Five Ontario hospitals and their IT service provider are facing a proposed class action lawsuit following a cyberattack that exposed sensitive patient records.
According to a report by CBC News, the lawsuit is seeking $480 million in damages. It also alleged that approximately 267,000 individuals had been affected by the data breach.
The cyberattack occurred in October, impacting Bluewater Health, Windsor Regional Hospital, Chatham-Kent Health Alliance, Erie Shores HealthCare, and Hôtel-Dieu Grace Healthcare. All five hospitals shared the same IT service provider, Transform Shared Service.
Ransomware gang Daixin has taken responsibility for the attack on the hospitals, CBC News said. The group also claimed that some of the stolen data were published on the dark web.
In a joint response, the hospitals and TransForm acknowledged the receipt of the lawsuit but declined to comment further.
Robin Smith is reportedly the lawsuit’s lone named plaintiff. He was a longtime patient at Bluewater Health, according to court documents.
The lawsuit accused the hospitals and their IT service provider of failing to implement adequate “technical and procedural safeguards,” according to CBC News.
It also contended that the cybercriminals could gain access to the computer systems due to the defendants’ alleged negligence in protecting patients’ personal information and a lack of robust IT security policies.
Further, the lawsuit argued that the plaintiff and class action members experienced mental distress after being told that their data had been leaked.
“Such mental injuries were within the reasonable contemplation of the defendants at the time that the relationship was formed,” the lawsuit stated. “They are serious, prolonged, and rise above the ordinary annoyances, anxieties and fears that come with living in modern-day society.”
The attack on the Ontario hospitals is just one of several recent cybersecurity incidents. In November, the Toronto Public Library announced that it was targeted by a cyberattack that may have compromised the personal information of its current and former employees.
What are your thoughts on this story? Feel free to comment below.
