MNGI Digestive Health resolves class action lawsuit related to BlackCat breach

MNGI Digestive Health, a Minnesota-based multi-location gastroenterology practice, recently settled a class action lawsuit arising from a cyberattack in August 2023. Initially reported on DataBreaches on September 25, 2023, the breach was detected by MNGI on August 25, 2023, following the cyberattack by the BlackCat (AlphV) ransomware group. The attackers exfiltrated over 2 TB of data, including sensitive patient information such as names, dates of birth, passport numbers, driver’s license details, medical records, insurance information, payment card data, account numbers, and Social Security numbers.

The severity of the breach was evident as BlackCat posted threatening messages on their dark web leak site. DataBreaches revealed that after failing to pay the ransom demanded by AlphV, more than 800 GB of data was leaked, accompanied by further threats of data exposure, spam, and harassment. The breach affected 767,670 patients, as reported to the U.S. Department of Health and Human Services (HHS) in October 2023. However, individual notification letters were only dispatched in July 2024.

The settlement of $2,838,749.62 for the MNGI Digestive Health class action lawsuit received preliminary court approval on May 7, 2025, encompassing all individuals who were notified about the data breach occurring around August 20, 2023. Notably, this settlement did not entail an acknowledgment of any wrongdoing or liability by MNGI. Eligible claimants can access further details and filing instructions on the official site, mngisettlement.com.

Upon reviewing the settlement agreement, DataBreaches sought insights into security enhancements for patient data protection. While specifics were not provided, one provision highlighted by the investigation revealed that MNGI would be investing $2.7 million in security measures over the next three years. This allocation indicates a commitment by MNGI to bolstering data security, although the comparison to prior security investments remains unclear.

In light of the increasing frequency and sophistication of cyber threats, safeguarding sensitive information, especially in healthcare settings, is critical. The MNGI Digestive Health settlement serves as a stark reminder of the potential consequences of cyberattacks and highlights the importance of proactive security measures to mitigate such risks. As organizations strive to fortify their cybersecurity posture, ongoing investments and advancements in data protection technologies are essential to safeguarding patient privacy and maintaining trust in healthcare providers.

The evolution of cybersecurity measures in healthcare facilities is imperative to combatting the complex and ever-evolving threats posed by cybercriminals. By understanding the implications of data breaches and adopting robust security protocols, organizations can demonstrate their commitment to data protection and patient confidentiality. As the digital landscape continues to evolve, healthcare providers must remain vigilant and proactive in countering cybersecurity threats to uphold the integrity of patient information and privacy.