A major healthcare institution is facing legal action following a significant data breach that compromised sensitive patient information. On July 11, 2024, Keren Gelfand filed a class-action complaint in the United States District Court for the Northern District of Illinois against Ann & Robert H. Lurie Children’s Hospital of Chicago.
The lawsuit alleges that Lurie Children's Hospital failed to implement adequate data security measures, leading to a cyberattack that exposed the personal identifiable information (PII) and protected health information (PHI) of over 792,000 patients. The plaintiffs, including minors L.C. and N.C., represented by their guardian Keren Gelfand, claim that the hospital's negligence resulted in the unauthorized access and potential misuse of sensitive data such as names, addresses, Social Security numbers, medical records, and more.
According to the complaint, the hospital discovered the breach between January 26 and January 31, 2024 but did not notify affected individuals until June 27, 2024. The delay in notification is one of several points of contention in the lawsuit. The plaintiffs argue that this delay prevented them from taking timely actions to mitigate potential damages from identity theft and other fraudulent activities.
The plaintiffs are seeking various forms of relief from the court. They demand compensatory and consequential damages for financial losses incurred due to identity theft risks and preventive measures like credit monitoring services. Additionally, they seek injunctive relief requiring Lurie Children's Hospital to enhance its data security systems and undergo regular audits to prevent future breaches.
Representing the plaintiffs are attorneys experienced in handling complex class-action lawsuits involving data breaches. The case has been assigned Case ID: 1:24-cv-05854.