Watson Clinic Resolves $10 Million Data Breach Lawsuit with Federal Court Approval A federal court in the Middle District of Florida has granted final approval to a $10 million settlement resolving a data breach lawsuit against Watson Clinic LLP. The breach exposed sensitive patient data, including medical images, government identifiers, and financial information belonging to current and former patients. U.S. District Judge Steven D. Merryday ruled that class counsel adequately represented the affected individuals, allowing the settlement to proceed. Under the terms, class members may receive additional compensation if their leaked medical images included facial recognition data. The court also deemed the settlement’s notice provisions sufficient. The case highlights the growing financial and legal consequences of healthcare data breaches, particularly when highly sensitive personal and medical records are compromised. The settlement includes a $3.3 million attorneys’ fee award.

Watson Clinic LLP faced a severe data breach in February 2024, where an unauthorized third party gained access to and, in some cases, published sensitive patient data and medical images on the dark web. The breach exposed personal and protected health information (PHI), including digital images categorized by sensitivity (e.g., full-face with exposed areas, partial clothing, or non-sensitive content). Affected individuals—current and former patients—received notification letters and became eligible for a $10 million class-action settlement, with payouts ranging from $100 to $75,000 depending on the severity of exposure (e.g., identity theft risks, fraud, or emotional distress from leaked images). The lawsuit alleged negligence, breach of contract, and violations of consumer protection laws, though Watson Clinic denied liability. The incident led to financial compensations for out-of-pocket losses (up to $500), extraordinary damages (up to $6,500), and time spent remedying issues ($125 max). The breach underscored failures in data security protocols, resulting in reputational harm, legal costs (up to $3.3M in attorneys' fees), and long-term trust erosion among patients.

Watson Clinic, a Lakeland-based healthcare provider, suffered a ransomware attack in January 2024, exposing the personal identifiable information (PII) of over 280,000 patients. The compromised data included names, addresses, birthdates, Social Security numbers, driver’s license numbers, financial account details, and medical records, stored unencrypted in an internet-accessible environment. The DonutLeaks ransomware group claimed responsibility, threatening to publish the stolen data after Watson Clinic allegedly ignored a ransom demand. The breach was discovered on February 6, 2024, but public disclosure was delayed until April 2024, with notifications to patients and state Attorneys General occurring months later. The clinic faced a class-action lawsuit (filed in September 2024) for failing to secure patient data, leading to a $10 million settlement fund to compensate affected individuals for identity theft risks, financial harm, and potential dark web exposure of sensitive images. Payments range from $100 to $75,000, depending on the severity of data exposure.