American Addiction Centers Hack Affects Over 420,000 Patients

American Addiction Centers (AAC) began notifying the 422,424 affected patients of a major breach that compromised their information on December 23, nearly three months after its discovery. Some affected parties have now filed a class-action lawsuit over alleged violations of the Health Insurance Portability and Accountability Act (HIPAA).

AAC initially identified the breach on September 26 last year. The attackers had accessed the data several days earlier, according to the company’s investigation launched upon first learning of the attack. AAC also alerted law enforcement agencies and third-party cybersecurity experts around the same time.

By November, the organization notified the US Department of Health, and in December, it began emailing affected patients. According to the notification letter sent to affected parties, the compromised information includes patient names, addresses, phone numbers, birthdates, Social Security numbers, and health insurance details. However, it does not include treatment or payment information.

In the letter, AAC offered free credit monitoring tools and instructions on what to do if patients suspect identity fraud.

Sources say the Rhysida ransomware group claimed responsibility for the attack in November. Ransomware is a type of malware that can prevent access to, copy, and share files unless the targeted party pays a ransom. The hackers have released most of the stolen information, publishing over 2.8 terabytes of data, suggesting a failed extortion attempt.

In response, some affected patients have filed a class-action lawsuit in the Middle District of Tennessee over an alleged breach of HIPAA. This federal law governs the handling of American citizens’ healthcare information. Under HIPAA, healthcare providers must protect sensitive patient information from external threats, such as cybercriminals.

“The lawsuit includes claims of negligence, unjust enrichment, and breach of implied contract, as well as monetary and injunctive relief,” according to Kathryn M. Rattigan, partner and writer for The National Law Review.

The case joins other major, recent ransomware attacks over the information of vulnerable populations. In early December last year, cybercriminals breached the online portal for social services recipients in Rhode Island.