As of late June, four class-action lawsuits have been filed in California's Southern District against Scripps Health (Scripps) in response to a late-April, early May 2021 data breach in which sensitive personal and medical information of more than 147,000 patients. Two of these cases are Rubenstein ind. and obo v. Scripps Health, 3:21-cv-01135, and Rasmussen ind. and obo v. Scripps Health, 3:21-cv-01143-H-DEB.
The lawsuits allege that the month-long ransomware attack was "massive and preventable," and was the result of Scripps' negligent and/or careless failure to properly safeguard and secure the data of patients, staff, and physicians.
The information stored on the network and compromised in the incident included names, dates of birth, Social Security numbers, driver's license numbers, medical records, lab results, and others. According to one of the lawsuits cited above, the attack also disrupted the IT systems for a full month, preventing patients from logging into their MyScripps accounts and scheduling appointments.
According to the complaint, during that month, four of the five Scripps hospitals were unable to receive certain patients, including heart attack and stroke victims, due to the breach.
During the month-long attack, some employees were instructed to use paid time off or work without pay during May, as employees were unsure of whether the pay system would work while systems were offline.
The cases allege that Scripps should have foreseen the possibility of a cyberattack, given the nature of the information stored, and the increasing prevalence of data breaches against entities in possession of health and medical information.
Although the incident happened in late April, the litigation alleges that many people affected by the attack were not notified by Scripps until June 1.
Although the data breach was severe, the complaint alleges that Scripps did very little to help protect those individuals who were affected by the breach, and only offered 12 months of identity theft and credit monitoring protection to a select few victims.
Parties to the lawsuits ask that Scripps pay $1,000 per violation, up to $3,00 in damages per plaintiff and class member, and other costs.
Editor's Note: It is unclear whether Scripps had any insurance policies under which coverage would be applicable in this case, but the severity of this ransomware attack, and the fact that the complaints allege that Scripps should have foreseen the possibility of a cyberattack, given the nature of the information stored, and the increasing prevalence of data breaches against health providers who store sensitive patient information, is yet another indication that such insurance coverage is becoming more important in our technology age.