Loading story…
Group Health Cooperative of South Central Wisconsin agreed to a $3.5 million settlement to resolve a class action lawsuit following a data breach that exposed the protected health information (PHI) of over 533,000 individuals. The breach, detected in January 2024, involved unauthorized access to sensitive data including names, Social Security numbers, and Medicare/Medicaid numbers. The settlement, which has received preliminary court approval, will compensate affected class members and was reached to avoid the costs and risks of continued litigation, with the defendant denying any wrongdoing.
Separately, Concentra Inc. settled with the U.S. Department of Health and Human Services Office for Civil Rights (OCR) for $112,500 over a HIPAA Right of Access violation, after failing to provide a patient with timely access to their medical records despite multiple requests. This enforcement action is part of an ongoing OCR initiative targeting noncompliance with the HIPAA Privacy Rule's right of access provision. These cases highlight the significant financial and legal consequences for healthcare organizations that fail to adequately protect patient data or comply with HIPAA requirements.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
The proposed $3.5 million settlement received preliminary court approval, with final proceedings scheduled for early 2026.
Group Health Cooperative of South Central Wisconsin agreed to settle the consolidated data breach lawsuit for $3.5 million while denying wrongdoing. The settlement offers affected individuals credit monitoring, identity theft protection, reimbursement for losses, or a cash payment.
Concentra agreed to pay $112,500 to settle OCR's allegations over the Right of Access violation, while disputing that it had violated HIPAA.
Following the January 2024 breach, lawsuits were consolidated into a class action alleging the organization failed to protect affected individuals' information.
In January 2024, Group Health Cooperative of South Central Wisconsin experienced a data breach that exposed the protected health information of more than 533,000 individuals.
The U.S. Department of Health and Human Services Office for Civil Rights began an enforcement initiative in 2019 focused on noncompliance with the HIPAA Privacy Rule's Right of Access provision.
OCR initially sought a $250,000 penalty against Concentra over the alleged HIPAA Right of Access violation before the matter proceeded toward an administrative hearing.
A patient made six requests to Concentra for medical and billing records, but the records were not provided within HIPAA's required 30-day timeframe after the requests were forwarded to Concentra's Central Billing Office.
2 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcehipaajournal.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several healthcare organizations are resolving class-action litigation tied to alleged exposure of sensitive patient data, with settlements emphasizing cost avoidance rather than admissions of wrongdoing. **Kaiser Permanente** agreed to a **$46 million** settlement over claims that patient interactions with certain Kaiser websites and digital tools resulted in personal health information being transmitted to third parties (including **Google, Microsoft Bing, Twitter/X, and Adobe**) via online tracking/advertising technologies; the allegations focus on web/digital activity rather than Kaiser’s core electronic medical record systems, and the proposed class period spans **2017–2024**. Separately, two healthcare entities reached settlements following **network intrusions** that allegedly exposed protected health information and other sensitive identifiers. **Mystic Valley Elder Services** agreed to pay **$520,000** to settle claims stemming from an **April 2024** incident in which attackers accessed its network and potentially obtained data including SSNs, financial/payment data, credentials, and medical/insurance information affecting **~89,600** people; plaintiffs also alleged delayed detection and notification. **Consulting Radiologists Ltd.** received approval for a **$2.2 million** settlement after a 2024 intrusion affecting up to **583,824** individuals, with allegations including inadequate security controls and delayed breach notification; the organization reported that some impacted records included medical/insurance data and SSNs (for a subset of individuals).
Jun 29, 2026
The U.S. Department of Health and Human Services Office for Civil Rights announced HIPAA enforcement settlements against **Assured Imaging Affiliated Covered Entities, Axia Women’s Health, Star Group, L.P. Health Benefits Plan, and Consociate Health** after ransomware-related breaches exposed the electronic protected health information of about **427,000 individuals**. OCR said the cases shared the same core failure: deficient or nonexistent security risk analysis under the HIPAA Security Rule, and each organization agreed to a corrective action plan with **two years of federal monitoring**. The settlements totaled **about $1.7 million** across the four cases, with reports also citing **$1,165,000 in penalties** as part of the enforcement actions. OCR said a HIPAA gap assessment is not a substitute for a formal risk analysis and warned that unresolved known risks can increase liability after a breach. Regulators and experts said covered entities should inventory all systems holding `ePHI`, assess threats and vulnerabilities, assign and track risk remediation, and strengthen controls such as access management, audit logging, encryption, incident response planning, and workforce training.
Jun 29, 2026
Hospital Sisters Health System (HSHS), a network comprising 13 Catholic hospitals, community health centers, and clinics in the Midwest, has agreed to a $7.6 million settlement to resolve consolidated class action litigation stemming from a significant cyberattack in August 2023. The targeted attack compromised the personally identifiable information (PII) and protected health information (PHI) of approximately 882,782 individuals. The breach exposed sensitive patient data, raising concerns about identity theft and medical fraud among those affected. As part of the settlement, HSHS will offer up to $5,000 in compensation to each eligible class member who can demonstrate out-of-pocket losses directly linked to the incident. Alternatively, affected individuals may opt for a pro-rated cash payment, the amount of which will be determined after accounting for all valid claims and the costs of additional services. The settlement also includes the provision of 24 months of complimentary credit and identity monitoring services to help mitigate the risk of further harm. HSHS has committed to enhancing its data security practices as a condition of the settlement, aiming to prevent similar incidents in the future. The breach and subsequent litigation highlight the growing financial and reputational risks healthcare organizations face from cyberattacks. The incident underscores the critical importance of robust cybersecurity measures in the healthcare sector, where the value of patient data makes organizations prime targets for threat actors. The settlement reflects the increasing trend of legal and financial accountability for healthcare providers following major data breaches. The attack on HSHS is part of a broader pattern of escalating cyber threats against healthcare institutions, which often result in significant costs for detection, response, and recovery. The litigation and settlement process has drawn attention to the need for proactive risk management and incident response planning in healthcare. The case also demonstrates the legal recourse available to victims of healthcare data breaches, including compensation for direct financial losses. HSHS's response, including the settlement and security improvements, may serve as a model for other organizations facing similar incidents. The breach has prompted renewed calls for industry-wide adoption of stronger cybersecurity frameworks and regular security assessments. The incident has also contributed to ongoing discussions about regulatory requirements and best practices for protecting sensitive health information. Overall, the HSHS breach and its aftermath illustrate the complex challenges and high stakes involved in safeguarding healthcare data in an increasingly hostile cyber threat landscape.
Jun 29, 2026