Chicago’s Lurie Children’s Hospital Hit with Class Action Over January 2024 Ransomware Attack

New to ClassAction.org? Read our Newswire Disclaimer

Ann & Robert H. Lurie Children’s Hospital of Chicago faces a proposed class action lawsuit after a January 2024 data breach reportedly exposed patients’ private information to hackers.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 49-page data breach lawsuit alleges that the ransomware attack—which Lurie Children’s says took place between January 26 and 31 of this year—was the result of the pediatric hospital’s failure to implement reasonable and industry-standard cybersecurity measures.

According to the case, the incident compromised approximately 800,000 patients’ names, addresses, dates of birth, driver’s license numbers, email addresses, health claims and health plan information, health plan beneficiary numbers, medical conditions or diagnoses, medical record numbers, medical treatments and dates of services, prescription details, Social Security numbers and telephone numbers.

Criminal ransomware group Rhysida claimed to be behind the attack and purported to have sold the patient information on its darknet extortion site for 60 bitcoins, worth approximately $3.4 million, the filing says.

“Lurie Children’s could have prevented or mitigated the effects of the data breach by better securing its network, properly encrypting its data, or better selecting its information technology partners,” the suit contends, claiming that the defendant’s alleged negligence has exposed victims—many of whom are minors—to a lifetime risk of fraud and identity theft.

This isn’t the first time Lurie Children’s has faced legal action over alleged data security issues, the complaint notes. Reports relay that in 2022, the defendant agreed to settle a lawsuit filed after it notified patients that employees had improperly accessed their data “without a work-related reason” between September 2018 and February 2020.

“The settlement in that case required Lurie Children’s to implement more robust security measures, but apparently, whatever measures Lurie Children’s may have taken in response to that incident were inadequate,” the filing charges.

Per the privacy lawsuit, Lurie Children’s admitted in an online notice that it took down its email, phones, electronic health record system and patient portal on January 31, 2024 in response to the attack. Despite this early response, the defendant waited several months—until around late June or early July 2024—to begin alerting victims that their sensitive information had been compromised, the filing claims. Even then, the case argues, the defendant’s notice letter was short on specifics.

“This ‘disclosure’ amounts to no real disclosure at all, as it fails to inform, with any degree of specificity, [the] plaintiffs and class members of the data breach’s critical facts about the cause of the data breach or any remedial measures,” the suit says. “Without these details, [the] plaintiffs’ and class members’ ability to mitigate the harms resulting from the data breach is severely diminished.”

The Lurie Children’s Hospital data breach lawsuit looks to represent anyone in the United States whose personal information was compromised in the January 2024 data breach that targeted the pediatric hospital.

Are you owed unclaimed settlement money? Check out our class action rebates page full of open class action settlements.