A Connecticut-based marketing software company is under fire after a massive security failure allegedly left the personal health information of more than 232,000 individuals exposed to hackers — and months went by before affected patients were told.

Melissa Gifford of New Jersey, filing on behalf of her child whose data was compromised, launched a proposed nationwide class action Thursday in Connecticut federal court. The lawsuit accuses Cierant Corp. of negligence, breach of implied contract, and unjust enrichment following what she called an “entirely preventable” cyberattack.

Allegations of Reckless Data Storage

According to the complaint, Cierant, which partners directly with health insurers and plan administrators, recklessly stored sensitive data including names, birthdates, medical record numbers, and premium details. The company relied on a third-party transfer tool, Cleo’s VLTrader, a system allegedly “known to be vulnerable to cyberattacks.”

On Dec. 10, 2023, hackers exploited an unknown flaw in VLTrader, allowing unauthorized access to troves of medical data. Gifford contends the breach could have been prevented with basic cybersecurity safeguards such as timely patching, encryption, and proper network monitoring.

Profits Over Protection?

The suit blasts Cierant for allegedly cutting costs on security while raking in profits. By delaying updates and skipping stronger safeguards, the company prioritized its bottom line over consumer privacy, Gifford argues.

To make matters worse, the lawsuit claims Cierant failed to meet state deadlines for disclosure. Instead of notifying victims within 30–60 days, Gifford said her family wasn’t informed until August — eight months after the hack. A public notice was issued in July, long after criminals may have misused the data.

Real-World Consequences for Patients

The lawsuit highlights chilling risks: the stolen information could be used to fraudulently obtain medical services or prescriptions, file false insurance claims, or even create synthetic identities tied to minors as they grow older. Victims are now left scrambling to protect themselves with costly credit monitoring and fraud alerts.

“Cierant’s negligence in failing to implement adequate cybersecurity measures, combined with its failure to act swiftly, constitutes a clear disregard of consumer privacy,” the complaint states.

What the Plaintiffs Want

Gifford seeks restitution exceeding $5 million, attorney fees, damages, and a court order requiring Cierant to bolster its security and issue prompt notifications for any future breaches. She also wants the company to cover lifetime credit monitoring services for all victims.

In its public statement, Cierant insisted, “The protection, privacy, and proper use of personal data is a top priority.” The company also provided a toll-free number and a list of recommended safeguards for those affected.

Legal Counsel

Gifford is represented by James J. Reardon Jr. of Reardon Scanlon LLP. Counsel for Cierant was not listed as of Friday. Neither side immediately responded to requests for comment.