Louisville, Ky.-based Norton Healthcare is facing two lawsuits for a May cybersecurity breach that exposed patient data, Fox affiliate WDRB reported Dec. 15.
The first federal class-action lawsuit was filed in July. The second was filed Dec. 14, and it alleges that Norton failed to uphold its commitment to maintaining the confidentiality of personal and private health information. The lawsuit also said the health system had insufficient security measures in safeguarding sensitive files and that it did not disclose which information was compromised as a result of the hack.
Norton has yet to verify the data that may have been exposed, but patients could have had their names, contact information, Social Security numbers, birth dates, health and insurance information, drivers license numbers, financial account details and digital signatures compromised.
The plaintiffs are seeking a jury trial.
"We are committed to taking the protection of personal information seriously and intend to vigorously defend ourselves in any legal proceedings related to the ransomware attack earlier this year," a Norton spokesperson told the news outlet.
Norton said 2.5 million patients were affected.