Delaware Health System Plans to Settle Rhysida Hack Lawsuit

Bayhealth Medical Center in Delaware – an alleged victim of a 2024 hack by the “notorious” and prolific ransomware gang Rhysida that resulted in a breach affecting nearly a half-million people – has agreed to a preliminary settlement in a proposed class action lawsuit stemming from the incident.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

Attorneys representing the plaintiffs and class members in the litigation against Bayhealth along with counsel representing the medical center, in a joint status report, told a Delaware federal court on Sept. 17 that they were hammering out details of a potential settlement of the lawsuit filed in August 2024 by several patients affected by the breach.

The lawsuit, which alleged negligence and invasion of privacy among other claims, sought financial damages and injunctive relief requiring Bayhealth “to use adequate security consistent with industry standards to protect the data entrusted to it.”

Bayhealth was among several healthcare organizations – including Community Health Alliance in Rhode Island, Axis Health System in Colorado and Sunflower Medical Group in Kansas – that were hit in a rash of ransomware attacks and data thefts in the healthcare sector during 2024 and into 2025 claimed by cybercrime gang Rhysida.

One of Rhysida’s highest-profile healthcare sector victims to date was Ann & Robert H. Lurie Children’s Hospital of Chicago. The gang’s February 2024 ransomware attack disrupted the pediatric hospitals’ IT systems for weeks and resulted in data theft affecting nearly 776,000 people (see: Rhysida Offers to Sell Children’s Hospital Data for $3.4M).

Most recently, Rhysida claimed to be behind a Sept. 5 attack on a non-healthcare sector victim – Elite Trailers, a U.S.-based manufacturer of custom trailers.

‘Notorious’ Gang

Since it surfaced in 2023, ransomware-as-a-service gang Rhysida has been the subject of several alerts by U.S. federal agencies warning healthcare and other sectors – including education, government, IT and manufacturing – of the gang’s attacks (see: Authorities Warn Health Sector of Attacks by Rhysida Group).

A joint advisory in April from the FBI, the Cybersecurity and Infrastructure Security Agency and the Multi-State Information Sharing and Analysis Center provided an update on Rhysida’s latest indicators of compromise and the gang’s tactics, techniques and procedures.

For example, Rhysida has been observed using Gootloader malware at times for initial access.

“Rhysida is an especially notorious cybercriminal group,” the class action lawsuit against Bayhealth Medical Center alleged, adding that a plaintiff in the litigation in August 2024, discovered that her personally identifiable information and protected health information – including her email and Social Security number – were published on the darkweb.

Also among Bayhealth data leaked on Rhysida’s darkweb site were patients’ passports, Social Security card numbers and other sensitive employee documents, the lawsuit alleged.

“Upon information and belief, this exposure is directly traceable to defendant’s data breach and the theft of her PII/PHI by Rhysida,” the lawsuit claimed.

The lawsuit alleged that Rhysida demanded Bayhealth pay a ransom of 25 bitcoins, worth about $1.4 million at the time of the incident.

Attorneys representing Bayhealth and the plaintiffs in the litigation against the medical center did not immediately respond to Information Security Media Group’s requests for comment on the pending settlement and for additional details regarding Rhysida’s claims and alleged ransom demand.

Breach Details

Bayhealth reported to the U.S. Department of Health and Human Services on Oct. 14, 2024, as an HIPAA breach affecting 497,047 people tied to the hack.

In its breach notice, Bayhealth said that on July 31, 2024, it learned of suspicious activity in its network and immediately launched “an investigation with the assistance of forensic specialists, to secure our environment and determine the nature and scope” of the incident.

The investigation found that threat actors accessed Bayhealth’s IT network between July 27 and July 31, 2024, during which time the hackers acquired copies of “certain information” from the medical center’s systems.

“The files included information used for the operation of Bayhealth facilities,” the medical center said. “The files may include Social Security numbers, medical information related to the provision of healthcare and health insurance information.”

Bayhealth, on its website, said it is central and Southern Delaware’s largest healthcare system, and includes three hospital campuses, a freestanding emergency department, an emergency and urgent care center, as well as several satellite facilities and it employs physician practices encompassing a variety of specialties.

Not-for-profit Bayhealth has 5,000 employees and a medical staff of more than 450 physicians and 200 advanced practice clinicians. Bayhealth is an affiliate of Penn Medicine for Cardiac Surgery and is a member of the Penn Cancer Network.