Tidelands Health Facing Class Action After Patient Records Were ‘Held Hostage’ in December 2019 Malware Attack

New to ClassAction.org? Read our Newswire Disclaimer

The company that runs the Tidelands Health hospital network has been hit with a proposed class action in the wake of a December 2019 ransomware attack that reportedly exposed patients’ sensitive data to unauthorized parties.

Filed against Georgetown Hospital System, the case says that a security incident on December 12, 2019 caused portions of the company’s IT network to be taken offline for multiple days while patients’ sensitive data was held for ransom by thieves. The 43-page complaint claims Tidelands Health failed to adequately protect patients’ personal information from the malware attack, during which names, demographic information, dates of birth, Social Security numbers, driver’s license numbers, employment information, health insurance details, and other protected health data were reportedly compromised.

During the attack, which lasted through December 19, doctors, nurses, and other hospital staff had no access to patients’ medical records, scheduled appointments or diagnostic tests, and were forced to use “downtime procedures”—or, paper records—to continue patients’ medical care, the case states. The two plaintiffs claim their damage was two-fold in that they were denied proper medical care during that time and were subjected to a higher risk of identity theft due to the alleged exposure of their private information.

The lawsuit argues that Tidelands has done “absolutely nothing” to compensate proposed class members for the damages they suffered as a result of the ransomware attack. As of the date the complaint was filed, the defendant had not reported the incident as a data breach nor announced the results of its investigation into the attack, the suit says. According to the case, Tidelands’ only public mention of the incident was a Facebook post in which the company reported that it was bringing its systems back online.

The plaintiffs claim Tidelands maintained their data in a “reckless manner,” adding that the company’s “inadequate” security procedures and employee training have exposed their sensitive information to an ongoing risk of identity theft and fraud that will require their time and attention for years to come. From the complaint:

The lawsuit seeks to cover anyone whose private information was maintained on the defendant’s system during the time of the December 2019 malware attack.