Patients sue Aultman in class-action lawsuit for data breach

A legal action has been taken against Aultman Health System by a former patient, who claims that the healthcare institution was negligent in safeguarding personal and medical data during a data breach that took place in early 2025. The lawsuit was filed in Stark County Common Pleas Court, alleging that Aultman fell victim to a cyberattack around January 22, 2025. This breach exposed highly sensitive data of both current and former patients, which included their names, Social Security numbers, medical records, test results, diagnoses, and other confidential treatment details. Information obtained from the filing indicates that hundreds of thousands of individuals were affected by this breach.

The complaint further asserts that Aultman failed to notify the affected patients until almost a year after the incident, knowing that unauthorized third parties had accessed the data. The plaintiff, known as Jack Oliver, claims that this delay in disclosure increased the risk of identity theft, financial fraud, and medical identity fraud for those whose data was compromised. The allegations include negligence on Aultman’s part, suggesting that the healthcare provider benefitted unjustly from this ordeal while failing to uphold federal cybersecurity standards concerning data protection.

The filing indicates that Aultman did not implement adequate cybersecurity measures, failing to encrypt sensitive information, relying on a third-party vendor without adequate security protocols, and disregarding federal guidelines mandated by the Federal Trade Commission. It also highlights the fact that healthcare institutions are appealing targets for cybercriminals due to the enduring value of medical and identity documents. According to federal data referenced in the lawsuit, Social Security numbers and patient health records can be exploited for various types of fraud, including tax, insurance, and employment fraud, with the potential to circulate in underground markets for years.

It has been proposed that the class in this lawsuit would consist of current and former Aultman patients who had their information compromised during the breach. The plaintiff is seeking both financial compensation and injunctive relief that would require Aultman to enhance its data security practices. This would include offering identity monitoring services to the affected individuals, in addition to improving overall data protection measures within the healthcare system.