Class action suit filed against LVHN over ransomware hack

A Philadelphia law firm has filed a class action suit against Lehigh Valley Health Network alleging the hospital has prioritized money over patient privacy after photos of cancer patients were posted on the internet in a ransomware hack.

The suit filed by Saltz Mongeluzzi & Bendesky focuses on photos that were published by hackers with the ransomware collective BlackCat over the last couple of weeks of cancer patients who received treatment through the network. The suit does not name a financial amount being sought for damages, instead requesting that the amount be determined by trial or the court.

The hackers acquired the photos through a ransomware attack on a physician’s practice owned by LVHN. The attack occurred in February and caused a leak of 132 gigabytes of patient data and photos. LVHN leaders have stated they refuse to pay the ransom, a tactic often touted by law enforcement and some cybersecurity experts, but in response, the hackers posted some of the photos online and have threatened to release more sensitive information if their demands are not met.

The suit filing states not only was the leak of these photos regrettable but that LVHN engaged in the “knowing, reckless, and willful, decision to let the hackers post the nude images” of Doe and others to the internet. And it accuses LVHN of “publicly patting itself on the back for standing up to the hackers” but “consciously and intentionally ignoring the real victims.”