Murfreesboro Medical Clinic & SurgiCenter in Tennessee has agreed to settle class action litigation over a major data breach in April 2023 that involved unauthorized access to the protected health information of 559,000 patients.
Murfreesboro Medical Clinic determined that “a well-known cyber extortion operation” gained access to its network on or around April 22, 2023, and exfiltrated patient and employee data. Data compromised in the incident included names, dates of birth, home addresses, phone numbers, copies of driver’s licenses, full or partial social security numbers, dependent information, dates of service, medical and diagnostic information related to those dates of service, test results, procedure notes, prescription information, medical record numbers, and insurance and enrolment information. The affected individuals were notified about the attack in May 2023. The BianLian ransomware group claimed responsibility for the attack.
Six class action lawsuits were filed in response to the data breach, which were consolidated on September 7, 2023, into a single action – Krenk et al. v. Murfreesboro Medical Clinic and SurgiCenter and Murfreesboro Medical Clinic – in the 16th Judicial Circuit Court of Rutherford County, Tennessee, as the lawsuits had overlapping claims. The consolidated lawsuit alleged that the cyberattack occurred as a result of the defendants’ negligence and failure to comply with their statutory and common law duties. Murfreesboro Medical Clinic and SurgiCenter and Murfreesboro Medical Clinic deny all claims of liability and wrongdoing…