90 Degree Benefits Facing Class Action Lawsuit Over 181,500-Record Data Breach
A lawsuit has been filed against 90 Degree Benefits over a breach of the protected health information of 181,543 individuals. Unauthorized system activity was detected on or around December 10, 2022, and the forensic investigation determined its systems had been accessed by unauthorized individuals between December 5, 2022, and December 10, 2022. During that time, the attackers had access to parts of its network that contained patients’ and health plan members’ names, addresses, dates of birth, Social Security numbers, health information, and payment information. Affected individuals were notified about the breach by mail on or around April 7, 2023.
The lawsuit alleges 90 Degree Benefits knew or should have been aware that it was a target for hackers, given the extent to which the healthcare industry has been targeted in recent years, especially considering 90 Degree Benefits experienced a similar data breach in February 2022. The February data breach should have made it clear that its data security measures were not sufficient and needed to be improved, yet despite that earlier breach, data security was still inadequate.
The lawsuit alleges the plaintiffs have incurred out-of-pocket expenses and have had to spend time protecting against misuse of their data, and that they are at imminent risk of identity theft and fraud, with that risk continuing for years to come. As a result, the plaintiffs and class members will likely have to continue investing time and money to protect themselves from fraud for the rest of their lives.
The lawsuit alleges negligence, breach of implied contract, and violations of the Wisconsin Deceptive Trade Practices Act and Wisconsin Confidentiality of Health Records Law. The lawsuit seeks class action certification, a jury trial, damages, reimbursement of out-of-pocket expenses, and injunctive relief, including encryption of data, changes to data retention practices, the implementation of a comprehensive information security program, regular third-party security audits/penetration tests, and for the court to prohibit 90 Degree Benefits from storing protected health information in cloud-based databases.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The lawsuit names 90 Degree Benefits Inc. and 90 Degree Benefits, LLC as the defendants and the plaintiffs as Steven Greek and Jon Boyajian. The lawsuit was filed in the U.S. District Court for the Eastern District of Wisconsin. The plaintiffs and class are represented by attorneys from the law firms Ademi LLP, Murphy Law Firm, and Federman & Sherwood.
