Loading story…
Massachusetts-based ambulance billing and collections firm Comstar agreed to pay $515,000 to settle allegations by the Massachusetts and Connecticut attorneys general that it violated HIPAA and state data security requirements following a March 2022 ransomware attack. Reporting indicates the intruder accessed Comstar’s network, exfiltrated files, and then encrypted systems with ransomware; exposed data included names, Social Security numbers, driver’s license numbers, financial data, and medical/assessment information. The incident ultimately affected ~585,621 individuals (including large numbers of Massachusetts and Connecticut residents), and regulators cited failures such as not conducting a comprehensive risk analysis for ePHI; separate federal enforcement by HHS OCR was resolved via a $75,000 penalty and a corrective action plan.
The Comstar case is being highlighted as a practical example that healthcare breaches can trigger stacked consequences—federal enforcement, state AG actions, and class-action litigation—in addition to extortion demands from ransomware operators. The breach’s downstream impact extended to organizations that had used Comstar as a vendor years earlier, with some providers reporting that their patients’ data was implicated even if the provider was no longer a Comstar client at the time of the incident. Separate reporting on class-action settlements involving Texas and New Jersey dermatology practices concerns different incidents and does not materially add to the Comstar enforcement story.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-01-28, the Massachusetts and Connecticut Attorneys General filed a proposed $515,000 settlement in Suffolk Superior Court over alleged HIPAA and Massachusetts data security violations. The consent judgment requires Comstar to implement a written information security program, specific security controls, and annual third-party assessments for three years.
In May 2025, HHS OCR announced a $75,000 settlement with Comstar and imposed a corrective action plan. OCR found Comstar had failed to conduct a comprehensive and accurate HIPAA risk analysis for ePHI and cited delayed detection of the intrusion.
Class-action litigation stemming from the Comstar breach was filed, later consolidated, and settled in December 2022. The settlement terms were not made public.
In May 2022, Comstar reported that patient personal data and protected health information had been encrypted in the incident. It later notified HHS that 68,957 patients were affected.
On 2022-03-26, Comstar detected a ransomware incident in which a threat actor exfiltrated files and encrypted data. A forensic investigation later confirmed protected health information and other sensitive data had been stolen.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Health and Human Services Office for Civil Rights announced HIPAA enforcement settlements against **Assured Imaging Affiliated Covered Entities, Axia Women’s Health, Star Group, L.P. Health Benefits Plan, and Consociate Health** after ransomware-related breaches exposed the electronic protected health information of about **427,000 individuals**. OCR said the cases shared the same core failure: deficient or nonexistent security risk analysis under the HIPAA Security Rule, and each organization agreed to a corrective action plan with **two years of federal monitoring**. The settlements totaled **about $1.7 million** across the four cases, with reports also citing **$1,165,000 in penalties** as part of the enforcement actions. OCR said a HIPAA gap assessment is not a substitute for a formal risk analysis and warned that unresolved known risks can increase liability after a breach. Regulators and experts said covered entities should inventory all systems holding `ePHI`, assess threats and vulnerabilities, assign and track risk remediation, and strengthen controls such as access management, audit logging, encryption, incident response planning, and workforce training.
Jun 29, 2026
Several healthcare-related organizations disclosed **separate data breach incidents** involving ransomware, unauthorized network access, and third-party compromise. CommonSpirit Health said patient data was exposed through a downstream vendor chain after **Pinnacle Holdings Ltd** suffered a ransomware attack, with attackers present in the network from November 11 to November 25, 2024, and exfiltrating files before the incident was later relayed through **NorthGauge Healthcare Advisors**. Meadowlark Hills and MedPeds also disclosed breaches tied to the **Beast ransomware** group, while Tieu Dental reported unauthorized access to its network in July 2025 that exposed patient information including Social Security numbers, medical and insurance data. These incidents led to regulatory notifications and offers of credit monitoring or identity theft protection for affected individuals. A separate legal development involved **Geisinger Health** and **Nuance Communications**, where a judge approved a **$5 million settlement** over claims tied to a former Nuance employee's theft of medical records affecting about 1.3 million patients. That matter differs from the ransomware and breach notifications because it concerns civil litigation over an earlier insider data theft rather than a newly disclosed intrusion. Overall, the reporting reflects ongoing exposure of protected health information across the healthcare sector through both direct attacks and third-party relationships, with delayed notification timelines and incomplete early visibility into the full scope of compromised data remaining recurring issues.
Jun 29, 2026
**Norton Healthcare** agreed to pay **$11 million** to settle a class-action lawsuit tied to a 2023 **ALPHV/BlackCat** ransomware-related data theft that reportedly involved **4.7 TB** of stolen data and impacted nearly **2.5 million** people. The preliminary settlement provides for reimbursement claims (up to **$2,500** for unreimbursed expenses), compensation for time spent responding to the incident (up to **$80**), and **three years of medical identity monitoring**, pending final court approval. Separately, Ohio-based **Kettering Health** began notifying current and former patients and affiliates about a **May 2025** ransomware and data theft incident claimed by the **Interlock** cybercrime group. Reporting indicates Interlock publicly listed Kettering Health on its leak site and claimed roughly **941–950 GB** of data, and Kettering previously warned patients about **scam calls** from fraudsters impersonating medical bill collectors seeking credit card payments—activity consistent with post-breach social engineering and fraud attempts.
Jun 29, 2026