Ransomware Attack Leads Class Action Lawsuit against Allscripts

by | Jan 31, 2018

A ransomware attack, discovered last week, against the EHR vendor Allscripts lead to thousands of healthcare suppliers being prevented from accessing patient data or using the e-prescription service. Florida-based Surfside Non-Surgical Orthopedics have moved quickly to register a class action lawsuit against Allscripts.

Allscripts is a supplier of EHR and e-prescription services to 2,500 hospitals and 19,000 post-acute care centers. Last week, a new type of SamSam ransomware was downloaded to the company´s data centers in Raleigh and Charlotte, NC, leaving 1,500 clients unable to log on to several online applications .

Response teams from Microsoft and Cisco assisted the company to restore its e-prescribing service by Saturday; but, for a lot of clients, the Allscripts PRO EHR system is still unavailable or experiencing intermittent outages. An Allscripts representatives have been unable to confirm when a full restore will be finished.

The class action lawsuit against Allscripts was registered in the United States District Court for the Northern District of Illinois where the company is located. It claims Allscripts was negligent in failing to safeguard their systems against cyberattacks and that the company was aware of flaws in its online security. The complaint refer to the company´s most recent 10-K filing which states: “If our security is breached, we could be subject to liability, and our clients could be deterred from using our products and services”.

Lawyers representing the plaintiff – Florida-based Surfside Non-Surgical Orthopedics – Allscripts predicted the ransomware attack in the K-10 filing; and, due to the attack, their client experienced “significant business interruption and disruption, and lost revenues”. The class action lawsuit taken against Allscripts also claimss breach of contract, unjust enrichment, and breaches of Illinois´ Uniform Deception Trade Practices Act and Consumer Fraud Act.

Steven Tapper – a member of class action lawsuit against Allscripts –feels the ransomware attack could have targeted many more clients than the company is admitting. He stated to reporters: “We really don’t know. Allscripts hasn’t disclosed the full extent of the impact”. His colleague – John Yanchunis – added it could take as long as eighteen months to resolve the case, but Allscripts may choose to seek an immediate resolution. “I would hope that would be the case here,” he added.


Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.


Please enable JavaScript in your browser to complete this form.

Patrick Kennedy

Patrick Kennedy is a highly accomplished journalist and editor with nearly two decades of experience in the field. With expertise in writing and editing content, Patrick has made significant contributions to various publications and organizations. Over the course of his career, Patrick has successfully managed teams of writers, overseeing the production of high-quality content and ensuring its adherence to professional standards. His exceptional leadership skills, combined with his deep understanding of journalistic principles, have allowed him to create cohesive and engaging narratives that resonate with readers. A notable area of specialization for Patrick lies in compliance, particularly in relation to HIPAA (Health Insurance Portability and Accountability Act). He has authored numerous articles delving into the complexities of compliance and its implications for various industries. Patrick's comprehensive understanding of HIPAA regulations has positioned him as a go-to expert, sought after for his insights and expertise in this field. Patrick's bachelors degree is from the University of Limerick and his master's degree in journalism is from Dublin City University. You can contact Patrick through his LinkedIn profile:

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

Comprehensive HIPAA Training

Used in 1000+ Healthcare Organizations and 100+ Universities

    Full Course - Immediate Access

    Privacy Policy