Three Pennsylvania Superior Court judges upheld a former ruling that Pittsburgh-based UPMC wasn't negligent in a 2014 data breach, according to the Pittsburgh Post-Gazette.
In March 2014, UPMC reported 322 employees' tax information had been stolen, a number they later revised to 27,000 employees. The employees filed a class-action lawsuit in the Allegheny County Court of Common Pleas, alleging the health system failed to adequately protect employee information and did not disclose the breach in a timely manner.
In a May 2015 ruling, Judge R. Stanton Wettick dismissed the employees' claims, stating UPMC was also a victim of the cyberattack and an improved cybersecurity system may not have prevented the breach.