Las Vegas plastic surgery practice sued after cyber hack, leak of patient photos and data
LAS VEGAS, Nev. (FOX5) – A Las Vegas plastic surgery practice is facing a class-action lawsuit after it suffered a cyberattack that resulted in private patient information, including photos, reportedly being leaked online.
According to court documents, Hankins & Sohn Plastic Surgery Associates was named as the defendant in a federal class action lawsuit filed this spring by plaintiff Jennifer Tausinga, on behalf of herself and “all others similarly situated.”
Two additional named plaintiffs were added and an amended complaint was filed in federal court on September 15. That filing cited “harm resulting from a data and privacy breach,” and noted the potential for identity theft and financial fraud.
The suit alleges that Hankins “was exfiltrated by a threat actor” during a data breach of the healthcare provider’s computer network on or around February 23. It added that Hankins began notifying affected patients on or around March 14.
“Hankins further warned that the threat actor intended to misuse the exfiltrated patient PII and PHI to commit extortion, informing patients that the threat actor ‘threatened to reach out to our patients individually.’”
Consolidated Amended Class Action Complaint, Jennifer Tausinga et al vs. Hankins Plastic Surgery Associates, September 15
The complaint continued by stating that the data involved in the breach included but was not limited to “patient names, contact information, dates of birth, Social Security Numbers, driver’s license information, medical history, consultation notes, and photos.”
The suit continued by saying that the breach was “a direct result of Defendant’s failure to implement adequate and reasonable cyber-security procedures and protocols,” adding that plaintiffs’ personal data was “now in the hands of cybercriminals who wish to use it for nefarious purposes.”
Plaintiff Tausinga stated in the complaint that she was contacted by one of the hackers on March 28 through a texting app, and she said that the threat actor threatened to distribute her information “unless she paid a ransom to the threat actor directly.”
She refused, and according to court documents, the threat actor then shared her…