Data Breach Fallout: Class Action Suit Launched Against Johns Hopkins University

BALTIMORE COUNTY - Johns Hopkins University is facing a class action lawsuit following the massive data breach in late May that exposed sensitive personal and health data.

The case, filed on July 7 in Maryland's federal district court, alleges that the university failed to adequately protect the information, potentially affecting hundreds of thousands of patients.

A complaint lodged by Pamela Hunter, a Baltimore County resident and victim of the data breach, alleges that those affected only learned about the breach and the university's possession of their data through a letter received on June 24.

"Not until after months it claims to have discovered the Data Breach did Johns Hopkins begin sending the Notice to persons whose PHI/PII and/or financial information Johns Hopkins confirmed was potentially compromised as a result of the Data Breach," the complaint, obtained by WTOP, states.

Hunter is seeking damages from the university for the trauma inflicted by having one's sensitive health information stolen and potential future harm due to the exposed data, including Social Security numbers and healthcare information.

"Plaintiff and the Class Members remain, even today, in the dark regarding what data was stolen, the particular malware used, and what steps are being taken to secure their PHI/PII and financial information going forward," the complaint states.

In response to the breach, Johns Hopkins launched an investigation and has begun reinforcing data security measures. To comply with the Health Insurance Portability and Accountability Act (HIPPA), the university must provide details about the compromised data, suggestions for victims to safeguard their information, an outline of the investigation and preventative steps, and a contact for further queries within 60 days of discovering a data breach.

Hopkins has created a dedicated website to provide this information to victims and answer questions related to the data breach.

The university clarified that it will continue to provide information as the investigation continues and provide additional services, including credit monitoring, to those impacted by the breach.

As a preventative measure, the university advises all students, faculty, staff, and dependents to protect their personal data.

"Until we know more, we strongly urge all students, faculty, and staff—as well as dependents—to take immediate steps to protect your personal information as a precautionary measure," Hopkins said in a news release.

The university has yet to issue a public statement in connection to the class action complaint.