Cybersecurity Breach at Southern Oregon Neurosurgical Clinic Leads to Lawsuit A former patient has filed a $5 million lawsuit against Southern Oregon Neurosurgical & Spine Associates (SONSA) in Medford, Oregon, following a November cyberattack that exposed sensitive patient data. The plaintiff alleges the clinic failed to promptly notify affected individuals and maintained inadequate cybersecurity protections, potentially violating HIPAA regulations. SONSA confirmed the breach stemmed from a phishing attack, compromising names, dates of birth, insurance details, and medical records. CEO Kamee Wearden stated that IT teams contained the incident quickly, minimizing further exposure. However, the plaintiff expressed lingering distrust, citing concerns over privacy protections and the clinic’s handling of the incident. As of now, SONSA reports no evidence that the stolen data has been misused. The lawsuit highlights ongoing risks in healthcare cybersecurity and the legal consequences of delayed breach notifications.