Patient files class action against One Medical over data breach

SAN FRANCISCO (CN) — A senior citizen filed a putative class action against a medical company over a data breach that exposed her personal and medical information to cybercriminals.

Lead plaintiff Donna Sanders claims Amazon-owned healthcare provider One Medical failed to protect her personal information in a data breach that occurred from June 8 to 11. The cybercriminal group ShinyHunters accessed a third-party storage system containing patient data, including demographic information and clinical records.

Potential class members span the country, from Atlanta to Seattle, and include patients in metro areas such as Denver, Houston, Phoenix and Tucson.

“The data breach was directly and proximately caused by defendant’s failure to implement reasonable and industry-standard data security practices necessary to protect its systems from a foreseeable and preventable cyberattack,” Sanders writes in the complaint filed on Friday. “Through this wrongful conduct, the sensitive private information of thousands of individuals is now in the hands of cybercriminals, who target this sensitive data for its value to identity thieves.”

Sanders says class members face the risk of fraud, identity theft and other “criminal mischief” that could follow them for the rest of their lives. ShinyHunters is a global cybercriminal group known for stealing data from large organizations, often for extortion. Previous targets include Ticketmaster, Microsoft and the school platform Canvas.

Sanders was notified June 29 that her data was part of the breach.

“As a proximate result of the data breach, plaintiff will spend time for the foreseeable future and beyond dealing with its consequences and self-monitoring her accounts and credit reports to monitor potentially suspicious and fraudulent activity,” she says. “This time will be lost forever and cannot be recaptured.”

The claims against One Medical on behalf of Sanders and the potential nationwide class include negligence and breach of implied contract. Sanders also asks for a declaratory judgment that One Medical owed patients a “duty of care” and a legal duty to adequately secure private information in the future.

Sanders and the potential class seek compensatory and punitive damages, as well as disgorgement and restitution. Sanders demands a jury trial.

The class action was filed in the Northern District of California.

Attorneys representing the plaintiff and One Medical did not immediately respond to requests for comment.