Bayhealth Medical Center, Inc. settled a lawsuit in August over a patient data breach.
The class action lawsuit was initially filed by Sally Cannon Dunlop in August 2024, claiming Bayhealth “lost control” of its sensitive data.
Efforts to mediate the dispute eventually led to a settlement agreement in August, according to court filings. Now that agreement is slated to go to the court for approval in October.
According to the suit, Rhysida, a hacker group, was able to access personal information like scans of patients’ passports, Social Security numbers and other employee documents. Some – including Dunlop’s email and Social – were published on the dark web last year.
The group demanded a 25 Bitcoin ransom, which is worth about $1.4 million.
The initial complaint said no one knows how long cybercriminals had access to Bayhealth’s network before the breach was discovered.
“In other words, Defendant had no effective means to prevent, detect, stop, or mitigate breaches of its systems—thereby allowing cybercriminals unrestricted access to its current and former patients’ [personal identifiable information and protected health information],” the complaint said.
It also claimed they failed to follow Federal Trade Commission guidelines, which require data security measures be in place to protect customers.
FTC regulations require businesses to protect personal customer information, dispose of unneeded information and encrypt information on computer networks.
The court will have final say on the settlement - including approval of who may be eligible to file a claim.
