LVHN Pays $800K Over Ransomware Leak of Cancer Patients’ Photos
HHS OCR settled with Lehigh Valley Health Network for $800,000 over the 2023 BlackCat ransomware attack that leaked 248,359 patients' data, including cancer patients' treatment photos.
Lehigh Valley Health Network will pay $800,000 to settle a federal HIPAA investigation into the 2023 BlackCat ransomware attack that ended with cancer patients’ treatment photos, some showing them unclothed, posted online. Medical Daily reports the HHS Office for Civil Rights announced the deal on Oct. 29, calling it OCR’s 22nd ransomware enforcement action. The Pennsylvania health system, now part of Jefferson Health, did not admit liability.
For defenders
The attack: found in February 2023, it hit the network supporting a Scranton physician practice. BlackCat (ALPHV) demanded more than $5 million, per local reports of court filings; LVHN refused, and the group published stolen data on its leak site, including radiation oncology photos. 248,359 people were affected: names, SSNs, driver’s license and financial details, diagnoses, lab results and treatment information.
What OCR found: no accurate and thorough risk analysis, no regular review of system activity, and late notification: the breach report reached HHS on May 15, 2023, more than three months after discovery. Those first two failures show up in nearly every OCR ransomware settlement.
Terms: $800,000 plus three years of OCR monitoring under a corrective action plan: a new risk analysis, a risk management plan, revised HIPAA policies and updated staff training. Details in HHS’s announcement.
Earlier: a $65 million class-action settlement was approved in November 2024, with patients whose nude images were posted eligible for the largest payments.
What it means for you
The $800,000 goes to the government, not patients, and there’s no new way to claim; the class-action deadlines passed in 2024. If you were an LVHN patient, your SSN and medical details may have been in the leaked data, so the protections below still matter. Not paying a ransom didn’t stop the leak, which is a hard lesson for every hospital.
Do this now
- Freeze your credit for free at Equifax, Experian and TransUnion.
- Read every insurance explanation-of-benefits statement and report care you never got: that’s how medical identity theft shows up.
- Healthcare providers: redo your HIPAA risk analysis and actually review system activity logs; those are the gaps OCR keeps fining.