Cummins Behavioral Health Settles Data Breach Lawsuit for Up to $2.1 Million
Cummins Behavioral Health, a behavioral healthcare provider in Central and Western Indiana, has agreed to a $2.1 million settlement to resolve a class action lawsuit filed by individuals affected by a 2023 data breach.
On March 9, 2023, Cummins Behavioral Health discovered a ransom note left by a threat actor who alleged to have infiltrated its systems and exfiltrated sensitive data. An investigation was launched to verify that a breach had occurred, and it was confirmed that there had been unauthorized access to its network between February 2, 2023, and March 9, 2023. The file review confirmed that a range of sensitive data had been stolen, including names, addresses, dates of birth, Social Security numbers, health insurance information, and payment card information.
The breach was reported to the HHS Office for Civil Rights on April 12, 2024, using a placeholder figure of 501 affected individuals, and that total remains on the OCR breach portal as of November 2024; however, the breach was reported to the Maine Attorney General as involving the personal information of 157,688 individuals. Complimentary credit monitoring services were made available.
A lawsuit was filed against Cummins Behavioral Health in August 2023, asserting several claims allegedly resulting from the data theft incident. In October, a motion was filed to dismiss the lawsuit as the plaintiff failed to allege a direct injury had been suffered only that there was an imminent and elevated future risk of fraud, which the defendant said did not meet a standard of harm sufficient to confer standing, but that attempt was unsuccessful.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Cummins Behavioral Health maintains there was no wrongdoing but has settled the lawsuit for $2.1 million. Claims may be submitted for benefits up to November 20, 2024. Under the terms of the settlement, individuals affected by the data breach can choose to receive one of the following benefits:
- Up to $500 for documented ordinary losses such as out-of-pocket expenses, credit monitoring services, and fees for credit reports.
- Up to $75 (3 hours at $25 per hour) for lost time spent dealing with the security incident, supported by an attestation.
- Up to $5,000 as reimbursement for documented, unreimbursed extraordinary losses such as losses to identity theft and fraud.
- A cash payment of $65.
- A free trauma screening from the defendant.
The lawsuit was filed by the law firm Cohen & Malad LLP.
