A patient suing a Pennsylvania-based hospital network over a data breach has asked a judge to force the organization to pay a ransom fee to hackers in a bid to have stolen photos of naked patients taken off the internet.
Lehigh Valley Health Network in Allentown, Pa., hasn’t paid the more than $5 million ransom demanded by the ransomware group known as BlackCat after it attacked the organization in February, according to a lawsuit that was filed on March 13. Naked photos of patients taken during cancer treatment appeared in early March on an online forum used by the hacker group.
People whose personal information is exposed or who are otherwise affected by a cyberattack frequently sue the companies that were hacked. But it is unusual for victims to try to compel a company to pay a ransom.
A cancer patient filed the lawsuit as an anonymous plaintiff, referred to as Jane Doe in the lawsuit, after Lehigh Valley’s chief compliance officer informed her by phone that photos of her naked during her treatment were online, the lawsuit said. Jane Doe said she wasn’t aware the photos were taken in the first place and worried that people would identify her, said Patrick Howard, a partner at law firm Saltz Mongeluzzi Bendesky PC who is representing her. The photos posted of Jane Doe appear to be from the end of her breast cancer treatment, Mr. Howard said.
“She’s afraid [people] are going to show up at her place of employment, someone is going to put together that it’s her, download them, joke about it at work,” he said. “She is going to have this in the back of her mind as long as these images are on the internet.”
Other photos posted online also showed patients naked and are now searchable by patient name, Mr. Howard wrote in an April 10 letter to the federal judge assigned to the case.
A spokesman for Lehigh Valley declined to comment. In a court filing submitted on April 5, Mary Ann La Rock, Lehigh Valley’s chief compliance officer, said the healthcare network has identified around 2,760 people whose “clinically appropriate photographs” were stolen during the cyberattack. Hackers “potentially” stole other types of data from additional individuals, the filing said.
Brian Nester, president and chief executive of Lehigh Valley, said the organization “refused to pay this criminal enterprise” in a statement shortly after the February attack.
The lawsuit accuses Lehigh Valley of violating cybersecurity and privacy rules including requirements under the Health Insurance Portability and Accountability Act, or HIPAA, to protect patient data.
Lehigh Valley runs 13 hospital campuses and numerous health centers, labs and other services. Ms. La Rock’s filing said the photo theft includes patients in New York, New Jersey, California, Virginia and Georgia.
Mr. Howard filed the lawsuit in Lackawanna County court in Pennsylvania, but the healthcare network had the case moved to federal court on April 6. On Friday, Mr. Howard filed a motion to transfer the case back to county court. Information that hackers posted online indicates that many affected patients live in Pennsylvania. Pursuing the matter in county court there would avoid delays, he wrote in the letter to the federal judge.
If the court certifies the lawsuit as a class action, other people affected by the lawsuit will be notified and have the ability to opt out, Mr. Howard said. He said he hasn’t spoken with other affected patients.
The lawsuit could face several legal hurdles. Companies that pay ransoms to hackers could be violating US sanctions against Russia-based cybercrime groups. US government officials say recent sanctions have deterred hackers, causing a 15% drop in the money paid to hackers in 2022 from 2021, according to Mandiant, a cybersecurity unit of Alphabet Inc.’s
Google Cloud.
Mr. Howard said he is looking into whether Lehigh Valley would be violating sanctions if it pays the ransom to BlackCat, which writes some of its material in Russian, according to a 2022 report from the cybersecurity unit of Palo Alto Networks Inc.
“We’re just trying to get this stuff taken off the internet. We don’t know any other way to go about it.”
Federal law enforcement agencies generally advise companies not to pay ransom fees to hackers because that emboldens them to attack again, and they might not release data anyway. Victims who do pay are typically trying to get stolen data back or unencrypted, or make the payment in exchange for the hackers’ promise not to post damaging or embarrassing information online.
Healthcare companies in particular are big targets for ransomware because they hold sensitive medical data, said Jason Johnson, a partner at law firm Moses & Singer LLP. Mr. Johnson isn’t involved in the case against Lehigh Valley.
However, healthcare providers also have legal and regulatory obligations to protect patient data. Johnson said. The judicial system will need to assess if patients were harmed by their photos being published, and if Lehigh Valley might be able to protect patient privacy by paying the ransom, he said.
For Jane Doe, the photos are a deeply upsetting violation of privacy and a “different level” of data breach, Mr. Howard said.
“We’re just trying to get this stuff taken off the internet. We don’t know any other way to go about it,” he said.
The federal judge must now decide whether to take the case or return it to the county court.
Write to Catherine Stupp at [email protected]
Copyright ©2022 Dow Jones & Company, Inc. All Rights Reserved. 87990cbe856818d5eddac44c7b1cdeb8
