The digital marketing company Rise Interactive Media & Analytics decided to resolve a class action lawsuit associated with a cyberattack on November 14, 2022. Rise Interactive notified HHS’ Office for Civil Rights about the data breach after discovering on December 2, 2022 that the protected health information (PHI) of 54,509 Edgepark Medical Supplies patients was affected. Compromised data included the names, phone numbers, email addresses, provider details, diagnoses, expected dates of delivery, and medical insurance data. Edgepark Medical Supplies sent the notification letters on February 10, 2023.
After issuance of the notification letters, Wolf Haldenstein Adler Freeman & Herz LLC filed the class action lawsuit, Roper, et al. v. Rise Interactive Media & Analytics LLC, on behalf of Tiffany Roper and likewise situated persons in the U.S. District Court of the Northern District of Illinois Eastern Division. The lawsuit claimed that the data breach was due to Rise Interactive’s failure to apply proper security measures to safeguard consumer information collected by Edgepark. The plaintiff claims that at the end of December 2022 or the beginning of January 2023, the hacker used her health insurance to fill a prescription, suggesting her data was immediately leaked on the dark web. Aside from negligence, the lawsuit alleges invasion of privacy and unjust enrichment. Rise Interactive and Edgepark Medical Supplies do not admit to any wrongdoing. A settlement was negotiated to stop additional litigation expenses as well as the uncertainty of trial.
As per the settlement, Edgepark Medical Supplies will set aside a sum of money (undisclosed amount) to pay claims made by class members who received notification regarding the data breach. Class members can file claims for a refund of documented out-of-pocket expenses linked to the data breach amounting to a maximum of $250. Otherwise, class members can get paid in cash, pro rata after deducting attorneys’ service fees, legal expenses, and claims payments. Each class member’s cash payment is likely to be about $50. The court has given preliminary approval of the settlement. The schedule of the final approval hearing is on March 11, 2025. Class members must submit claims on or before February 18, 2025.
The settlement also requires Rise to strengthen security to avoid other cyberattacks and data breaches down the road.
