A patient has filed a class action lawsuit against UF Health as the result of a ransomware attack that exposed patients’ information for sale on the dark web.
Chrystal Holmes, identified as a Lake County resident, is suing The Villages Tri-County Medical Center, UF Health Central Florida and Leesburg Regional Medical Center Inc. in U.S. District Court in the Middle District of Florida.
UF Health played down the ransomware attack but on July 30 notified the U.S. Department of Health and Human Services that 700,981 people were affected by the ransomware attack, according to the lawsuit, which is seeking damages in excess of $5 million.
Holmes also alleges that UF Health failed “to implement industry protocols and exercise reasonable care in protecting and safeguarding” patient information. She quotes the FBI in its warning that “prevention is the most effective defense against ransomware and it is critical to take precautions for protection.”
Like many other UF Health patients, Holmes received a letter in late July notifying her of the data breach.
She worries that her information will be used for “targeted marketing information” or sold on the dark web. She said she and fellow patients “now face years of constant surveillance of their financial and personal records.”
Holmes is represented by John Yanchunis and Ryan Maxey of Morgan & Morgan Complex Litigation Group in Tampa.