A class action lawsuit was filed against Pruitt Health over a ransomware attack in 2023 that resulted in the compromise of the protected health information (PHI) of 56,405 individuals. Pruitt Health manages 180 care centers in Georgia, Florida, North and South Carolina. A ransomware attack occurred in November 2023 that compromised Pruitt Health’s patient data. The NoEscape ransomware group was behind the attack and stole 1.5TB of data. In December 2023, the stolen information was published on its data leak site, which was removed even before Pruitt Health could confirm which data was stolen.
Pruitt Health deduced that the types of information potentially stolen during the attack included patient names, contact details, demographic data, birth dates, government ID details, bank account numbers, Social Security numbers, medical insurance data, and health data. Pruitt Health informed all individuals possibly impacted by the incident in May 2024.
Former Pruitt Health staff, Tina Clayton who had her personal data possibly exposed during the attack, filed a class action lawsuit in the U.S. District Court for the Northern District of Georgia. In the Tina Clayton v. PruittHealth Inc. lawsuit, Clayton alleges that the attack happened because of the negligence of Pruitt Health, which did not apply reasonable and proper safety measures to stop unauthorized access to staff and patient information.
Clayton claims Pruitt Health utilized outdated computers, did not create and enforce procedures for handling ransomware attacks, and failed to train employees about password protection and email security, which are required in HIPAA training. The lawsuit also complains about Pruitt Health’s delay in notifying the impacted persons. Notification letters were mailed after 6 months since the attack took place.
Though Pruitt Health is not certain that Clayton’s information was compromised in the attack, Clayton still received a notification letter about the possible exposure. Clayton needed to spend a lot of time securing her sensitive data from improper use. Since the cyberattack, Clayton says that she spent about one hour per week checking her accounts for fraudulent transactions and data misuse.
The lawsuit states Clayton and the class members have sustained injuries because of the data breach and currently face an impending and increased risk of identity theft, medical fraudulence, and other injuries. The lawsuit claims negligence, breach of contract, unjust enrichment, and breach of fiduciary duty. The plaintiff and class members want a jury trial, class action certification, damages, and other remuneration considered proper by the court. The legal representatives of the class are Leigh Montgomery and Jarrett L. Ellzey of Ellzey & Associates PLLC, and Ainsworth G. Dudley of Dudley Law LLC.
