Morrison Community Hospital Agrees to $675K Settlement to Resolve Ransomware Lawsuit
Morrison Community Hospital, a critical access hospital in Illinois, has agreed to a $675,000 settlement to resolve a lawsuit filed in response to a 2023 ransomware and data breach.
On September 24, 2023, the BlackCat/ALPHV ransomware group used ransomware to encrypt files on its network after exfiltrating sensitive data. When the ransom was not paid, the BlackCat/ALPHV group leaked the stolen data on its data leak site. The data breach was reported to the HHS’ Office for Civil Rights on November 23, 2023, as involving the protected health information of 122,488 current and former patients. The compromised data included names, birth dates, addresses, Social Security numbers, and medical information.
Affected patients took legal action against the hospital – In re: Morrison Community Hospital Data Breach Litigation – in the Circuit Court for the 14th Judicial District in Whiteside County, Illinois. The lawsuit alleged insufficient safeguards had been implemented to prevent cyberattacks which amounted to negligence, and as a result of that failure, a hacker was able to breach its network and steal highly sensitive patient data.
Morrison Community Hospital has denied wrongdoing, disagrees with the plaintiffs’ claims, and denies any liability; however, chose to settle the lawsuit to avoid further legal costs and the uncertainty of trial. Under the terms of the settlement, class members may submit claims for up to $5,000 to recover documented losses due to the incident, including bank charges, credit fees, travel costs, and losses to identity theft and fraud.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Class members who do not wish to submit a claim for losses may instead choose to receive a cash payment, which will be paid pro rata once attorneys’ fees, legal expenses, plaintiff awards, and claims have been paid. Claims must be submitted by February 5, 2025, and the final approval hearing is scheduled for February 28, 2025.
