Pinehurst Radiology and Tallahassee Memorial HealthCare Settle Data Breach Lawsuits Two healthcare providers have reached settlements in separate class action lawsuits over data security incidents in 2025. Pinehurst Radiology Associates agreed to settle claims stemming from a January 2025 cybersecurity breach that exposed the protected health information (PHI) of 8,682 individuals. The North Carolina-based medical imaging center detected the incident on January 20, 2025, confirming that sensitive data including names, Social Security numbers, medical records, and insurance details had been compromised. Affected patients were notified in May 2025. Plaintiffs alleged negligence in failing to implement adequate cybersecurity measures, though Pinehurst Radiology denied wrongdoing. The settlement, preliminarily approved on September 30, 2025, includes 12 months of medical data monitoring with a $1 million identity theft insurance policy for class members. Victims may also claim up to $500 in reimbursement for documented losses incurred between January 20, 2025, and April 9, 2026. The final fairness hearing is set for April 6, 2026, with claims due by April 9, 2026. Tallahassee Memorial HealthCare settled a lawsuit over its use of website tracking pixels, which allegedly shared patients’ PHI with third parties like Meta and Google without consent. The lawsuit claimed the tools collected user interaction data for marketing purposes, violating privacy laws, including the Florida Security of Communications Act and the Electronic Communications Privacy Act. Tallahassee Memorial denied liability but opted to settle to avoid litigation costs. Under the agreement, class members can receive a 24-month membership to CyEx Financial Shield Complete and a $17 cash payment. The final fairness hearing is scheduled for March 2, 2026. Both settlements reflect ongoing legal and financial consequences for healthcare organizations following data exposure incidents.

A ransomware attack occurred against ESO Solutions, a significant software provider for emergency services and healthcare. This incident resulted from unauthorised data access and system encryption across many enterprise platforms. Depending on the information patients have shared with their healthcare providers using ESO's software, a range of personal data was exposed in the hack. Among the compromised data are: complete names dates of birth Numbers to call Numbers for patient accounts and medical records Details of the injury, diagnosis, treatment, and procedure, and Social Security numbers. It was established that patient data connected to U.S. hospitals and clinics that ESO serves as a client was compromised. All notified parties will receive a year of identity monitoring services from Kroll through ESO to assist in reducing risks.

Tallahassee Memorial HealthCare (TMH) targeted by the cyber security incident that impacted some of IT systems. They shut down their IT systems out of caution. They rescheduled non-emergency patient appointments. Patients will be contacted directly by their provider and/or care facility if their appointment is affected. The good news is that the IT department promptly found the problem and is actively trying to fix it. Additionally, they are redirecting EMS victims, and they will only accept Level 1 trauma cases that are located in our immediate service area. The cancellation and rescheduling of all elective surgical and outpatient procedures.