Loading story…
ALN Medical Management and Octapharma Plasma have agreed to pay a combined total of $6.5 million to settle class action lawsuits stemming from separate cyberattacks that occurred in 2024. ALN Medical Management, a Nebraska-based revenue cycle management firm acquired by Health Prime in 2023, experienced a significant cyber incident in March 2024. Initially, ALN reported the breach to U.S. federal regulators as affecting only 501 individuals, but subsequent investigations revealed the true impact was much larger, with court documents indicating approximately 1.8 million people were affected. The company has agreed to pay $4 million to resolve the proposed class action lawsuit related to this breach. The breach was reported as a HIPAA data breach, highlighting the exposure of sensitive healthcare information. The settlement is pending a preliminary court hearing, with the date yet to be determined. Octapharma Plasma, a Swiss-based pharmaceutical manufacturer with blood plasma collection centers in the United States, was also targeted in a separate cyberattack in April 2024. In response to the resulting class action litigation, Octapharma Plasma has agreed to pay $2.55 million to settle claims from affected individuals. Both companies are among the latest in the healthcare sector to face multimillion dollar settlements following major hacking incidents. The breaches underscore the ongoing risks to patient data and the significant financial and reputational consequences for healthcare organizations. The settlements reflect the growing trend of legal action and regulatory scrutiny following large-scale data breaches in the healthcare industry. Both incidents involved the compromise of sensitive personal and health information, leading to widespread notification and remediation efforts. The lawsuits alleged that the companies failed to adequately protect patient data, resulting in unauthorized access and potential misuse of information. The settlements are intended to compensate affected individuals and cover costs related to credit monitoring and identity protection. These cases highlight the importance of robust cybersecurity measures and incident response planning for healthcare organizations. The financial impact of the settlements serves as a warning to other entities in the sector about the potential costs of inadequate data protection. The incidents have prompted calls for increased investment in cybersecurity and compliance with data privacy regulations. Both ALN Medical Management and Octapharma Plasma have taken steps to address the vulnerabilities exploited in the attacks and to enhance their security postures moving forward. The legal outcomes may influence future litigation and regulatory actions in the healthcare industry regarding data breaches.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
ALN and Octapharma Plasma agreed to settle lawsuits related to a data breach, according to reports published on October 10, 2025. No additional details about the breach timeline, impact, or settlement terms were provided in the reference content.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several healthcare organizations are resolving class-action litigation tied to alleged exposure of sensitive patient data, with settlements emphasizing cost avoidance rather than admissions of wrongdoing. **Kaiser Permanente** agreed to a **$46 million** settlement over claims that patient interactions with certain Kaiser websites and digital tools resulted in personal health information being transmitted to third parties (including **Google, Microsoft Bing, Twitter/X, and Adobe**) via online tracking/advertising technologies; the allegations focus on web/digital activity rather than Kaiser’s core electronic medical record systems, and the proposed class period spans **2017–2024**. Separately, two healthcare entities reached settlements following **network intrusions** that allegedly exposed protected health information and other sensitive identifiers. **Mystic Valley Elder Services** agreed to pay **$520,000** to settle claims stemming from an **April 2024** incident in which attackers accessed its network and potentially obtained data including SSNs, financial/payment data, credentials, and medical/insurance information affecting **~89,600** people; plaintiffs also alleged delayed detection and notification. **Consulting Radiologists Ltd.** received approval for a **$2.2 million** settlement after a 2024 intrusion affecting up to **583,824** individuals, with allegations including inadequate security controls and delayed breach notification; the organization reported that some impacted records included medical/insurance data and SSNs (for a subset of individuals).
Jun 29, 2026
Heritage Provider Network, one of the largest physician-owned healthcare networks in the United States, and nine of its affiliated physician practices have agreed to pay nearly $50 million to settle consolidated class action lawsuits stemming from a major ransomware and data theft incident in December 2022. The breach affected more than 3.4 million current and former patients, whose sensitive personal and medical information was compromised. The impacted practices include Regal Medical Group, Lakeside Medical Organization, Greater Covina Medical Group, Affiliated Doctors of Orange County Medical Group, Arizona Health Advantage, AZPC Clinics, Community Surgery Center of Glendale, Pacific Family Hospice, and Valley’s Best Hospice. Plaintiffs in the lawsuits alleged that the compromised data, which included names, Social Security numbers, addresses, dates of birth, and medical information, was leaked on the dark web. Notices about the breach were sent to affected individuals in early 2023, alerting them to the exposure of their information. The $49.9 million settlement provides each class member with three years of complimentary identity and theft monitoring services. Eligible class members who submit valid claims can receive cash payments of up to $10,000 for documented fraud or out-of-pocket expenses related to the breach. The settlement aims to address the alleged failure of Heritage Provider Network and its affiliates to adequately protect patient data, as detailed in the class action complaints. The legal resolution covers an estimated 3,413,000 individuals who received notification of the breach. The settlement was reached after plaintiffs claimed that the defendants’ security measures were insufficient to prevent the ransomware attack and subsequent data theft. The incident has highlighted the ongoing risks faced by healthcare organizations in protecting sensitive patient information from cybercriminals. The settlement also underscores the significant financial and reputational consequences that can result from large-scale healthcare data breaches. Heritage Provider Network and its affiliates have not admitted wrongdoing but agreed to the settlement to resolve the litigation. The case serves as a reminder for healthcare providers to continually assess and strengthen their cybersecurity posture to mitigate the risk of future incidents. The settlement is one of the largest in recent years for a healthcare data breach, reflecting the scale and impact of the incident. Affected patients are encouraged to review the settlement terms and submit claims if eligible.
Jun 29, 2026
Multiple healthcare organizations in the United States have experienced significant data breaches involving the exposure of protected health information (PHI) and other sensitive personal data. In Albemarle County, Virginia, a ransomware attack compromised the PHI of members of its self-insured health plan, as well as data belonging to current and former government and public school employees, their dependents, and individuals who interacted with the county. The compromised information included names, Social Security numbers, health insurance details, and other identifiers. The county has concluded its investigation, notified affected individuals, and is offering complimentary credit monitoring and identity theft protection services. Separately, class action settlements have been reached with three healthcare providers—Hypertension Nephrology Associates, Asheville Arthritis and Osteoporosis Center, and Intermountain Planned Parenthood—following data breaches that exposed patient health and financial information. In one case, Hypertension Nephrology Associates agreed to a $625,000 settlement after a ransomware attack led to the theft of data from nearly 40,000 patients. The lawsuits alleged failures in security practices and delayed breach notifications, with affected individuals being offered credit monitoring services. These incidents highlight ongoing legal and regulatory consequences for healthcare organizations following data breaches involving PHI.
Jun 29, 2026