OneBlood Agrees to Pay $1M Settlement in Ransomware Hack

A non-profit blood supplies provider to 250 hospitals in four states agreed to pay $1 million to settle proposed class action litigation filed after a 2024 ransomware attack that compromised the information of nearly 170,000 individuals.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

Under a preliminary settlement with OneBlood approved by a Broward County, Florida circuit court, affected individuals can claim up to $2,500 to cover documented losses or choose a cash payment of $60.

A final hearing is set by the court for Dec. 9. OneBlood denies any wrongdoing.

OneBlood discovered in late July 2024 that it was the victim of ransomware attack by criminal actors. The incident was one of several cyber incidents involving blood suppliers over the last year or so.

An investigation determined that the cybercriminals accessed OneBlood’s computer network between July 14 and July 29, 2024, gaining access or potential access to information of 167,400 individuals (see: OneBlood Notifying Donors Affected by 2024 Ransomware Hack).

Potentially compromised information included individuals’ name and identifiers such as Social Security numbers, payment card data and medical data such as mental or physical condition information and prescriptions. OneBlood distributes blood in Florida, Georgia and the Carolinas.

Other incidents involving blood suppliers include a January ransomware attack on New York Blood Center Enterprises, which collects and distributes blood to hospitals in at least seven states, including New York, New Jersey, Connecticut, Delaware, Rhode Island, Nebraska and Missouri (see: NY Blood Center Attack Disrupts Suppliers in Several States).

The NY Blood Center recently began notifying an undisclosed number of individuals that its attack also involved data theft (see: NY Blood Center Says Data Was Stolen in January Attack).

An April 2024 attack on Octapharma Plasma, the U.S. operations of a Swiss pharmaceutical maker, disrupted the firm’s blood collection and processing operations for several weeks (see: Suspected Attack Shuts Down U.S. Blood Plasma Donation Centers).

The most serious attack on a blood supplier to date occurred outside the United States. A June 2024 ransomware attack on Synnovis, a British pathology laboratory services provider, disrupted patient care and testing services at a number of London-based National Health System hospitals and other care facilities for several weeks (see: NHS: Most Patient Services Online Following Synnovis Attack).

That incident caused the postponement and cancellation of thousands of procedures and appointments and triggered a nationwide shortage of type-O blood supplies in the United Kingdom. The NHS also attributed the delay of care services caused by the disruption as a factor contributing to at least one patient’s death (see: Breach Roundup: UK NHS Links Patient Death to Ransomware Attack).

The string of blood supplier attacks also spurred the U.S. Food and Drug Administration, the Health Information Sharing and Analysis Center and the American Hospital Association to issue cyber alerts last year to the healthcare sector.