In a striking legal move, a class action lawsuit has been filed against a major ambulance service provider for allegedly failing to protect sensitive patient information. The complaint was lodged by Kirkston Spann II on June 6, 2024, in the United States District Court for the Northern District of Illinois against Superior Air-Ground Ambulance Service, Inc.
The lawsuit claims that Superior Air-Ground Ambulance Service, Inc., which employs over 3,000 people and operates in five states, failed to secure personally identifiable information (PII) and protected health information (PHI) of its patients. According to the filing, the data breach occurred between May 15 and May 23, 2023, when cybercriminals infiltrated the company's systems and exfiltrated sensitive data including names, addresses, dates of birth, Social Security numbers, driver’s license numbers, financial account details, payment card information, medical records, and health insurance information. The plaintiff alleges that this breach affected approximately 858,000 individuals.
The plaintiff contends that Superior Air-Ground Ambulance Service's negligence led to the breach. "Defendant maintained... Private Information in a reckless manner," the complaint reads. It further accuses the company of failing to implement adequate cybersecurity measures despite being aware of potential risks due to their handling of highly valuable private information. The plaintiff asserts that as a result of this breach, he and other class members have suffered concrete injuries such as invasion of privacy, theft of their private information, increased spam communications, and dissemination of their data on the dark web.
Spann argues that Superior Air-Ground Ambulance Service violated several laws including the Health Insurance Portability and Accountability Act (HIPAA), which mandates stringent protection for PHI. The complaint highlights how Superior Air-Ground Ambulance Service neglected basic security protocols like encryption and timely updates which could have prevented unauthorized access. Additionally, it points out that despite discovering unusual activity in May 2023 and confirming unauthorized access by June 23rd of the same year, there was a delay in notifying affected individuals about the breach.
The plaintiffs are seeking multiple forms of relief from the court including statutory damages for each member of the class action suit as well as nominal damages for actual misuse of their private information. They also demand injunctive relief requiring Superior Air-Ground Ambulance Service to implement proper security measures henceforth to prevent future breaches.
Representing Kirkston Spann II is an array of attorneys whose names were not disclosed in this summary document. The case is being overseen by judges from the United States District Court for the Northern District of Illinois under Case ID: 1:24-cv-04704.