Lehigh Valley Health Network to Pay $800,000 After Cancer Patients' Photos Were Leaked in Ransomware Attack - Medical Daily
Lehigh Valley Health Network has paid $800,000 to settle a federal investigation into a 2023 ransomware attack that exposed sensitive data of 248,359 patients, including photos of cancer treatment posted on the dark web.
The settlement, announced on Oct. 29, 2026, resolves allegations that the health system violated HIPAA Privacy, Security, and Breach Notification rules following the February 2023 attack. The breach exposed names, addresses, dates of birth, Social Security numbers, driver's license numbers, financial information, diagnoses, lab results, medications, and treatment information of nearly a quarter-million patients.
Most disturbingly, the hackers posted more than 600 medical photos of patients receiving radiation oncology treatment on the dark web. Some images showed breast cancer patients unclothed during care. Medical images cannot be changed like a password, leaving patients with permanent exposure of their sensitive health information.
The Attack Details
The Allentown, Pennsylvania-based health network discovered suspicious activity on its systems in early February 2023 and later confirmed it was a ransomware attack carried out by the Russian group BlackCat. The attack targeted systems supporting Lehigh Valley Physician Group-Delta Medix, a physician practice in Scranton.
The attack was on the network supporting one physician practice located in Lackawanna County.
BlackCat demanded more than $5 million in ransom, which the health system refused to pay. The hackers then began publishing stolen patient images and data on their dark web leak site. The health system filed its breach report with HHS on May 15, 2023, more than three months after discovering the attack.
Federal Findings and Penalties
The Office for Civil Rights cited the health system for failing to conduct an accurate risk analysis, regularly review system activity, and properly notify affected patients and HHS in a timely manner. The settlement includes a corrective action plan that OCR will monitor for three years.
OCR Director Paula M. Stannard emphasized that thorough risk analysis and regular system reviews are crucial defenses against cyberattacks. This settlement marks the HHS's 22nd ransomware enforcement action. The federal penalty is significantly smaller than the $65 million class-action settlement approved by a Lackawanna County judge in November 2024, which provided payments of $70,000 to $80,000 each to patients whose nude images were posted.
Patient Protection Steps
The federal settlement creates no new claims process for patients, as the deadlines for the class-action settlement passed in 2024. Affected patients, particularly those whose images were published or whose financial information was exposed, should take steps to protect themselves.
Patients can freeze their credit with the three major credit bureaus at no cost, review insurance explanation-of-benefits statements for unfamiliar services, and request an accounting of disclosures from their providers. Warning signs of medical identity theft include bills for care never received, collection notices from unfamiliar providers, or unexpected benefit limit notifications.
Related
