Arietis Health, Progress Software Hit with Class Action Over May 2023 MOVEit Data Breach [UPDATE]

New to ClassAction.org? Read our Newswire Disclaimer

Arietis Health faces a proposed class action over a May 2023 data breach that reportedly compromised the private information of more than 1.9 million patients.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

According to the 56-page lawsuit, the revenue cycle management company has joined the ranks of over 2,000 organizations affected by the massive cyberattack against the MOVEit file transfer service, owned by software company and co-defendant Progressive Software.

The case alleges that the data breach—which Arietis Health says in its online notice of the incident exposed private data belonging to patients of at least 54 of its healthcare provider clients—was a result of the company’s failure to maintain basic cybersecurity measures.

“As a HIPAA covered business entity…, Defendant Arietis Health is required to implement adequate safeguards to prevent unauthorized use or disclosure of private information,” the suit says.

Related Reading: 2023 MOVEit Data Breach Lawsuits

Despite its legal obligation to maintain strict confidentiality of patient’s sensitive data, Arietis Health negligently stored this information on computer systems in a condition “vulnerable to cyberattacks,” the filing contends. 

In its September 29 notice letter sent to victims, Arietis Health reported that Progress Software alerted it to a security vulnerability in the MOVEit software in late May 2023, the filing relays. A subsequent investigation concluded in July 2023 that an unauthorized actor gained access to Arietis Health’s MOVEit server on May 31 of this year and acquired files containing patient data, the complaint says.

Per the complaint, stolen information includes patients’ names, dates of birth, driver’s license or other state ID numbers, addresses, Social Security numbers, medical record numbers, patient account numbers, health insurance information, diagnosis and treatment information, clinical and prescription information, and/or provider information.

As the case tells it, Russian-linked ransomware gang Cl0p has taken credit for the attack on MOVEit and began posting victims’ names on its dark web leak site as early as June 14. The lawsuit stresses that those impacted by the Arietis Health data breach now face an ongoing risk of identity theft and fraud as their information has likely been or will be sold to other cybercriminals.

“This risk is even more pronounced given the extended amount of time that lapsed between when the data breach occurred, when [the defendants] reportedly determined [the plaintiff’s] and class members’ private information was compromised, and when [the defendants] actually notified [the plaintiff] and class members about the data breach,” the complaint says.

The lawsuit looks to represent anyone, or, if minors, their parents or guardians, or, if deceased, their executors or surviving spouses, whom Arietis Health identified as being among those individuals impacted by the data breach, including all who were sent notice of the incident. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.