300,000 Patients Impacted By Law Firm Data Breach

The law firm Thompson Coburn LLP and its client, Presbyterian Healthcare Services, or PHS, have become the focus of a class-action lawsuit following a significant data breach that compromised the personal information of over 300,000 individuals.

Filed on Nov. 12 in an Illinois federal court, the lawsuit accuses both parties of failing to secure sensitive personal and medical data, thereby leaving it vulnerable to cybercriminal activity.

The data breach, which occurred between May 28 and May 29, 2024 involved unauthorized access to Thompson Coburn’s network. As a result, a wide array of sensitive data including names, Social Security numbers, dates of birth, medical record numbers, patient account details, prescription information, and health insurance information was exposed.

Alleged Cybersecurity Shortcomings

Plaintiffs argue that Thompson Coburn and PHS were negligent in their cybersecurity measures, pointing to inadequate protections against recognized cyber threats. Given the growing risks surrounding healthcare data breaches, they claim that both organizations should have enforced more rigorous safeguards for patient information.

Notably, plaintiffs emphasize that healthcare data is highly prized on the black market, often used for identity theft and fraud, underscoring the heightened responsibility of healthcare and legal entities to protect such information.

Matt Gaetz Abruptly Resigns From Congress After Trump Picks Him As Attorney General

Trump’s Cabinet: Here Are His Picks For Key Roles—Matt Gaetz, Tulsi Gabbard, Marco Rubio And More

Was Amazon Hacked? No—Your Account And Password Have Not Been Compromised. Here’s What You Need To Know

As Steve Alder, writing for HIPAA Journal, explains: “There are so many more data breaches in the healthcare sector than in other sectors because healthcare data is more valuable on the black market than any other type of data. This is because it takes longer for healthcare fraud to be discovered and stolen data can be used for longer compared to (for example) a stolen credit card which can be stopped as soon as the breach is discovered.”

The Rising Frequency of Healthcare Related Data Breaches

This lawsuit highlights a concerning trend: cyberattacks increasingly target not only healthcare providers but also their service partners, like law firms, which store extensive patient data. In fact, healthcare data breaches are among the most financially damaging, with the average cost per breach reaching nearly $9.8 million in 2024. This financial toll, coupled with the sector's reliance on digital records and frequently outdated IT infrastructure, intensifies the imperative for robust cybersecurity.

The breach affecting Thompson Coburn and PHS reflects a broader surge in cyberattacks on the healthcare sector and affiliated service providers. According to recent reports, the U.S. healthcare sector saw over 745 large-scale breaches in 2023 alone, impacting millions of individuals nationwide. This trend is projected to escalate, with cybercriminals consistently exploiting system vulnerabilities.

The consequences of such breaches extend beyond financial loss. Healthcare data breaches can severely disrupt patient care, with ransomware attacks even leading to temporary shutdowns of critical systems like electronic health records. In some instances, these disruptions can delay surgeries and other essential treatments, posing life-threatening risks to patients.

Thompson Coburn’s Response To The Data Breach

In response to the data breach impacting Presbyterian Healthcare Services (PHS) patients, Thompson Coburn LLP issued a public notice detailing the incident and its actions following the discovery, which explains that:

• The compromised data may include sensitive details, and each affected individual received a tailored notification specifying which types of information were involved according to the notification.
• Thompson Coburn emphasized that it has no evidence of identity theft or fraud resulting from the incident but have nevertheless provided free credit monitoring and identity theft protection services to those potentially affected.
• The firm issued notifications through mail, media releases, and website postings to reach involved individuals. Additionally, the firm has implemented further security enhancements to prevent similar incidents.
• Thompson Coburn urges affected individuals to monitor their financial and healthcare statements for any unusual activity.
• For additional information, Thompson Coburn has set up a toll-free assistance line at 1-866-629-7715.

Thompson Coburn and Presbyterian Healthcare Services have been contacted for comment and have yet to respond.

This column originally appeared in Forbes.