Maternal and Family Health Services Facing Class Action Over Months-Long Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action alleges Maternal and Family Health Services (MFHS) is responsible for a data breach that reportedly occurred from August 21, 2021 to April 4, 2022 and compromised the personal information of more than 461,000 current and former clients.

The 27-page suit claims the nonprofit, which operates several health and nutrition centers throughout Eastern Pennsylvania, fell victim to an eight-month data breach due to its failure to properly secure and safeguard sensitive information stored on its network. According to the case, hackers gained access to customers’ names, addresses, dates of birth, Social Security and driver’s license numbers, financial account/payment card information, usernames and passwords, and medical and/or health insurance information.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

As a result of MFHS’s negligence, at least 461,070 data breach victims face a “present and imminent lifetime” risk of fraud and identity theft as their information may be bought and sold on the dark web, the complaint asserts. 

“As of this writing, there exist many class members who have no idea their [sensitive personal information] has been compromised, and that they are at significant risk of identity theft and various other forms of personal, social, and financial harm,” the case reads. “The risk will remain for their respective lifetimes.”

Per the suit, MFHS detected the ransomware attack on April 4 of last year but waited another eight months to notify impacted individuals, on January 10 of this year, the suit states. Although MFHS stated that it is “committed to strengthening our systems’ security to prevent this kind of incident from happening again,” the nonprofit has not offered any specifics about what remedial measures it plans to undertake, the lawsuit says.

The plaintiff, a Pennsylvania consumer who last obtained services from MFHS in 2006, claims to have experienced since the incident fraudulent attempts to use her American Express card to purchase infant formula and supplies. The woman has also received an influx of spam calls, texts and emails related to medical procedures, indicating that her data has already been circulated on the dark web, the filing claims.

The complaint alleges the nonprofit left itself vulnerable to the cyberattack by failing to comply with minimum industry standards for cybersecurity, which the case says constitutes an “unfair act or practice” prohibited under the Federal Trade Commission Act.

As the complaint tells it, MFHS’s deficient data security practices are particularly egregious considering that data breaches are a notorious and foreseeable threat to companies that store personal data in their systems.

The suit seeks to represent anyone in the United States whose sensitive personal information was compromised in the data breach announced by Maternal and Family Health Services on or about January 10, 2023.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.