Forefront Dermatology Facing Class Action Over Spring 2021 Data Breach Affecting Roughly 2.4M Patients [UPDATE]
by Erin Shaak
Last Updated on November 16, 2022
Anderson v. Forefront Dermatology, S.C. et al.
Filed: July 29, 2021 ◆§ 1:21-cv-00891
Forefront Dermatology faces a proposed class action over a Spring 2021 data breach that reportedly affected approximately 2.4 million patients.
November 16, 2022 – Forefront Dermatology Data Breach Settlement Website Is Live
The official website for the $3.75 million Forefront Dermatology data breach class action settlement is live and can be found here:
To file a claim, head to this page. If you received a settlement claim ID, check the first option, enter the claim ID number found on your settlement notice, and hit the “Begin Claim” button to begin.
If you did not receive an ID but believe that you should be covered by the settlement, select the second option. Keep in mind, however, that those who did not receive a settlement claim ID will be asked to provide reasonable documentation to demonstrate that they were impacted by the data breach.
Claims must be submitted online or postmarked by February 8, 2023. If you do nothing, you will receive no benefits from the settlement and you will give up your right to sue Forefront Dermatology for the claims covered in the litigation.
To contact the settlement administrator, head to this page.
Don’t miss out on settlement news like this. Sign up for ClassAction.org’s free weekly newsletter here.
Case Update
October 26, 2022 - $3.75M Settlement Approved in Forefront Dermatology Data Breach Class Action
A federal judge has granted preliminary approval to a $3.75 million settlement to resolve the claims detailed on this page.
The deal, which was submitted to the court on September 1 and preliminarily approved on October 3, will provide cash payments and credit monitoring for U.S. residents who were notified by Forefront Dermatology that their personal information was potentially compromised in the ransomware attack at issue in the litigation.
The settlement will also require Forefront to take certain steps to improve its data security.
Everyone covered by the settlement, i.e., the class members, will be eligible to file a claim for two years of three-bureau credit monitoring and up to $1 million of insurance coverage for identity theft incidents.
Class members will also be eligible to submit a claim for reimbursement of up to $10,000 in documented losses (and expenses incurred from trying to remedy those losses) that are likely traceable to the ransomware attack. These claims must be supported by reasonable documentation, such as credit card or bank statements, invoices, phone records or receipts.
Those covered by the deal can also submit a claim for reimbursement of lost time related to any efforts to address or prevent fraud and identity theft following the announcement of the Forefront Dermatology data breach. Claims for lost time, capped at five hours, will be paid at a rate of $25 per hour for a maximum of $125.
In lieu of the aforementioned benefits, class members can instead submit a claim for a cash payment. These payments will be distributed to claimants from the settlement fund on a pro-rated basis after the costs of the credit monitoring, loss payments and lost time payments have been paid.
Those covered by the deal should expect to receive notice of the settlement through either email or physical mail using contact information provided to the settlement administrator by Forefront. According to court documents, notice will be sent to consumers covered by the settlement sometime in November.
An official website will also be set up at ForefrontSettlement.com to provide more information about the settlement and allow those covered by the deal to file claims. ClassAction.org will update this page when the official settlement website goes live.
Payments for valid claims will not be sent out until after the settlement receives final approval from the court and any appeals are resolved in favor of the deal. A final approval hearing has been scheduled for March 1, 2023.
Don’t miss out on settlement news like this. Sign up for ClassAction.org’s free weekly newsletter here.
Forefront Dermatology, S.C. and Forefront Management, LLC face a proposed class action over a Spring 2021 data breach that reportedly affected approximately 2.4 million patients.
The 29-page lawsuit claims the “massive intrusion” into the defendants’ network between May 28 and June 4, 2021 was the result of the dermatology services group’s failure to implement adequate data security. As a result, the case says, patients’ names, addresses, dates of birth, patient account numbers, health insurance plan member IDs, medical record numbers, dates of service, provider names, and medical and clinical treatment information were exposed to unauthorized parties.
The filing argues that Forefront has fallen short of its responsibility to secure patients’ personally identifiable information (PII) and exposed them to a lifetime risk of identity theft and fraud:
“Forefront’s failures to ensure the adequacy of its IT networks and systems, and that class members’ sensitive PII was secured and protected fell, [sic] far short of its obligations to Plaintiff and class members’ and their reasonable expectations for data privacy, jeopardized the security of Plaintiff’s and class members’ PII, and put Plaintiff and class members at serious risk of fraud and identity theft.”
Per the case, Forefront, as a large medical services provider operating in 21 states and the District of Columbia, was well aware of the risks of a data breach and, despite having the resources to prevent such an incident, failed to do so.
Although the defendants allegedly learned of the breach as early as June 4, they “waited over a month” to send notice of the incident to affected patients, the lawsuit attests. Moreover, Forefront, the case says, “does not appear to have offered” any relief to those affected, such as credit monitoring and identity theft prevention services, even though such tools are frequently provided by companies in the wake of an exposure of patients’ sensitive health and personal information.
The lawsuit claims Forefront had an obligation under the Health Insurance Portability and Accountability Act and industry standards to protect patients’ information from unauthorized disclosure yet “failed to spend sufficient resources on data privacy risk management.” Further, while Forefront has disclosed only limited details about the nature of the breach, a group known as the “Cuba Ransomware” gang reportedly posted on its website in late June 2021 information purporting to be from Forefront, according to the complaint. The case notes that although it is unclear whether the information posted on the site is the same as that stolen in the breach at issue, “it makes clear that Forefront’s data privacy is inadequate, and that there is a large appetite for stolen sensitive information among cyber criminals.”
The lawsuit seeks to represent anyone in the U.S. whose personally identifiable information was compromised in the Forefront data breach that occurred between May 28 and June 4, 2021, with a proposed subclass of Pennsylvania residents.
Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.
Camp Lejeune
Camp Lejeune residents now have the opportunity to claim compensation for harm suffered from contaminated water.
Read more here: Camp Lejeune Lawsuit Claims
Stay Current
Sign Up For
Our Newsletter
New cases and investigations, settlement deadlines, and news straight to your inbox.
Before commenting, please review our comment policy.