Lehigh Valley Health Network has agreed to pay $65 million to settle a class-action lawsuit after hackers leaked nude photos of cancer patients online, the Washington Post reports.
The cyberattack, which occurred in early 2023, compromised the sensitive information of hundreds of patients, including revealing images taken during radiation treatments. The settlement highlights the growing risk of cyberattacks on healthcare systems and the significant legal and financial consequences that can follow.
The breach came to light in March 2023, when a health network executive informed a Pennsylvania woman, referred to as Jane Doe in legal documents, that hackers had obtained and posted photos of her on a hidden corner of the dark web. Jane Doe, the lead plaintiff in the lawsuit, had no prior knowledge that such intimate images were being stored by the health system. The hackers demanded a ransom of more than $5 million, but Lehigh Valley Health Network refused to pay.
The settlement, announced on September 12, aims to compensate nearly 135,000 patients and health-system employees impacted by the data breach. About 80 percent of the $65 million will go to those whose nude photos were posted online, which includes approximately 600 individuals. These patients stand to receive up to $75,000 each, while Jane Doe could be awarded $125,000 as the lead plaintiff.
The attack underscores the vulnerabilities healthcare organizations face in securing highly sensitive data. Medical systems are prime targets for cybercriminals due to their complex networks and valuable information, often linking doctors, insurers, and vendors. The FBI has reported that the healthcare sector experiences more ransomware attacks than any other industry, with breaches occurring almost daily.
Lehigh Valley Health Network did not pay the ransom and has since worked to strengthen its cybersecurity defenses. A spokesperson for the health system emphasized the importance of patient privacy and stated that the attack was limited to a single physician practice in northeast Pennsylvania.
The settlement awaits approval from a judge before it is finalized.
