Settlement Resolves Rise Interactive Media & Analytics Class Action Data Breach Lawsuit
The digital marketing agency Rise Interactive Media & Analytics has agreed to settle a class action lawsuit filed in response to a November 2022 cyberattack. Rise Interactive Media & Analytics worked with RGH Enterprises, which does business as Edgepark Medical Supplies, which had data compromised in the cyberattack such as names, email addresses, phone numbers, provider information, diagnoses, expected delivery dates, and health insurance information. Rise Interactive reported the data breach to the HHS’ Office for Civil Rights as involving the protected health information of 54,509 individuals. Notification letters were issued by Edgepark Medical Supplies in February 2023.
A class action lawsuit – Roper, et al. v. Rise Interactive Media & Analytics LLC – was filed on behalf of Tiffany Roper by Wolf Haldenstein Adler Freeman & Herz LLC in the U.S. District Court of the Northern District of Illinois Eastern Division soon after the notification letters were issued. The lawsuit alleged Rise Interactive was at fault for the data breach due to the failure to implement reasonable security measures to protect consumer data. In addition to the negligence claim, the lawsuit asserted claims of unjust enrichment and invasion of privacy. Rise Interactive and Edgepark Medical Supplies both deny any wrongdoing. The settlement was agreed to avoid further litigation costs and the uncertainty of trial.
Under the terms of the settlement, an undisclosed sum has been made available to cover claims from class members who were notified about the data breach by Edgepark Medical Supplies. Claims may be submitted for reimbursement of documented out-of-pocket losses due to the data breach up to a maximum of $250, plus class members can receive a cash payment, which will be paid pro rata after attorneys’ fees, legal costs, expenses, and claims have been paid. The cash payment is expected to be around $50 per class member. The settlement has received preliminary approval from the court and the final approval hearing is scheduled for March 11, 2025. Claims must be submitted by February 18, 2025.
March 30, 2023: Rise Interactive Media & Analytics Sued Over Edgepark Medical Supplies Data Breach
A lawsuit has been filed against the digital marketing agency, Rise Interactive Media & Analytics, over a cyberattack in which the protected health information of approximately 54,500 patients of Edgepark Medical Supplies was compromised.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
On November 14, 2022, a hacker gained access to Rise’s network and accessed files containing sensitive patient data, including names, email addresses, phone numbers, provider information, diagnoses, expected delivery dates, and health insurance information. Rise discovered Edgepark data had been compromised on December 2, 2022, and the affected individuals were notified about the attack on February 10, 2023.
The lawsuit was filed by the law firm Wolf Haldenstein Adler Freeman & Herz LLC in the U.S. District Court of the Northern District of Illinois Eastern Division on behalf of plaintiff Tiffany Roper and similarly situated individuals. The lawsuit alleges Rise was at fault for the breach due to the failure to implement reasonable security measures to protect consumer data that was provided by Edgepark.
The lawsuit also calls into question why Edgepark provided patient data such as health insurance information to Rise and seeks to establish how that information is relevant to the digital marketing services the company provides to Edgepark, especially since permission must be obtained from patients before disclosing protected health information for marketing purposes. The lawsuit also takes issue with the length of time it took to notify the affected patients about the breach – three months after the intrusion was detected and for the lack of information in the breach notification letters. The lawsuit claims the notification letters did not explain how the breach occurred, how the information was stolen, and what steps Rise has taken to prevent misuse of patient data.
Shortly after the data breach, in late December 2022 or early January 2023, the plaintiff claims that her information was used to fraudulently fill a prescription using her health insurance, which indicates her data had been rapidly traded on the dark web. She also claims she faces a present and imminent lifetime risk of identity theft and fraud as a result of the data breach.
The lawsuit alleges negligence, unjust enrichment, and invasion of privacy and seeks class action status, a jury trial, damages, legal costs, and injunctive relief, including 16 requirements for Rise to improve security to prevent further cyberattacks and data breaches.
