A Florida healthcare provider is facing a class-action lawsuit over a significant data breach that exposed sensitive patient information. On June 10, 2024, Kevin Walker filed the complaint in the Circuit Court of the Fifteenth Judicial Circuit in Palm Beach County against Lakeview Health Systems, LLC.

According to the complaint, Walker alleges that Lakeview Health Systems failed to adequately secure and safeguard personally identifiable information (PII) and personal health information (PHI) of its patients. The breach occurred on or around January 25, 2024, when an unauthorized intruder accessed and exfiltrated data from Lakeview’s database. The compromised data includes names, addresses, dates of birth, Social Security numbers, medical diagnoses and treatment information, provider names, dates of service, treatment cost information, financial account details, state IDs, health insurance information, and prescription details.

Walker asserts that Lakeview Health Systems did not notify affected individuals until May 29, 2024—over four months after the breach occurred. This delay in notification has left thousands of patients at risk for identity theft and other forms of fraud. “Plaintiff’s and the Class members’ PHI can be sold on the dark web,” states the complaint. “Hackers can access and then offer for sale unencrypted, unredacted PHI to criminals.”