Freehold, N.J.-based CentraState Medical Center has been hit with five more class-action lawsuits over a December cyberattack that affected nearly 618,000 patients, bringing the total to six, New Jersey Law Journal reported.
The hospital began notifying patients in early February that hackers may have stolen such data as names, addresses, dates of birth, Social Security numbers, treatment plans, diagnoses and prescription information.
Three of the lawsuits were filed in Monmouth County (N.J.) Superior Court, while the others were in federal court, according to the Feb. 24 story. One of the complaints noted that protected health information fetches a hefty price on the black market: up to $363, compared to $40 to $200 for personally identifiable details and $50 to $200 for banking information.
A CentraState spokesperson told the Law Journal the hospital doesn't comment on pending litigation.
"If you can demonstrate that your security was set up consistent to a cybersecurity framework, that can be an affirmative defense," Elizabeth Litten, a Princeton, N.J., data lawyer who is not involved in the lawsuits, told the news outlet. "One of the difficulties with respect to a healthcare provider is that you can have set policies and procedures in place that are best practices and still be the victim of a breach, because hackers are getting more sophisticated and humans can fall for phishing attacks that introduce malware into a system and wreak havoc."