A class-action lawsuit has been filed against Anna Jaques Hospital in Newburyport, Mass., and its parent organization, Boston-based Beth Israel Lahey Health, over a December 2023 data breach that exposed the personal and medical information of 316,342 patients.
The suit, filed Jan. 2 in the U.S. District Court for the District of Massachusetts, alleges the healthcare organizations failed to implement sufficient security measures to safeguard sensitive data, including Social Security numbers, medical histories and insurance details. The compromised information has reportedly surfaced on the dark web.
The breach occurred Dec. 24, 2023, when Anna Jaques Hospital was targeted by the Money Message ransomware group. The gang claimed responsibility for stealing 600GB of data, including files tied to the hospital and Beth Israel Lahey Health.
The plaintiffs, according to the lawsuit obtained by Becker's, are seeking damages and court-ordered actions to bolster data security measures and ensure lifetime identity theft protection for those affected by the breach.
Becker's reached out to Beth Israel Lahey Health for comment and will update the story if more information is learned.