HHS settles Lehigh Valley ransomware probe for $800,000
First merged summary.
HHS OCR settled with Lehigh Valley Health Network for $800,000 after a 2023 AlphV ransomware breach affecting 248,359 people.
The HHS Office for Civil Rights settled with Lehigh Valley Health Network and affiliates over a February 2023 AlphV (BlackCat) ransomware attack. The network will pay an $800,000 penalty and follow a three-year corrective action plan. The attack exposed protected health information of 248,359 individuals, including cancer-patient and nude photos posted on the dark web. OCR found failures in risk analysis, audit logs, and timely breach notification.
- February 2023 AlphV (BlackCat) attack exfiltrated patient PHI.
- Breach affected 248,359 individuals, including sensitive patient photos.
- OCR imposed an $800,000 penalty and a three-year corrective plan.
- Findings cited missing risk analysis, audit logs, and late notice.
Timeline
dated events in the reporting · oldest first- Nov 3, 2026OCR announced $800,000 LVHN ransomware settlement · DataBreaches.net
What each outlet adds
beyond the shared facts- DataBreaches.netNames AlphV/BlackCat, February 2023, and HIPAA notification failures.
- Vendors
- Lehigh Valley Health Network
- Products
- health systems
- Threat actors
- AlphV
- Malware
- BlackCat
- Countries
- United States
Coverage
oldest first · one row per article · UTC- · 8d ago
DataBreaches.netFirst report
HHS Settles with Lehigh Valley Health Network Over Ransomware Breach
OCR imposed $800,000 penalty and corrective actions after Lehigh Valley Health Network's 2023 ransomware attack exposed PHI of 248,359 individuals.
- · 8d ago
DataBreaches.net
HHS Settles with Lehigh Valley Health Network Over Ransomware Breach
HHS Office for Civil Rights settled with Lehigh Valley Health Network for $800,000 and a three-year corrective action plan following a 2023 ransomware attack that exposed PHI of 248,359 individuals.