A district court in Maryland has granted CareFirst BlueCross BlueShield's motion to dismiss a class action lawsuit filed against the payer regarding a data breach that exposed data of 1.1 million members, saying the plaintiffs' argument does not sufficiently indicate any harm.
The two plaintiffs filed the lawsuit after CareFirst reported in May that it suffered two cyberattacks, one in June 2014 and the other in May 2015. CareFirst is the largest payer in the Mid-Atlantic region, and the cyberattack affected nearly one-third of its 3.4 million customers. The payer said personal information including names, birth dates, email addresses and member identification numbers may have been affected.
In their lawsuit, the plaintiffs allege CareFirst "knew or should have known earlier" of the breaches, as the type of compromised information is "highly coveted by and a frequent target of hackers." Additionally, they allege they had a "reasonable expectation that their confidential personal information would remain private and confidential." The plaintiffs claim they and class members "have lost or are subject to losing money and property," though neither named plaintiff has suffered any actual injury so far, according to court documents.
In the court's opinion granting the motion to dismiss the case, it says the plaintiffs lack standing and fail to allege a sufficient injury. The court indicates the plaintiffs have not cited a single instance where data was misused since the breach, and they don't provide facts to show the breach could cause future harm. "This court does not have subject matter jurisdiction to adjudicate their claims," reads the opinion.
More articles on data breaches:
78% of organizations don't have a plan to deal with cybersecurity
Providence notifies 5,400 patients of insider breach
What cyber criminals want with your health record