A Florida health organization has agreed to settle a class action brought over a ransomware attack that exposed employee data, ending litigation that had been running for more than two years.
Notification went out on or around March 22, 2024, to the people affected. The intrusion itself dated to February 20, 2024, when a ransomware group got into the Etairos Health network and potentially viewed or took employee details such as Social Security numbers, government-issued ID numbers, addresses, phone numbers and names.
Filed in Pinellas County Circuit Court, the suit claimed Etairos ought to have stopped the breach by putting proper cybersecurity measures in place. Etairos denies any wrongdoing or liability, and to avoid the cost and risk of further litigation all parties agreed to settle.
Under the terms, a class member can pick either a one-time cash payment of $75, for those who skip the reimbursement claim, or up to $4,500 for documented, unreimbursed losses tied to the breach, which can include as much as eight hours of lost time at $15 an hour. A $3,500 service award for the class representative is set aside too, alongside as much as $146,500 for attorneys’ fees.
It is a familiar shape for healthcare. Before encrypting systems, ransomware crews increasingly take employee and patient records, turning the data itself into leverage. Even modest settlements become a second cost piled on top of downtime, recovery and regulatory scrutiny.
For security leaders the lesson is unglamorous. The controls that most often determine whether a ransomware intrusion becomes a costly breach or a contained incident remain multi-factor authentication, network segmentation and tested backups. Etairos, like many before it, is footing that gap through installments of attorneys’ fees, class benefits and reputation.
