HHS Settles Lehigh Valley Health Network for 2023 Ransomware Attack
November 3, 2026: Adds AlphV as attacker and posting of nude patient photos on dark web.
HHS OCR settled with Lehigh Valley Health Network for $800,000 and a three-year plan after AlphV ransomware exposed PHI of 248,359 individuals including nude photos on dark web.
The HHS Office for Civil Rights settled with Lehigh Valley Health Network and affiliates for an $800,000 penalty and three-year corrective action plan. The February 2023 AlphV ransomware attack exfiltrated protected health information of 248,359 individuals, including cancer patient photos and nude images posted on the dark web. OCR found violations in risk analysis, audit logs, and breach notifications.
- Affected 248,359 individuals
- Paid $800,000 penalty
- Three-year corrective action plan
- Attack by AlphV (BlackCat)
- PHI including nude patient photos posted on dark web
- Violations in risk analysis and audit logs
Timeline
dated events in the reporting · oldest first- Feb 1, 2023AlphV ransomware attack on Lehigh Valley Health Network · DataBreaches.net
What each outlet adds
beyond the shared facts- DataBreaches.netAdds AlphV (BlackCat) as the attacking group and nude patient photos posted on the dark web
- Vendors
- Lehigh Valley Health Network
- Products
- health systems
- Threat actors
- AlphVAlphV (BlackCat)
- Malware
- BlackCat
- Countries
- United States
Coverage
oldest first · one row per article · UTC- · 1d ago
DataBreaches.netFirst report
HHS Settles with Lehigh Valley Health Network for Ransomware Breach
The HHS Office for Civil Rights settled with Lehigh Valley Health Network for $800,000 and a corrective action plan after a 2023 ransomware attack that affected 248,359 individuals.
- · 14h ago
DataBreaches.net
HHS Settles with Lehigh Valley Health Network Over Ransomware Breach
OCR imposed $800,000 penalty and corrective actions after Lehigh Valley Health Network's 2023 ransomware attack exposed PHI of 248,359 individuals.
- · 14h ago
HHS Settles with Lehigh Valley Health Network Over Ransomware Breach
HHS Office for Civil Rights settled with Lehigh Valley Health Network for $800,000 and a three-year corrective action plan following a 2023 ransomware attack that exposed PHI of 248,359 individuals.