Hi-School Pharmacy Agrees to Settle Data Breach Lawsuit for $600,000
The Vancouver, WA-based drug store chain Hi-School Pharmacy has agreed to settle a class action data breach lawsuit over a November 2023 data breach. A $600,000 settlement fund will be created to cover attorneys’ fees, legal costs and expenses, and class members’ claims.
Hi-School Pharmacy experienced network disruption on November 3, 2024, and confirmed on November 21, 2023, that hackers had accessed its network and potentially obtained the personal information of current and former employees, including their names, dates of birth, and Social Security numbers. Individual notification letters were mailed to the 17,676 affected individuals in December 2023.
In January 2024, a lawsuit – Shayna Marie Landin v Hi-School Pharmacy Services, LLC; Hi-School Pharmacy, Inc. – was filed in the U.S. District Court for the Western District of Washington alleging the pharmacy chain was negligent due to the failure to implement reasonable and appropriate cybersecurity measures to prevent unauthorized access to sensitive data. The plaintiffs alleged that the pharmacy chain should have been aware of the risk of cyberattacks given the number of hacking incidents being reported by healthcare organizations, yet maintained highly sensitive data “in a reckless manner.” According to the lawsuit, cybersecurity measures that should have been implemented included strong spam filters, firewalls to block known malicious IP addresses, regular antivirus scans, and staff members should have received regular security awareness training. If those measures had been implemented, the plaintiffs claimed the data breach could have been prevented. The lawsuit also asserted claims of breach of implied contract, unjust enrichment, and a violation of the Washington Consumer Protection Act.
Hi-School Pharmacy denied and continues to deny any wrongdoing or liability and chose to settle the lawsuit to avoid further legal costs and the risks and uncertainty from continuing to fight the litigation. Under the terms of the settlement, claims may be submitted for reimbursement of documented, unreimbursed out-of-pocket expenses up to a maximum of $5,000 per class member. All class members may also claim 2 years of free credit monitoring and identity theft protection services.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The settlement received preliminary approval from the court in March 2025, and the final approval hearing has been scheduled for July 31, 2025.
