Lehigh Valley (Pa.) Health Network agreed to pay $65 million in a proposed settlement of a class action lawsuit affecting 134,000 patients and employees, the Information Security Media Group reported Sept. 23.
Lehigh Valley Health was hit with a cyberattack by Russian ransomware group BlackCat in February 2023 which targeted Scranton, Pa.-based Delta Medix Group, a physician practice that is a part of Lehigh Valley Health Network.
The group was extorted over stolen exam photos of breast cancer patients posted on a data leak site by BlackCat. In a Sept. 23 statement to ISMG, LVHN said that BlackCat demanded a ransom which they refused to pay. LVHN hired cybersecurity firms to investigate the attack and notified law enforcement.
Under the preliminary settlement, LVHN will pay four tiers of affected class members, ranging from $50 to $125,000, which will go to the lead plaintiff. A final approval hearing of the proposed settlement is scheduled for Nov. 15.