Four people are suing Penobscot Valley Hospital after a likely data breach.
The hospital learned of suspicious activity in its network on Jan. 28 and the subsequent investigation found that hackers may have accessed patients’ addresses, dates of birth, Social Security numbers, and medical and financial information.
However, the hospital did not start telling people about the “massive and preventable cyberattack” until July 20, according to one of the four lawsuits filed in Penobscot County Superior Court. All the lawsuits were filed against Penobscot Valley Hospital.
The lawsuits, filed by Jessica Stanley, Katelyn Berube, James Wotton and Lindsey Maartens, all contain nearly the same allegations. They say the hospital was negligent by failing to keep sensitive information safe, it breached an implied contract to keep information safe and it breached its fiduciary duty.
All four lawsuits, filed Friday and Monday, ask a judge to allow them to proceed as a class action. No ruling has been issued.
Penobscot Valley Hospital did not immediately provide comment on the lawsuits.
The data breach is because of the hospital’s failure to implement adequate cybersecurity procedures, the lawsuits said.
For five months the hospital didn’t alert the public to the breach, which meant people were not aware they were at significant risk of identity theft and other harms, the lawsuit filed by Stanley said.
The lawsuits ask a judge to grant unspecified damages and restitution.