Class Action Lawsuit Filed Over September 2023 Aveanna Healthcare Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit accuses Aveanna Healthcare of failing to protect the private information of approximately 65,000 people during a September 2023 data breach.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 75-page Aveanna Healthcare data breach lawsuit contends that negligent cybersecurity on the part of the home healthcare provider resulted in the unauthorized disclosure of current and former patients’ full names and medical information, such as provider names and medical record numbers or patient IDs.

After Aveanna Healthcare detected suspicious activity associated with one of its email accounts, a subsequent investigation revealed that an unknown threat actor may have gained access to the Atlanta-based company’s email environment and the files stored therein on September 25, 2023, the data breach suit relays.

The case claims that the exposure of patients’ personal information was wholly preventable and stemmed from Aveanna Healthcare’s failure to implement even basic data security protocols. Notably, the company has faced similar allegations in recent years, in particular after a phishing attack compromised the confidential information of more than 166,000 patients in July 2019, the complaint points out.

As a result of the defendant’s negligence, the filing alleges, data breach victims are now at a significant risk of being targeted for cybercrimes and must carefully monitor their financial accounts to protect themselves against identity theft.

The suit takes further issue with Aveanna Healthcare’s data breach notice letter, which, as the case tells it, was unreasonably delayed and lacked critical details about the incident. For example, the notice—which the company only began to send to impacted individuals in March 2024—failed to explain how cybercriminals gained access to Aveanna Healthcare’s email environment, who was behind the cyberattack and what steps are being taken to safeguard patient data going forward, the complaint charges.

The lawsuit looks to represent anyone in the United States whose private information was accessed and/or acquired by an unauthorized third party as a result of the Aveanna Healthcare data breach reported in March 2024.

Are you owed unclaimed settlement money? Check out our class action rebates page full of open class action settlements.