Norton Healthcare to Pay $11M to Settle BlackCat Lawsuit

Norton Healthcare, which operates nine hospitals and 480 other care facilities in Kentucky and Indiana, has agreed to pay $11 million to settle class action litigation triggered by a 2023 data theft attack by ransomware-as-a-service gang Alphv/BlackCat that affected nearly 2.5 million people.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

Under the preliminary settlement, which is set for a final court approval hearing on May 15 at a Kentucky state court, nonprofit Norton Healthcare will pay class member claims up to $2,500 each for unreimbursed out-of-pocket expenses that are “fairly traceable” to the data incident.

Norton Healthcare also will pay each class member for claims of up to $80 – or $20 per hour, up to four hours – for time spent related to dealing with the data breach. That includes time spent acquiring credit freezes, remedying actual fraud and monitoring bank statements.

Class members can also submit a claim for Norton Healthcare’s offer of three years of complimentary medical identity monitoring services.

All class members, regardless of whether they submitted claims for out-of-pocket expenses or lost time, are also eligible to receive a pro-rata cash payment of up to $5 based on what’s left of the $11 million settlement fund after payments are made for the other claims, administrative expenses, credit monitoring, court-appointed attorney fees, service awards and other costs.

Class counsel is slated to receive up to one-third of the settlement fund, or about $3.6 million, for attorney’s fees. Several class representatives each will receive $3,500 service awards.

Norton Healthcare in its breach notification letter told affected individuals that it did not pay a ransom in the attack (see: Kentucky Hospital Chain Notifying 2.5 Million of Data Theft).

The healthcare group said that on May 9, 2023, it experienced a cybersecurity incident, later determined to be a ransomware attack.

Norton Healthcare notified the FBI and investigated the incident with outside legal and forensic security assistance.

The investigation found that hackers gained access to certain Norton Healthcare network storage devices between May 7, and May 9, 2023, but did not access the provider’s medical record system or Norton MyChart patient portal.

The incident compromised the information of current and former patients, employees, employee’ dependents and beneficiaries, and caused Norton Healthcare to cancel appointments, surgeries and other medical procedures for several weeks.

The information contained in the stolen documents potentially included individuals’ name, contact information, Social Security Number, date of birth, health information, insurance information, medical identification numbers, driver’s license numbers or other government ID numbers, financial account numbers and digital signatures.

Russian-speaking Alphv/BlackCat claimed on its darkweb site to have stolen 4.7 terabytes of Norton Healthcare’s data.

The class action litigation, among other claims, alleged that Norton Healthcare “did not have adequate security protocols to prevent, detect and stop the cybercriminals from committing the cyberattack, a ransomware attack, and accessing the voluminous protected health information” Norton stored on its systems (see: Class Action Attorneys Circling Major Healthcare Breaches).

The complaint also alleged that “plaintiffs and the proposed class members have suffered identity theft and fraudulent charges, have been forced to expend significant time and effort to remediate the consequences of the breach, and have been caused anxiety and emotional distress; as well as a lifetime risk of identity theft, as it includes sensitive information that cannot be changed, like their dates of birth and Social Security numbers.”

Under the settlement, Norton Healthcare denies any wrongdoing.

Unlike many recent settlements in similar class action lawsuits involving cyberattacks and major data thefts, the agreement between Norton Healthcare and the litigants does not appear to require the healthcare organization to implement any improvements to its security practices.

“This settlement brings resolution for those potentially affected,” said a Norton Healthcare spokesperson in a statement to Information Security Media Group. “The court granted the plaintiffs’ request for preliminary approval of the settlement, and we look forward to moving toward final approval according to the court’s schedule.” Norton Healthcare did not address ISMG’s request for additional details, including the steps the organization has taken to help prevent future similar security incidents.