Loading story…
OneBlood, a non-profit organization supplying blood to 250 hospitals across four states, experienced a significant ransomware attack in July 2024. The cybercriminals gained unauthorized access to OneBlood's computer network between July 14 and July 29, 2024. As a result of this breach, the personal information of approximately 167,400 individuals was compromised or potentially exposed. The compromised data included names, Social Security numbers, payment card information, and sensitive medical data. Following the incident, OneBlood faced a proposed class action lawsuit from affected individuals. To resolve the litigation, OneBlood agreed to a $1 million settlement, which was preliminarily approved by a Broward County, Florida circuit court. Under the terms of the settlement, affected individuals are eligible to claim up to $2,500 for documented losses or opt for a $60 cash payment. A final court hearing regarding the settlement is scheduled for December 9. OneBlood has denied any wrongdoing in connection with the incident. The attack on OneBlood was part of a broader trend, as several other blood suppliers in the US and UK also suffered cyber incidents during the same period. The breach highlighted the vulnerability of healthcare and critical infrastructure organizations to ransomware attacks. The incident prompted OneBlood to notify all affected donors and individuals whose data may have been compromised. The organization undertook an internal investigation to determine the scope and impact of the breach. The settlement aims to provide financial relief to those impacted by the exposure of their sensitive information. The case underscores the increasing financial and reputational risks faced by healthcare providers in the wake of cyberattacks. The attack and subsequent settlement have drawn attention to the need for enhanced cybersecurity measures in the healthcare sector. The incident also serves as a warning to other organizations handling sensitive personal and medical data. Regulatory scrutiny and litigation risks are likely to increase for organizations that experience similar breaches. The OneBlood case demonstrates the potential costs and consequences of ransomware attacks on critical service providers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
OneBlood agreed to pay a $1 million settlement related to a ransomware incident, according to reports published on September 29, 2025. The available references do not provide additional details about the underlying attack date, impact, or settlement terms.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ALN Medical Management and Octapharma Plasma have agreed to pay a combined total of $6.5 million to settle class action lawsuits stemming from separate cyberattacks that occurred in 2024. ALN Medical Management, a Nebraska-based revenue cycle management firm acquired by Health Prime in 2023, experienced a significant cyber incident in March 2024. Initially, ALN reported the breach to U.S. federal regulators as affecting only 501 individuals, but subsequent investigations revealed the true impact was much larger, with court documents indicating approximately 1.8 million people were affected. The company has agreed to pay $4 million to resolve the proposed class action lawsuit related to this breach. The breach was reported as a HIPAA data breach, highlighting the exposure of sensitive healthcare information. The settlement is pending a preliminary court hearing, with the date yet to be determined. Octapharma Plasma, a Swiss-based pharmaceutical manufacturer with blood plasma collection centers in the United States, was also targeted in a separate cyberattack in April 2024. In response to the resulting class action litigation, Octapharma Plasma has agreed to pay $2.55 million to settle claims from affected individuals. Both companies are among the latest in the healthcare sector to face multimillion dollar settlements following major hacking incidents. The breaches underscore the ongoing risks to patient data and the significant financial and reputational consequences for healthcare organizations. The settlements reflect the growing trend of legal action and regulatory scrutiny following large-scale data breaches in the healthcare industry. Both incidents involved the compromise of sensitive personal and health information, leading to widespread notification and remediation efforts. The lawsuits alleged that the companies failed to adequately protect patient data, resulting in unauthorized access and potential misuse of information. The settlements are intended to compensate affected individuals and cover costs related to credit monitoring and identity protection. These cases highlight the importance of robust cybersecurity measures and incident response planning for healthcare organizations. The financial impact of the settlements serves as a warning to other entities in the sector about the potential costs of inadequate data protection. The incidents have prompted calls for increased investment in cybersecurity and compliance with data privacy regulations. Both ALN Medical Management and Octapharma Plasma have taken steps to address the vulnerabilities exploited in the attacks and to enhance their security postures moving forward. The legal outcomes may influence future litigation and regulatory actions in the healthcare industry regarding data breaches.
Jul 12, 2026
Heritage Provider Network, one of the largest physician-owned healthcare networks in the United States, and nine of its affiliated physician practices have agreed to pay nearly $50 million to settle consolidated class action lawsuits stemming from a major ransomware and data theft incident in December 2022. The breach affected more than 3.4 million current and former patients, whose sensitive personal and medical information was compromised. The impacted practices include Regal Medical Group, Lakeside Medical Organization, Greater Covina Medical Group, Affiliated Doctors of Orange County Medical Group, Arizona Health Advantage, AZPC Clinics, Community Surgery Center of Glendale, Pacific Family Hospice, and Valley’s Best Hospice. Plaintiffs in the lawsuits alleged that the compromised data, which included names, Social Security numbers, addresses, dates of birth, and medical information, was leaked on the dark web. Notices about the breach were sent to affected individuals in early 2023, alerting them to the exposure of their information. The $49.9 million settlement provides each class member with three years of complimentary identity and theft monitoring services. Eligible class members who submit valid claims can receive cash payments of up to $10,000 for documented fraud or out-of-pocket expenses related to the breach. The settlement aims to address the alleged failure of Heritage Provider Network and its affiliates to adequately protect patient data, as detailed in the class action complaints. The legal resolution covers an estimated 3,413,000 individuals who received notification of the breach. The settlement was reached after plaintiffs claimed that the defendants’ security measures were insufficient to prevent the ransomware attack and subsequent data theft. The incident has highlighted the ongoing risks faced by healthcare organizations in protecting sensitive patient information from cybercriminals. The settlement also underscores the significant financial and reputational consequences that can result from large-scale healthcare data breaches. Heritage Provider Network and its affiliates have not admitted wrongdoing but agreed to the settlement to resolve the litigation. The case serves as a reminder for healthcare providers to continually assess and strengthen their cybersecurity posture to mitigate the risk of future incidents. The settlement is one of the largest in recent years for a healthcare data breach, reflecting the scale and impact of the incident. Affected patients are encouraged to review the settlement terms and submit claims if eligible.
Jun 29, 2026
Sunflower Medical Group, a healthcare provider serving Kansas and Missouri, has agreed to pay $1.2 million to settle a class action lawsuit following a ransomware attack attributed to the Rhysida cybercrime gang. The breach compromised sensitive data of nearly 256,000 individuals, with Rhysida claiming responsibility and listing Sunflower Medical as a victim on its leak site. Under the preliminary court-approved settlement, affected individuals can claim a one-time cash payment or submit receipts for out-of-pocket losses, while plaintiff attorneys have requested half of the settlement for fees and expenses. Sunflower Medical has also committed to providing a confidential declaration on additional cybersecurity safeguards implemented to mitigate future breaches. The final approval hearing for the settlement is scheduled in Missouri state court. The Rhysida group, known for targeting healthcare organizations, claims to have stolen an SQL database from Sunflower Medical. The incident highlights ongoing risks to healthcare data security and the legal and financial consequences organizations face following ransomware attacks. No evidence from the provided references suggests that the breach involved other medical groups or was part of a broader coordinated attack beyond Sunflower Medical Group.
Jun 29, 2026