Loading story…
A federal court has granted preliminary approval for a $5 million settlement in a class action lawsuit involving Geisinger Health and Nuance Communications following a significant insider data breach. The breach, which occurred in 2023, involved a former Nuance employee who accessed and stole sensitive patient information from Geisinger Health two days after his termination. The compromised data included names, Social Security numbers, dates of birth, medical information, and health insurance details for over 1 million patients. Notification to the 1.2 million affected individuals was delayed until June 2024 due to an ongoing law enforcement investigation.
The settlement addresses both the class action litigation and the criminal case against the ex-Nuance worker. Geisinger Health, a major healthcare provider in Pennsylvania, and Nuance Communications, a Microsoft subsidiary, faced scrutiny for their handling of the breach and subsequent notification process. The incident highlights the risks associated with insider threats in healthcare and the importance of timely breach disclosure to affected individuals.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
The court scheduled a final approval hearing for the proposed Geisinger-Nuance settlement. The hearing is set to determine whether the $5 million class action settlement will receive final approval.
A Pennsylvania federal court granted preliminary approval to a $5 million settlement in consolidated class action litigation against Geisinger Health and Nuance Communications over the insider breach. The proposed settlement includes reimbursement for certain losses, cash payments, and one year of credit, medical monitoring, and identity theft protection for class members.
The accused individual, Max Vance, also known as Andre Burk, was charged under the federal Computer Fraud and Abuse Act in connection with the breach. He remains in custody pending trial.
In June 2024, Geisinger notified approximately 1.2 million individuals affected by the insider breach. The notices said potentially exposed information included personal, medical, and health insurance data.
A law enforcement investigation into the breach delayed notification to affected individuals. As a result, Geisinger did not notify roughly 1.2 million affected people until June 2024.
After discovering the incident, Geisinger notified Nuance about the unauthorized access. Nuance then permanently disconnected the former employee's access to prevent further misuse.
In 2023, a former Nuance employee allegedly accessed and stole Geisinger Health patient data two days after being terminated. The breach ultimately affected more than 1 million Geisinger patients and exposed data such as names, Social Security numbers, dates of birth, medical and insurance information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US healthcare data-breach litigation and enforcement activity saw multiple updates, including new criminal charges tied to the **2023 Geisinger Health** breach. Prosecutors filed a superseding indictment adding **two counts of false statements** against **Max Vance**, a former **Nuance Communications** employee accused of intentionally accessing a protected computer and obtaining **PHI for more than 1.3 million Geisinger patients** shortly after his termination; the new counts allege he lied to the FBI about downloading or storing unauthorized data on personal devices. Separately, two civil class-action matters reached settlement in breach cases involving patient data exposure. **Capital Health** agreed to a **$4.5M** settlement tied to a **2023 ransomware incident** in which intruders had network access for roughly two weeks and encrypted files; **LockBit** claimed responsibility and alleged **~7 TB** of data exfiltration, while Capital Health reported the incident to HHS OCR as affecting **503,071 individuals**. **Gryphon Healthcare** agreed to a **$2.87M** settlement (including a **$2.8M** fund) over a **2024 cyberattack** affecting a billing-services partner relationship, with **393,358 patients’ PHI** potentially viewed or obtained; the company denied liability but settled to avoid continued litigation costs and uncertainty.
Jun 29, 2026
Multiple healthcare-related organizations disclosed **separate** incidents involving exposure or theft of patient data. Delta Medical Systems reported unauthorized access to its email environment on July 15, 2025, with potentially exposed data including names, dates of birth, Social Security numbers, driver’s license information, bank details, insurance information, and medical information. A separate HIPAA Journal report described additional incidents at Cedar Valley Services, Community Nurse, and Health Dimensions Group, including a likely **Qilin ransomware** intrusion at Cedar Valley Services and a vendor-linked compromise affecting Community Nurse through *Doctor Alliance*, where files may have been accessed between October 31 and November 17, 2025. In a different but related healthcare privacy matter, a judge approved a **$5 million settlement** in litigation against Geisinger Health and *Nuance Communications* over the theft of medical records affecting roughly **1.3 million patients** by a former Nuance employee. The stolen records reportedly included names, birthdates, addresses, medical record numbers, treatment details, and insurance information. While all three reports concern healthcare data exposure, they describe **distinct incidents** rather than one unified breach event, spanning direct compromises, third-party/vendor exposure, suspected ransomware activity, and post-incident legal resolution.
Jul 12, 2026
A former Nuance Communications IT worker, **Max Vance** (also known as **Andre Vance**), pleaded guilty in Pennsylvania federal court to **obtaining information from a protected computer without authorization** after allegedly downloading and storing **~1.2 million Geisinger Health patient records** on a personal hard drive shortly after being terminated in 2023. Nuance (now part of **Microsoft**) was providing IT services to Geisinger at the time of the incident, and the criminal case was initially filed in January 2024. Geisinger previously stated the exposed data included patient **names, birthdates, addresses, medical record numbers, race, gender, phone numbers, and facility name abbreviations**. Under the plea agreement, prosecutors agreed to dismiss additional charges related to alleged false statements to the FBI that had been added in a superseding indictment, and Vance agreed to forfeit a **Samsung PSSD T7** external drive cited in the case.
Jun 29, 2026