Capital Health agreed to pay $4.5 million to resolve the class action lawsuit over a 2023 data breach that exposed patient data and other personal information.
Data Breach Incident
Capital Health experienced unauthorized access to its computer systems between November 11 and November 26, 2023, when an external actor gained access and used ransomware to encrypt files.
Files that contained patient data were exposed and may have been stolen during the incident.
The unauthorized access occurred alongside a network outage within Capital Health’s systems. Capital Health Medical Center in Hopewell Township, Capital Health Regional Medical Center in Trenton and other primary care clinics in Pennsylvania, and New Jersey operated by Capital Health may have been affected.
The LockBit ransomware group stated it conducted the attack and stole 7 TB of data. LockBit threatened Capital Health that it will publish the stolen information on January 9, 2024 when no ransom payment is given. It is unclear whether the hospital paid the ransom.
Scope Of Information Involved
The forensic investigation identified that the cyber actors potentially accessed private data including names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, and medical information. In compliance with HIPAA laws, the data breach report was submitted to the HHS’ Office for Civil Rights as having 503,071 affected individuals. Capital Health announced the cyberattack in December 2023. The first class action lawsuit against Capital Health was filed on December 19, 2023. Other affected patients filed several class action lawsuits as well,
Settlement Terms
The settlement resolves the consolidated class action litigation Bruce Graycar, et al. v. Capital Health Systems, Inc. filed in the United States District Court for the District of New Jersey. Capital Health denies liability, fault, or wrongdoing as part of the settlement agreement.
Settlement class members can submit claims for reimbursement of documented, unreimbursed losses up to $5,000 per member related to the data breach. Alternatively, claimants may elect to receive a flat alternative cash payment of approximately $100. Class members may also submit a claim for three years of credit monitoring services, with a stated value per year in the settlement documents.
The deadline to object to or opt out of the settlement is March 9, 2026. Class member may submit claims until April 6, 2026.
Regulatory Incident Notice
Capital Health previously posted a notice stating that an unauthorized actor gained access to certain systems during the period from November 11 to November 26, 2023. The notice stated that the investigation found no evidence of misuse of personal information or protected health information (PHI) as a result of the incident. Capital Health offered free identity and credit monitoring and fraud consultation services to individuals whose information may have been involved.
Image credits: DASHINKAN, Adobestock : logo©CapitalHealth
