Judge OKs $5 million settlement after data breach of Geisinger patients. What to know
AI-generated summary reviewed by our newsroom.
- Judge approves $5 million settlement after breach exposed data of 1.3M patients.
- Claimants get one year of credit monitoring; deadline to file claims is Wednesday.
- Attorneys receive one-third of fund; payouts expected to be modest per claimant.
A judge gave final approval Monday to a $5 million settlement stemming from a widespread data breach that compromised the personal information of roughly 1.3 million Geisinger patients.
U.S. District Judge Matthew W. Brann signed off on the agreement, which attorneys who brought the class-action lawsuit described as an “outstanding result.”
In addition to the $5 million, those with valid claims can enroll in one year of credit monitoring and identity theft protection services. The deadline to file a claim is Wednesday.
Here is what else you should know.
How much will I get?
An exact amount will be determined when all claims have been evaluated and after the deadline to submit claims has passed. But in general, don’t expect to receive enough to cover a rent or mortgage payment.
The attorneys who brought the suit will receive one-third of the $5 million. An additional $30,000 will cover litigation costs and awards for the five named plaintiffs. As of March 4, more than 97,000 claims were submitted.
All told, it’s likely best to expect a modest sum rather than a windfall.
What is this about?
Geisinger and its information technology vendor, Microsoft-owned Nuance Communications, were accused of negligence after a November 2023 data breach.
Former Nuance employee Max Vance, 47, was fired that month for unrelated misconduct, but did not immediately lose access to the company’s systems. Two days after he was fired, he improperly downloaded Geisinger’s patient records.
According to a lawsuit filing, Vance improperly accessed names, birthdates, addresses, medical record numbers, race, genders, phone numbers, facility name abbreviations and admission, discharge or transfer codes.
Geisinger has said Vance did not gain access to insurance information, credit card or bank account numbers, Social Security numbers or other financial information.
The health system did not notify patients of the breach until June 2024, saying it could have impeded what was an ongoing criminal investigation.
Neither Geisinger nor Nuance admitted wrongdoing or liability in the settlement.
Who foots the bill?
Seemingly Nuance, which did not immediately respond Monday to a request for comment. Geisinger has said none of the settlement will be paid for by the health system or its insurer.
Geisinger did not answer whether it still contracts with Nuance.
“Safeguarding our data and maintaining the trust of the communities we serve remain our top priorities,” the health system said in a written statement. “We hold our vendor partners to rigorous security standards and continually enhance our monitoring and oversight processes.”
What’s going on with the criminal case?
Vance, whom a federal prosecutor cast as a sophisticated software engineer and identity fraudster, pleaded guilty in February to one count of obtaining information from a protected computer.
Under the deal, Vance would receive a time-served sentence followed by three years of supervised release. His sentencing has not yet been scheduled. He is incarcerated at the Columbia County Prison.
In addition to false identification documents, the FBI said it found Vance in possession of equipment necessary to make fake ID cards in his apartment. He had a printer, ink, blank ID cards and a magnetic card swipe reader.
“We are also pleased that the individual who illegally accessed our systems has pleaded guilty and will be held accountable for his crimes,” Geisinger said in its statement. “We thank federal authorities for their work to identify and arrest Mr. Vance.”