June 2022 that it had become aware of “a hack and exfiltration of sensitive personal information involving its patients” on May 1. One of the lawsuits alleges, however, that the data breach may have occurred as early as December 2021 and continued through May of this year, when the hackers, who the suit says referred to themselves as Targetware Team, demanded payment from MAIC for the data. The other case posits that had the hackers, who supposedly gained access to MAIC’s network in 90 minutes, not announced themselves, “MAIC may have never detected the Data Breach at all.”

Citing a DataBreaches.net article, the case claims MAIC “knew or should have known of the Data Breach earlier than May 1, 2022, but did not act on it until at least May.”

Further, the suit charges that MAIC has been “extremely vague” in its response to the breach and has offered little information about the steps it has taken to safeguard patients’ data against future security incidents.

Both lawsuits claim that data breach victims now face “years of constant surveillance of their financial and personal records, monitoring, and loss of rights,” arguing that the defendant’s offer of one year of identity theft detection services is “wholly inadequate” to protect victims from the threats they face.

One of the cases looks to represent anyone whose information was accessed as a result of the MAIC data breach, while the other looks to cover all Illinois residents whose personally identifiable information or protected health information was contained on files obtained by unauthorized parties in the MAIC cybersecurity incident.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.