WRVO - Months after a ransomware attack, Practice Resources LLC. is facing some legal battles with a new class action lawsuit being filed against them.
The company, which stores the medical record data of nearly 1 million central New Yorkers suffered a data breach in April. The breach came after a ransomware attack, or an attack conducted by hackers who want to get access to personal information like birthdates, full names, home addresses and more.
Dr. Austen Givens, a professor of cybersecurity at Utica University, said that while ransomware attacks are not rare, this one may have different implications.
"There's a lot more that a bad actor could discern from this data beyond merely your full name and where you live," Givens said. "They might have really sharp confidential insights into what is going on with you medically. And to me at least, that is the real scary part of this."
Practice Resources LLC. hosts the data from 28 different medical practices across central New York. The company has sent letters to patients letting them know that some information, like names, addresses and medical record numbers, may have been obtained.
Givens said that because of the large number of potentially affected patients, the impacts of the data breach could be felt for years to come.
"The nature of this firm was such that they did business with many different medical practices and hospitals, it wasn't just a handful," Givens said. "And we are talking about up to one million patient records. So, the reverberations from this, I think, are going to be with us for quite a while."
While it is unknown how many patients were impacted by the ransomware attack, some have decided to take action against the company through a class action lawsuit. If the case gets certified by the court, Practice Resources LLC. will have to prove that they had the proper preventions in place during a process called "discovery." Givens said that this process will allow the public to determine if enough action was being taken by the company.
"Once discovery takes place and once that kind of evidence gets airs in court during the suit, the public will have a much clearer idea of what measures may have been in place in the firm and whether they were reasonable, whether they were effective," Givens said.
The lawsuit, filed on Sept. 2, will have to be certified before moving forward.