Integris Health Hit with Two New Class Action Lawsuits Over Vendor Data Breach Oklahoma-based healthcare provider Integris Health is facing two fresh class action lawsuits following a data breach involving one of its vendors. The incident comes just months after the organization settled a prior breach case for $30 million, underscoring the persistent legal and reputational risks of inadequate post-breach responses. The lawsuits highlight concerns over Integris Health’s communication strategy, which plaintiffs argue prioritized legal protection over victim support. Vague disclosures have reportedly left affected individuals frustrated, potentially exacerbating the fallout for the organization. The breach also reignites broader industry debates, including compliance challenges under the Children’s Online Privacy Protection Act (COPPA). Some companies remain hesitant to implement age-verification tools due to fears of violating data-collection restrictions, despite new FTC guidance aimed at clarifying legal uncertainties. The case reflects a growing trend: organizations that experience repeat breaches face heightened scrutiny, not only from regulators but also from an increasingly skeptical public. Legal experts note that opaque breach notifications can weaken trust and strengthen plaintiffs’ positions in litigation. Integris Health’s situation serves as a cautionary example of how poor post-incident handling can compound financial and operational consequences.

A cyberattack on November 28 was directed at Integris Health of Oklahoma. Although the anonymous threat actors encrypted none of the files in the health system, Integris discovered that the actors corresponded with patients directly. The specific personal information that may be impacted differs from person to person, however, it could include any person's name, birthdate, contact details, demographic data, and Social Security number. Integris for promptly informing patients of threat actors' direct patient contact on the same day they became aware of it.

In November 2023, Integris Health, an Oklahoma-based healthcare system, suffered a massive data breach exposing over 2 million patients' sensitive information, including Social Security Numbers, dates of birth, addresses, phone numbers, insurance details, and employer data. Cybercriminals, operating under the alias DataLeakege, stole the data and began directly extorting victims, demanding $50 per person to prevent the sale of their information on the darknet for fraud and identity theft. The breach stemmed from negligent data security practices, with plaintiffs alleging Integris failed to protect patient records or attempt to recover the stolen data. Victims faced imminent fraud and identity theft risks, prompting a $30 million class-action settlement offering three years of credit monitoring, $1M in identity theft insurance, and up to $25,000 in reimbursements for breach-related expenses. Integris denied wrongdoing but acknowledged the incident, later enhancing security policies to prevent future breaches.

The California Office of the Attorney General reported that INTEGRIS Baptist Medical Center, Inc. experienced a data breach on October 17, 2019. The breach involved the loss of a portable hard drive containing patient information, including individuals' names, Social Security numbers, and clinical information. The breach was reported on September 4, 2020, but the number of affected individuals is unknown.