Hospital Español Auxilio Mutuo (Puerto Rico) Settles Lawsuit Over 2023 Data Breach Affecting Patient Records
Hospital Español Auxilio Mutuo de Puerto Rico has agreed to a $500,000 class action settlement resolving litigation tied to a 2023 network intrusion. The U.S. Department of Homeland Security (DHS) notified the hospital on September 23, 2023 that a cybercriminal actor had likely breached its network. A follow-up investigation concluded in September 2024 that the network was compromised between August 2022 and September 2023, with patient data likely exfiltrated, including names, contact information, health information, health insurance information, billing and claims data, Social Security numbers, and other government-issued ID numbers. Notification letters were not sent until April 21, 2025 — 575 days after the hospital first learned of the likely breach — prompting multiple class action lawsuits alleging inadequate cybersecurity controls, poor network monitoring, insufficient employee training, delayed notification, and obfuscation of the breach's severity.
Remediação
Under the preliminarily court-approved settlement, affected individuals can claim reimbursement of out-of-pocket expenses (up to $2,500) or an alternative cash payment (estimated at $25), plus two years of credit and medical monitoring services. Hospital Español also agreed to implement additional data security measures to reduce the risk of future incidents. The claims/opt-out/objection deadline is December 21, 2026, with a final fairness hearing scheduled for January 20, 2027.
Linha do tempo
-
Hospital Español Auxilio Mutuo (Puerto Rico) Settles Lawsuit Over 2023 Data Breach Affecting Patient Records
ler a análise desta fonte ocultar
Hospital Español Auxilio Mutuo de Puerto Rico has agreed to a $500,000 class action settlement resolving litigation tied to a 2023 network intrusion. The U.S. Department of Homeland Security (DHS) notified the hospital on September 23, 2023 that a cybercriminal actor had likely breached its network. A follow-up investigation concluded in September 2024 that the network was compromised between August 2022 and September 2023, with patient data likely exfiltrated, including names, contact information, health information, health insurance information, billing and claims data, Social Security numbers, and other government-issued ID numbers. Notification letters were not sent until April 21, 2025 — 575 days after the hospital first learned of the likely breach — prompting multiple class action lawsuits alleging inadequate cybersecurity controls, poor network monitoring, insufficient employee training, delayed notification, and obfuscation of the breach's severity.
Remediation
Under the preliminarily court-approved settlement, affected individuals can claim reimbursement of out-of-pocket expenses (up to $2,500) or an alternative cash payment (estimated at $25), plus two years of credit and medical monitoring services. Hospital Español also agreed to implement additional data security measures to reduce the risk of future incidents. The claims/opt-out/objection deadline is December 21, 2026, with a final fairness hearing scheduled for January 20, 2027.