Cybersecurity

Plaintiff Carli Rodriguez filed this class action lawsuit following a cyberattack on City of Hope's systems between September 19, 2023, and October 12, 2023. The complaint alleged that the organization failed to secure the Personal Health Information (PHI) and Personally Identifiable Information (PII) of approximately 800,000 individuals, including social security numbers and medical history. Rodriguez further claimed that City of Hope was negligent by waiting until April 2024—nearly six months after discovering the breach—to notify affected victims. The case, which involved claims of negligence, breach of implied contract, and privacy violations, was resolved with a settlement of $8,500,000.

The case is based on a severe data breach that occurred in September 2023, during which an unauthorized party accessed highly sensitive personal information, including clients’ Social Security Numbers (SSNs) and medical records. Plaintiffs alleged that Keenan failed to uphold its fundamental duty of care and acted with negligence in protecting this private data. The agreed-upon $14,000,000 Settlement Fund has been established to compensate the class, which includes cash payments, reimbursement of documented losses up to $10,000 per class member, and the provision of three years of Credit Monitoring and Insurance Services (CMIS). Crucially, while the Settlement Agreement has been electronically filed with the Court (on 12/26/2024) , it is subject to Court approval. All litigation proceedings are currently stayed pending the Final Fairness Hearing and the Court's entry of the Final Approval Order and Judgment. The case is therefore technically still open until the Effective Date of the Settlement occurs.