Lehigh Valley Health Network will pay $800,000 to settle federal privacy charges after hackers leaked the records of 248,359 patients, including Social Security numbers.
A Pennsylvania hospital network has agreed to pay an $800,000 penalty to the federal government after a ransomware attack exposed the health records of 248,359 people. Lehigh Valley Health Network settled with the Office for Civil Rights, the part of the US Department of Health and Human Services that enforces health privacy law. It also settled a class action lawsuit over the breach for $65 million.
The hospital network spotted suspicious activity in its systems in early February and later confirmed ransomware was involved. Ransomware is software that locks or steals data so criminals can demand money. The group behind it, known as ALPHV/BlackCat, got into IT systems tied to Delta Medix, a company the network acquired in 2021. The hackers stole files and demanded a ransom. The network did not pay, so the group posted the data on its dark web leak site.
The stolen files held a lot of personal detail. The list included:
Photographs of cancer patients receiving radiation treatment were also stolen and leaked online. Some of those patients were naked from the waist up.
The Office for Civil Rights said the network never carried out a full and accurate risk analysis. That is a check for weak spots in systems that hold patient data. It also said the network did not regularly review records of activity in those systems, such as access logs.
Regulators also said the notices came too late. Under the rule, HHS must be told within 60 days of discovering a breach. The intrusion was detected on February 4, and HHS was notified on May 15. The network also failed to warn affected patients in a timely way.
Beyond the fine, the network must run a thorough risk analysis, create a risk management plan, update its policies and train its staff on the privacy rules. The government will monitor it for three years. This is the 22nd ransomware investigation by the office to end in a financial penalty. Late breach notices are a repeat issue. They were part of five of the 12 settlements announced this year and five last year.
OCR Director Paula M. Stannard said that skipping a thorough risk analysis and regular reviews of system activity makes organizations attractive targets for cyberattacks.
If a doctor or hospital holds your records, it is fair to ask how they protect them. If you ever get a breach notice, take it seriously and watch for signs of identity theft, since details like Social Security numbers can be misused for years.
After any breach notice from a health provider, watch closely for signs of identity theft, and do not be shy about asking how your records are protected.
Reports say the Trump administration is weighing underwater datacenters off Maine and Alaska, and Lake Erie groups want a plan before anyone proposes one nearby.
Read more: Underwater datacenters may be next, and Lake Erie groups are worriedA user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesA fake call in Truro, Canada, sent a police tactical team to a woman's home. An RCMP officer now shares plain rules for spotting phone scams.
Read more: Canadian police share simple rules to beat phone scammers
