HIPAA-covered entity Greater Cincinnati Behavioral Health Services (GCBHS) decided to pay approximately $850,000 to settle all claims associated with a ransomware attack in December 2023 involving unauthorized access to patient and worker data. On December 10, 2023, GCBHS discovered the cyberattack and confirmed that preliminary network access had occurred the previous day. The DragonForce ransomware group used compromised employee credentials to gain initial access and enabled the group to access 72 GB of sensitive data, which includes worker and patient data.
The breach report submitted to the Maine Attorney General indicated that roughly 62,000 individuals were affected. The breach report sent to HHS’ Office for Civil Rights indicated that the protected health information (PHI) of approximately 50,000 individuals was exposed. GCBHS started notifying the affected workers and patients about the data breach on June 12, 2024. The following data were potentially compromised and stolen in the attack: names, birth dates, driver’s license numbers, Social Security numbers, state ID numbers, health data, and medical insurance details.
Because of the breach, GCBHS faced two class-action lawsuits, which were combined into one lawsuit filed in the Court of Common Pleas for Hamilton County, Ohio. The lawsuit alleged that the defendant failed to use acceptable and proper cybersecurity measures to secure sensitive information on its system. The lawsuit stated claims of negligence, breach of fiduciary duty, breach of implied contract, and unjust enrichment. GCBHS rejects all claims of liability and wrongdoing.
All parties joined in mediation but did not settle immediately. Only after months of ongoing negotiations did they agree to a settlement that was satisfactory to all parties. The court recently gave preliminary approval of the settlement agreement. The terms of the settlement require GCBHS to pay at most $850,000 to settle the litigation, including attorneys’ fees and expenditures, settlement management costs, and service awards paid to the class representatives. There are roughly 61,850 settlement class members.
Class members could file a claim to reimburse documented, unreimbursed losses for as much as $5,000 per class member. Or, class members can claim a pro rata cash payment ranging between $60 and $120. In addition, all class members can claim a three-bureau CyEx Medical Shield service subscription for one year. The last day to submit an objection to or an exemption from the settlement is November 11, 2025. Claims must be submitted on or before December 11, 2025. The schedule of the final approval hearing is January 14, 2026.
Image credit: tiger, AdobeStock / logo©GCBHS
