$65 Million Settlement After Ransomware Gang Posted Cancer Patients' Medical Photos Online

In February 2023, a Russian ransomware group known as BlackCat (also called ALPHV) broke into computer systems at a Lehigh Valley Health Network physician practice network in northeastern Pennsylvania. The attackers targeted radiation oncology files and stole sensitive medical images, including nude photographs of breast cancer patients taken during treatment, along with diagnostic records, lab results, Social Security numbers, and other personal data belonging to more than 134,000 patients and employees.

When LVHN refused to pay the ransom, consistent with FBI guidance discouraging such payments, the hackers followed through on their threat and published the stolen materials on the dark web. More than 600 patients had their most private medical images exposed to public view. The plaintiffs' complaint later argued that the health network, by declining to pay, had weighed its finances against the catastrophic privacy harm to patients.

Attorney Patrick Howard of Saltz Mongeluzzi Bendesky filed suit on March 13, 2023, on behalf of a pseudonymous lead plaintiff identified as 'Jane Doe,' representing the broader class of affected individuals. The legal team built a case around LVHN's data-security failures and its decision-making after the attack became known.

The parties reached a $65 million settlement agreement in September 2024. Senior Judge Thomas A. James of the Lackawanna County Court of Common Pleas granted final approval on November 15, 2024. Every class member received a payment ranging from about $50 to $80,000, scaled to how their information was compromised. Cancer patients whose nude photographs were published online received the maximum, between $70,000 and $80,000 each. All of the more than 134,000 class members received compensation automatically, without having to file an individual claim. Attorney Howard described the per-capita payout as the largest of any data breach settlement in United States history. LVHN denied wrongdoing but agreed the settlement reflected good-faith, arms-length negotiations. Settlement checks were expected to be distributed in early 2025 after the 30-day appeal period closed.