$65 Million Settlement After Ransomware Gang Posted Cancer Patients' Medical Photos Online
Won by Saltz Mongeluzzi & Bendesky.
Saltz Mongeluzzi Bendesky secured a $65 million class-action settlement against Lehigh Valley Health Network after a 2023 BlackCat ransomware attack exposed intimate medical images and private health records of more than 134,000 patients.
What happened
In February 2023, a Russian ransomware group known as BlackCat (also called ALPHV) broke into computer systems at a Lehigh Valley Health Network physician practice network in northeastern Pennsylvania. The attackers targeted radiation oncology files and stole sensitive medical images, including nude photographs of breast cancer patients taken during treatment, along with diagnostic records, lab results, Social Security numbers, and other personal data belonging to more than 134,000 patients and employees.
When LVHN refused to pay the ransom, consistent with FBI guidance discouraging such payments, the hackers followed through on their threat and published the stolen materials on the dark web. More than 600 patients had their most private medical images exposed to public view. The plaintiffs' complaint later argued that the health network, by declining to pay, had weighed its finances against the catastrophic privacy harm to patients.
Attorney Patrick Howard of Saltz Mongeluzzi Bendesky filed suit on March 13, 2023, on behalf of a pseudonymous lead plaintiff identified as 'Jane Doe,' representing the broader class of affected individuals. The legal team built a case around LVHN's data-security failures and its decision-making after the attack became known.
The parties reached a $65 million settlement agreement in September 2024. Senior Judge Thomas A. James of the Lackawanna County Court of Common Pleas granted final approval on November 15, 2024. Every class member received a payment ranging from about $50 to $80,000, scaled to how their information was compromised. Cancer patients whose nude photographs were published online received the maximum, between $70,000 and $80,000 each. All of the more than 134,000 class members received compensation automatically, without having to file an individual claim. Attorney Howard described the per-capita payout as the largest of any data breach settlement in United States history. LVHN denied wrongdoing but agreed the settlement reflected good-faith, arms-length negotiations. Settlement checks were expected to be distributed in early 2025 after the 30-day appeal period closed.
Sources
This account is drawn from contemporaneous public reporting and the court record.
- 1.WHYY: Pa. judge finalizes $65M settlement in Lehigh Valley Health Network data breach (Nov 2024)·Archived copy
- 2.Insurance Journal: Hospital to pay $65M over cyberattack exposing cancer patients' nude photos (Sep 2024)·Archived copy
- 3.HIPAA Journal: Lehigh Valley Health Network data breach lawsuit settled for $65 million·Archived copy
More proven verdicts from Saltz Mongeluzzi & Bendesky
All Saltz Mongeluzzi & Bendesky proven verdicts →The families of 98 people killed in the June 2021 Champlain Towers South collapse in Surfside, Florida, recovered over $1 billion through a class settlement run by a court-appointed Plaintiffs' Steering Committee, with final approval reached in under a year.
After Amtrak Train 188 derailed in Philadelphia in May 2015, killing eight and injuring more than 200, Kline & Specter's Thomas R. Kline led the plaintiffs' negotiations that produced a $265 million settlement fund for the victims.
A Pennsylvania-record $227 million settlement resolved claims brought by 19 victims of the June 2013 Center City building collapse, in which an improperly braced wall fell during demolition and crushed the adjoining Salvation Army thrift store, killing seven people.
A Montgomery County jury awarded the estate of Ellen Gregory Robb $124.26 million in November 2014 against her husband, a former Penn economics professor who killed her in 2006 and pleaded guilty to voluntary manslaughter. Of the total, $100 million was punitive damages. The proceeds were for the couple's daughter, the estate's beneficiary. The award stood after Robb's post-trial challenge, though collection was limited to his retirement and investment assets.
Related medical malpractice verdicts
A Utah judge entered a $951 million default judgment against Steward Health Care after newly trained nurses, an excessive Pitocin drip, and a delayed C-section at Jordan Valley Medical Center left a newborn permanently brain damaged.
A Gainesville jury awarded $900 million, including $700 million in punitive damages, to stroke survivor Joseph Webb over neglect at the University Place Care and Rehabilitation Center, in a Wilkes & McHugh case tried against defaulted Trans Healthcare entities with no defense present, but Florida's First District Court of Appeal reversed the judgment in 2013 because the trial court had refused to let a defense lawyer appear, and the money was never collected; the estate's claim was later resolved for a small share of a multi-estate bankruptcy settlement.
A Clark County jury ordered Health Plan of Nevada and Sierra Health Services to pay $524 million after finding the UnitedHealth Group subsidiaries negligently credentialed a gastroenterologist whose unsafe injection practices at his Las Vegas endoscopy clinics caused the largest medically caused hepatitis C outbreak in American history.
Georgia Hayes, a Kansas City area ovarian cancer patient, sued pharmacist Robert Courtney after learning he had diluted the chemotherapy drugs used in her treatment. A Jackson County jury found Courtney liable and awarded Hayes $225,571,439 in compensatory damages and $2 billion in punitive damages, the first of hundreds of similar suits against Courtney to reach trial. The trial judge later found the award excessive and cut it by remittitur to $330,071,439, and that reduced judgment stood. Hayes herself and the case reporter covering the verdict both said she was unlikely to ever collect a significant portion of it.