Morris Hospital, in far southwest suburban Morris, has been hit with a class action lawsuit over a data breach amid an attack by Royal Ransomware, allegedly exposing the private information of nearly 284,000 people.
The breach occurred April 4, according to the suit.
"Following an investigation, Morris Hospital determined that cybercriminals gained unauthorized access to its systems and exported data to an
external cloud storage platform," the lawsuit states. "The exported files contained records with the names, addresses, dates of birth, social security numbers, medical record numbers and account numbers, and diagnostic codes of current and former healthcare patients at Morris Hospital and the names,addresses, social security numbers, and dates of birth of current and former employees and their dependents and beneficiaries."
A cybergang called Royal Ransomware Group later claimed responsibility for the breach and posted data from the victims on the "dark web " the lawsuit states.
The hospital failed to take adequate steps to protect the data, the suit alleges.
"Due to Defendant’s negligence and failures, cybercriminals obtained and now possess everything they need to commit personal and medical identity theft and wreak havoc on the financial and personal lives of over 248,000 individuals, for decades to come," the complaint says.
Lead plaintiff Brenda Johnson of Ottawa, identified as both an employee and patient at the hospital, received a letter from the hospital on Aug. 17 notifying her of the breach, the suit says.
"If Ms. Johnson had known that Defendant would not adequately protect her Private Information, she would not have entrusted Defendant with her Private Information or allowed Defendant to maintain this sensitive private Information," the lawsuit states.
It seeks unspecified money damages, plus remedial measures at the hospital, such as increased training and education in how to prevent data breaches.
The plaintiffs are represented by attorney Gary M. Klinger, of Milberg Coleman Bryson Phillips Grossman.