Community Health Systems agrees to pay nearly $3.1 million as a part of settlement for 2014 data breach

• The settlement covers a total of 4.5 million patients impacted in the breach.
• The cyber attack took place in April and June of 2014 and was orchestrated by a Chinese criminal group.

Tennessee-based Community Health Systems has reached a settlement over a 2014 data breach that 4.5 million patients. A proposed amount of $3.1 million has been reached as a part of the settlement in a class action lawsuit filed against the healthcare.

What happened?

According to court records, the cyber attack took place in April and June of 2014 and was orchestrated by a Chinese criminal group, that solely focused on obtaining intellectual data. The hackers used an advanced malware and exfiltrated a variety of information such as patient names, Social Security numbers, addresses, dates of birth, and phone numbers. However, no credit card details and medical details were affected in the breach.

Following the breach, the healthcare firm had notified the patients about the breach. However, there were few patients who filed lawsuits against the firm, asking for compensation.

What does the settlement include?

Depending on the type of impact, the patients are entitled to two types of payments. Each patient will receive up to $250 to cover identity theft protection services and reimburse their out-of-pocket expenses. Those who experienced identity theft or fraud due to the attack will receive up to $5,000.

“The Settlement defines 'Personal Information' as information that is or could be used, whether on its own or in combination with other information, to identify, locate or contact a person, including without limitation names, addresses, birthdates, social security numbers, telephone numbers, and the names of employers and/or guarantors,” reads the CHS Data Breach Settlement report.

Impacted patients must file a compensation form by August 1, 2019.