TAMPA, Fla. — The personal injury law firm Morgan & Morgan filed a lawsuit on Monday against Tampa General Hospital over a recent data breach that exposed sensitive personal data of about 1.2 million people.
The lawsuit was filed on behalf of three people victimized who say TGH allegedly not only failed to protect their personal and medical information but also did not notify them of the data breach until more than two months after it happened, Morgan & Morgan told 10 Tampa Bay. This resulted in the identity theft of one of the plaintiffs, the lawsuit said.
10 Tampa Bay has reached out to TGH for comment on this lawsuit and is waiting to hear back.
The breach that is discussed in the lawsuit pertains to when TGH detected unusual activity on its computer systems on May 31. They did an investigation with the help of a cybersecurity firm and found that an unauthorized user accessed the hospital's network and downloaded the files between May 12-30.
Officials say they reported the breach to the FBI and gave information to support an investigation of the criminal group responsible.
"TGH considers the health, safety and privacy of patients and team members a top priority," a spokesperson for the hospital said in a news release at the time. "The hospital is continuously updating and hardening systems to help prevent events such as this from occurring and has implemented additional defensive tools and increased monitoring."
Last month, the hospital said they were notifying patients and staff members that someone may have accessed their personal data in the breach.
The lawsuit claims cybercriminals hacked into TGH's computer system and stole the data of about 1.2 million patients, including names, addresses, phone numbers, dates of birth, social security numbers and certain HIPAA-protected medical records.
Morgan & Morgan's lawsuit also alleges the hospital allowed the hackers 19 days to steal the undetected information.
“Our clients’ allegations, in this case, paint a picture of Tampa General Hospital’s cavalier attitude toward cybersecurity and patient privacy. This is not the first time Tampa General Hospital has allegedly failed to protect its patients’ personal data – this data breach follows a 2014 breach," Morgan & Morgan attorneys John Morgan and Ryan McGee said in a joint statement. "It is our hope that this lawsuit will not only secure justice and accountability for the patients whose privacy and peace of mind have been irrevocably violated but also will spur Tampa General Hospital to take additional steps to protect their patients' privacy in a manner appropriate for the current climate of cyberattacks.”
According to the lawsuit, one of the victims listed in the complaint has suffered identity theft since the breach happened.
10 Tampa Bay's Andrew Polino contributed to this report.