Brewer, Maine-based Northern Light Health is being sued over a May 2020 data breach linked to its fundraising database platform, according to an April 23 Bangor Daily News report.
Brothers Jacob Gignac and Jeremy Gignac filed a complaint in Penobscot County Superior Court against Northern Light Health April 20, claiming the breach of the Blackbaud platform left them vulnerable to identity theft. Northern Light Health reported the incident to HHS as affecting 657,392 people.
The Blackbaud ransomware attack affected more than 25,000 nonprofit organizations across the globe, including more than 30 health systems in the U.S. The lawsuit claims that Northern Light violated Maine law by sharing personal health information with Blackbaud for fundraising reasons without getting patients' permission. The Gignac brothers also allege the health system did not encrypt the information it shared with Blackbaud.
A Northern Light spokesperson on April 22 declined to comment on the allegations and said the health system had not yet had time to review the lawsuit, according to the report.
The lawsuit is seeking class-action status, and the Gignac brothers are requesting to be repaid the money they have spent to protect themselves from identity theft and that Northern Light pay for future identity monitoring of their personal information.