HHS Settles with Lehigh Valley Health Network Over Ransomware Breach
Original title: HHS’ Office for Civil Rights Settles Ransomware Investigation of Lehigh Valley Health Network
OCR imposed $800,000 penalty and corrective actions after Lehigh Valley Health Network's 2023 ransomware attack exposed PHI of 248,359 individuals.
The HHS Office for Civil Rights settled with Lehigh Valley Health Network for $800,000 and a three-year corrective action plan following a 2023 ransomware attack. The attack by AlphV led to exfiltration of PHI including sensitive patient photos. Violations included lack of risk analysis and audit logs.
- Ransomware attack affected 248,359 individuals
- PHI including nude patient photos posted on dark web
- OCR imposed $800,000 penalty
- Three-year corrective action plan required
Impact: protected health information of 248,359 individuals
- Vendors
- Lehigh Valley Health Network
- Products
- health systems
- Threat actors
- AlphV
- Malware
- BlackCat
- Victims
- Lehigh Valley Health Network
- Organizations
- HHS Office for Civil Rights
- Countries
- United States
From the original article
4 min read at wordpress-1685287-6764806.cloudwaysapps.comDataBreaches. net previously covered the 2023 Lehigh Valley Health Network breach by AlphV (aka “BlackCat”). The breach garnered a lot of public attention when the threat actors crossed a line by posting nude pictures of patients on their leak site.
By Dissent · wordpress-1685287-6764806.cloudwaysapps.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.