A class action lawsuit has targeted Sacramento-based Sutter Health and health care administration tech company Welltok for allegedly allowing patient information to be exposed in a data breach.
The alleged breach occurred on or before May 30, according to the lawsuit filed in U.S. District Court for the Eastern District of California.
"When Sutter providers treat patients, the patients provide Sutter with highly sensitive medical information, such as their medical history, current conditions, medications, and specimen material, such as blood samples or cell swabs," the suit says. "Patients additionally grant Sutter access to sensitive personal information, including but not limited to their name, social security number, date of birth, mailing address, and telephone number."
The alleged breach occurred on or before May 30, according to the lawsuit filed in U.S. District Court for the Eastern District of California.
WellTok, a contractor hired by Sutter, used a file transfer software called MOVEit, the suit said.
"The system had a vulnerability that allowed attackers unauthorized access to Sutter patients’ unencrypted data," the lawsuit states. "If Sutter had been using or requiring WellTok to use the confidentiality policies, encryption, firewalls, monitoring, access controls, and other controls it advertised, it would have detected and eliminated the flaw. Instead, on or before May 30, 2023, an unauthorized user gained access to the WellTok platform and accessed files of at least 500 Sutter patients’ personal medical information. Because of this negligent and illegal conduct, patients’ data is now for sale on the dark web."
The suit seeks money damages, plus attorney fees.
The plaintiffs are represented by attorneys Julie Erickson, Elizabeth Kramer, Kevin Osborne, of Erickson Kramer Osborne LLP, of San Francisco.
Copans v. Sutter Health et al, U.S. District Court for the Eastern District of California, 2:23-at-01154