Oregon Health Plan Service Hit with Class Action Over May 2023 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit claims Oregon-based Performance Health Technology (PH Tech) failed to protect one of its client’s private patient information from a cyberattack reportedly discovered in June 2023.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 39-page lawsuit says that although the defendant first detected unauthorized access to one of its servers on June 2, the company claims that cybercriminals infiltrated its network days before, on May 30, via a vulnerability in a third-party file transfer application known as MOVEit. The suit relays that on June 16 of this year, the health plan and storage service provider determined that the patient information it received from healthcare client Health Share of Oregon was compromised in the breach.

According to the case, the cyberattack on PH Tech’s systems exposed approximately 1.7 million Health Share of Oregon patients’ personal information, including at least their names, dates of birth, Social Security numbers, addresses, health insurance data, member and health plan ID numbers, email addresses, diagnostic and procedure codes, and claim and billing details.

The complaint argues that the breach was a direct result of the defendant’s failure to implement proper cybersecurity measures to safeguard the sensitive data stored in its network.

Though the company reportedly began notifying victims of the breach in late July 2023, the notices failed to include “basic details” about the incident, such as how the cybercriminals gained access to the network or what is known about the degree to which the information has already been disseminated, the filing states.

The plaintiffs in the case, four Oregon residents insured by PH Tech client Health Share of Oregon, each received notice on July 27 informing them that their personal information had been compromised in the breach, the suit says.

Like other victims, the plaintiffs now face a lifelong risk of identity theft, medical fraud and other illegal schemes as a result of PH Tech’s negligence, the case contends.

The lawsuit looks to represent anyone in the United States and its territories whose personal information was compromised in the PH Tech data breach.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.