Lehigh Valley Health Network pays 800000 dollars over ransomware breach settlement

Lehigh Valley Health Network agreed to pay an 800,000 dollar settlement following a federal investigation into a 2023 ransomware attack, Medical Daily and The HIPAA Journal both report. The Department of Health and Human Services Office for Civil Rights announced the Health Insurance Portability and Accountability Act settlement on October 29, 2026, according to Medical Daily. [1][2]

Medical Daily reported that the 2023 cyberattack was carried out by the BlackCat ransomware group. The hackers posted sensitive medical information and radiation treatment photos of cancer patients on the dark web. The security breach compromised the personal information of 248,359 individuals, including names, addresses, dates of birth, Social Security numbers, driver license numbers, financial details, and medical diagnoses. [1]

Under the terms of the settlement, the health network agreed to a corrective action plan without admitting liability, according to reporting from Becker Hospital Review cited by Medical Daily. Lehigh Valley Health Network is an eastern Pennsylvania healthcare system based in Allentown that merged with Jefferson Health in 2024. [1][3][6]