FOLLOW US

A Tennessee medical provider has agreed to resolve sweeping class action litigation tied to a cyberattack that exposed the sensitive health information of more than half a million patients, closing a legal chapter born from a digital break-in that rippled across the state.

Murfreesboro Medical Clinic & SurgiCenter confirmed it has reached a settlement over a data breach discovered in April 2023 that involved unauthorized access to the protected health information of roughly 559,000 individuals. The agreement has received preliminary court approval.

A Cyber Intrusion With Far-Reaching Impact

According to court filings, the clinic determined that a “well-known cyber extortion operation” infiltrated its network on or about April 22, 2023, and siphoned off patient and employee data. Affected information ran deep and wide, including names, birth dates, home addresses, phone numbers and copies of driver’s licenses, as well as full or partial Social Security numbers.

The breach also exposed dependent details, dates of service, diagnostic and medical information connected to those visits, test results, procedure notes, prescription data, medical record numbers, and insurance and enrollment information. Patients were notified of the incident in May 2023. The BianLian ransomware group later claimed responsibility, according to the filings.

Like a vault left briefly unguarded, the network intrusion unlocked years of personal records in a matter of moments.

Lawsuits Consolidated, Liability Denied

Six class action lawsuits followed the breach. On Sept. 7, 2023, the cases were consolidated into a single action — Krenk et al. v. Murfreesboro Medical Clinic and SurgiCenter and Murfreesboro Medical Clinic — in the 16th Judicial Circuit Court of Rutherford County, Tennessee.

The consolidated complaint alleged the cyberattack stemmed from negligence and failures to meet statutory and common law duties to protect sensitive information. The clinic and its affiliated entities have denied all allegations of wrongdoing and liability.

Why the Parties Chose to Settle

After extensive exchanges of information and mediation, all sides agreed a settlement offered the most practical path forward, citing the costs, delays and uncertainty of prolonged litigation. The agreement was endorsed by all parties and granted preliminary approval by the court.

Under the terms, the settlement provides for attorneys’ fees and expenses of up to $350,000, along with service awards of $3,000 for each class representative, totaling $24,000.