Bone & Joint Clinic Hit with Class Action Over Data Breach Affecting 100K People

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit claims negligence on the part of Bone & Joint Clinic, S.C. is to blame for a data breach purportedly discovered by the company in January 2023.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 36-page lawsuit says that although the networks of the Wisconsin-based orthopedic and physical therapy practice were hacked on January 16, it was 11 days later that the defendant realized that the highly sensitive personal information stored on the servers had been exposed to cybercriminals.

The suit relays that the breach compromised the private data of about 105,094 current and former patients, including, but not limited to, their names, dates of birth, Social Security numbers, home addresses, phone numbers, health insurance information, medical diagnoses and treatment details.

The case argues that the cyberattack was a direct result of Bone & Joint’s failure to implement reasonable cybersecurity practices to protect patients’ personal data. Inadequate safeguards meant that the confidential information was stored in a “vulnerable position” that made the practice’s servers “easy targets for cybercriminals,” the complaint alleges.

Per the filing, it is unclear how long the hackers had access to Bone & Joint’s systems before the unauthorized activity was discovered.

“In other words, [Bone & Joint] had no effective means to prevent, detect, stop, or mitigate breaches of its systems—thereby allowing cybercriminals unrestricted access to [patients’ personal data],” the lawsuit charges.

To make matters worse, the defendant purportedly delayed notifying victims of the breach until early March of this year, around 50 days after it supposedly occurred, the suit claims. By keeping victims “in the dark,” Bone & Joint has robbed them of the chance to mitigate the harms caused by the disclosure of their data, the case argues.

By law, Bone & Joint has an obligation to protect patients’ private information, and indeed, the company’s own privacy policy acknowledges this duty, the complaint says. Despite this, however, the defendant has “done little” to make amends for its alleged negligence, the lawsuit alleges. Although it has reportedly offered victims credit and identity monitoring services, the gesture is “wholly insufficient to compensate … for the injuries that [Bone & Joint] inflicted upon them,” the filing contends.

The plaintiff, a Wisconsin resident and former Bone & Joint patient, received notice in March of this year that his personal information had been compromised in the data breach, the suit relays. According to the case, the man has already experienced harm from the unauthorized disclosure of his private information, as he was alerted by PayPal in March of a fraudulent attempt to withdraw $410 from his account.

“The exposure of one’s [personal data] to cybercriminals is a bell that cannot be unrung,” the complaint reads. “Before this data breach, patients’ private information was exactly that—private. Not anymore.”

The lawsuit looks to represent anyone in the United States whose personal information was compromised in the data breach discovered by Bone & Joint Clinic, S.C. in January 2023.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.