SouthCoast Medical Group Class Action: Patients Sue Over Data Breach

A class action lawsuit accuses SouthCoast Medical Group of negligence in a data breach that exposed patients' personal and medical information, allegedly leading to identity theft and fraud.

Consumers Affected: Patients whose personal and medical information was compromised in the data breach.

Court: U.S. District Court for the Southern District of Georgia.

Plaintiff Tamara Rathbun filed the class action complaint against SouthCoast Medical Group LLC on July 17 in a Georgia federal court, alleging the medical provider failed to properly secure and safeguard the sensitive information of its patients. 

The complaint comes after a significant data breach that allegedly compromised the personal and medical information of approximately 32,000 people, Rathburn says.

The compromised data includes full names, Social Security numbers, passport and driver’s license numbers, financial account details, electronic signatures, and medical treatment information. 

“The private information compromised in the data breach was exfiltrated by cyber-criminals and remains in the hands of those cyber-criminals who target private information for its value to identity thieves,” the lawsuit states.

SouthCoast Medical Group Accused of Negligence in Massive Data Breach

According to the complaint, SouthCoast started notifying patients about the data breach on July 3, 2024, more than a year after the provider became aware of the breach.

The letters informed patients that the provider had become aware of “unauthorized activity” in its network on June 18, 2023, the lawsuit states. 

SouthCoast Health told its customers that it opened an investigation that determined that between June 15 and June 18, 2023, an “unauthorized actor” gained access to its network and “viewed or copied certain files stored on certain systems.” The provider said it promptly took steps to secure its systems. 

However, Rathbun says this wasn’t good enough, and didn’t meet federal standards for informing customers about a data breach involving their information. 

“Omitted from the Notice Letter were the identity of the cybercriminals who perpetrated this Data Breach, the details of the root cause of the Data Breach, the vulnerabilities exploited, and the remedial measures undertaken to ensure such a breach does not occur again,” she said. 

Stolen Patient Data Allegedly Sold on Dark Web, Lawsuit Claims

Rathbun alleges that SouthCoast Medical Group was negligent, and failed to implement adequate cybersecurity measures, leaving its data systems vulnerable to a foreseeable and preventable cyberattack. 

She says the stolen data has already been used to commit identity theft and fraud, with potential future crimes including the opening of new financial accounts, taking out loans, obtaining government benefits, filing fraudulent tax returns, and obtaining driver’s licenses with another person’s photograph.

“Plaintiff further believes that her Private Information and that of Class Members was subsequently sold on the dark web following the Data Breach, as that is the modus operandi of cybercriminals that commit cyber-attacks of this type,” the lawsuit states.

In the SouthCoast Medical Group data breach class action lawsuit, Rathbun seeks to represent everyone in the United States whose private information was accessed in the July 2024 data breach. She is seeking certification of the class action, damages, fees, costs, an order forcing the provider to better protect their data, and a jury trial.

SouthCoast is not the only medical provider to face a privacy-related class action. Henry Ford Health was also recently hit with a class action lawsuit alleging it unlawfully discloses patients' confidential information to third parties, including Facebook and Google without patient consent. 

Case Details

• Lawsuit: Rathbun v. SouthCoast Medical Group LLC 
• Case Number: 4:24-cv-00148-LGW-BWC 
• Court: U.S. District Court for the Southern District of Georgia

Plaintiffs' Attorneys

• Allison McCarthy
• Mariya Weekes (Milberg Coleman Bryson Phillips Grossman PLLC)