By Lauren Giella
Senior Reporter
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
Oklahoma health system Integris Health reached a $30 million settlement in a data breach class action lawsuit that impacted over two million people over two years ago.
This agreement settles a class action lawsuit filed in the U.S. District Court for the Western District of Oklahoma that accuses Integris of negligence after it failed to protect patient data that was part of a breach in November 2023 and exposed victims to “imminent risk” of fraud and identity theft risk, according to the filing.
Why it Matters
The plaintiff in the lawsuit accused Integris of negligence, claiming the health system failed to protect and safeguard highly sensitive, identifiable information, resulting in a “massive and preventable data breach.”
Read More on Business
Integris’ "insufficient” data security allowed cybercriminals to hack the computer system and steal patient information, plaintiffs claimed.
According to the court filing, the cybercriminals not only stole the data but also began directly extorting victims of the data breach.
Newsweek Photo-Illustration/Canva
Victims are entitled to three years of credit monitoring services, which include up to $1 million in identity theft insurance and up to $25,000 in reimbursements for out-of-pocket costs associated with the data breach.
The settlement notes that “Integris denies that it did anything wrong and the court has not decided who is right.”
What to Know
Several class action lawsuits were filed in response to the breach and were later consolidated into a single lawsuit, Bointy, et al. V. Integris Health, Inc., filed in the U.S. District Court for the Western District of Oklahoma.
The data breach occurred on November 28, 2023, impacting over two million people, according to court filings.
At the end of December 2023, victims of the data breach began receiving emails from a cybercriminal using the email “dataleakege@igpc.mcambraia.dns-secure.net.” The email informed recipients that “[i]f you are receiving this message, your data have [sic] been compromised.”
The leaked data included Social Security Numbers, dates of birth, addresses, phone numbers, insurance information and employer information.
The cybercriminal, referred to as DataLeakege, also threatened to sell the leaked data on the darknet to be “used for fraud and identity theft.” DataLeakege told the plaintiffs they had until January 5, 2024, to pay $50 for their stolen data or else it would be sold to data brokers, according to the filing.
Plaintiffs said Integris made no assurance that it attempted to regain the stolen data from the hacker or paid the ransom demand.
“Due to defendant’s negligence, cybercriminals have stolen and obtained everything they need to commit identity theft and wreak havoc on the financial and personal lives of millions of individuals,” the filing stated.
The plaintiffs sought compensatory damages, punitive damages, nominal damages, restitution, and injunctive and declaratory relief, reasonable attorney fees and costs and all other remedies this court deems proper.
The cybercriminal also said it contacted Integris after the breach, but the health system “refused to resolve the issue,” according to the filing.
The plaintiffs claim that it was only after DataLeakege started extorting victims that Integris publicly announced the breach.
On December 24, 2023, Integris published a notice on its website informing patients of the breach and the investigations it conducted.
Integris said it was aware that some patients were contacted by a group claiming to be responsible for the breach and encourages anyone who received an email to “NOT respond or contact the sender or follow any instructions.”
“Integris Health encourages you to remain vigilant against incidents of identity theft and fraud by reviewing your account statements and explanation of benefits and monitoring your free credit reports for suspicious activity and to detect errors," the company said in the notice.
Integris said that upon learning of the incident, it conducted an investigation with a third-party cybersecurity specialist and notified affected individuals.
“As part of our ongoing commitment to the security of information, we are reviewing and enhancing existing policies and procedures to reduce the likelihood of a similar future incident," the company notice said. "As a precautionary measure, we are notifying potentially affected individuals, including you, so that you may take further steps to best protect your personal information, should you feel it is appropriate to do so.”
What Happens Next
In order to receive benefits from the settlement, victims must submit a claim form by December 22, 2025, according to the settlement website. Individuals can opt out of the settlement by November 21, 2025.
The $30 million settlement will first be used to pay court-approved attorneys’ fees and costs, Service Awards for the Class Representatives and the costs of administering the settlement.
The rest of the funds will go towards credit monitoring and insurance services, which include up to $1 million in identity theft insurance and other documented loss payments.
These out-of-pocket costs qualify for up to $25,000 in reimbursements and cover costs associated with requesting a credit report, credit freeze canceling payment cards, closing bank accounts, postage or long-distance phone charges and unrefunded overdraft protection fees, late or missed payment charges.
The court will hold a final approval hearing on December 16, 2025.
Newsweek reached out to Integris Health for comment.
Have an announcement or news to share? Contact the Newsweek Health Care team at health.care@newsweek.com.
View 0 Comments
Submit Correction
View Editorial & AI Guidelines