Madison-based Group Health Cooperative of South Central Wisconsin reported that a cyberattack in January affected 533,809 people, according to the Wisconsin State Journal, and the stolen data may include Social Security numbers. Madison attorney Sam Strauss on Thursday filed two class-action lawsuits in Dane County Circuit Court against Group Health over the data breach.
One suit accuses Group Health of negligence in safeguarding patient information and responding appropriately to the breach, defining Group Health as medical clinics, pharmacies, and providers. The other suit is similar but defines Group Health as a member-owned health plan.
Group Health’s statement, released Tuesday, says it identified unauthorized access to its network on Jan. 25. Its information technology department made several systems temporarily unavailable, securing the network.
The hacker tried and failed to encrypt the company’s systems. Group Health reported the incident to the FBI and hired outside help to investigate the attack and restore its network security.
The company on Feb. 9 saw indications that the attacker had copied some of the data, possibly including names, Social Security numbers, addresses, phone numbers, email addresses, dates of birth or death, Group Health member numbers, Medicare numbers, and Medicaid numbers.
Group Health says it has taken other steps to mitigate harm by working with the FBI and the U.S. Cybersecurity and Infrastructure Security Agency. It has also informed individuals who were potentially affected.
