Hospital and Ortho Group Fight Back Against Cybercriminals

It’s no secret that medical practices and patients have been hit with data breaches over the past years. What may come as a surprise is the recent action by a hospital and orthopedic group in fighting back against the alleged cyber criminals and alleged associated parties.

Claxton-Hepburn Medical Center, Inc., Carthage Area Hospital, and North Country Orthopaedic Group, P.C. (collectively the “hospital group”) have filed a lawsuit against John Doe and Jane Doe (collectively “Does”) in the St. Lawrence County Court in New York.

The hospital group claims, per the complaint, that the identity of the Does “is currently unknown, as they have perpetrated the subject scheme in secrecy and utilizing the Worldwide Web.” Additionally, the hospital group alleges that the Does “conspired to carry out the complex cybercrime and movement of stolen assets.”

According to the hospital group, sensitive personal information was compromised in the data breach. That information purportedly includes “names, addresses, dates of birth, financial information, social security numbers, health insurance information, and other personally identifying and protected health information, as defined by the Health Insurance Portability and Accountability Act of 1996.” The sensitive personal information is supposedly still in the possession of the cybercriminals and their servers.

The hospital group claims that the data breach occurred on or about August 31, 2023. It further asserts that the Does “were able to gain access to the IT infrastructure of the Hospital Group and to transfer the stolen data to a cloud server owned and operated by Wasabi Technologies, Inc.” Wasabi is a cloud storage company based in Boston, Massachusetts.

The hospital group believes that “Wasabi has already provided copies of the stolen data to the FBI.” It is requesting injunctive relief against the Does and other entities to prevent the “access, transfer or duplication of the Stolen Data.” It is also requesting that “after the Stolen Data is returned to the Hospital Group, all other copies of the Stolen Data be destroyed.”

Will this case impact how hospital groups respond to cyberattacks in the future? It does raise some interesting considerations, the first being the actual filing of the lawsuit. In the past, medical groups have not typically responded to data breaches by filing lawsuits against the unnamed cybercriminals. Additionally, the lawsuit also raises interesting considerations for other entities associated with the data breaches including technology firms.