Federal regulators have closed the books on a 2023 ALPHV/BlackCat intrusion with an $800,000 penalty and a three-year monitoring arrangement, making the case the 22nd ransomware investigation HHS’ Office for Civil Rights has resolved with a financial sanction. Lehigh Valley Health Network agreed to the terms after OCR found the Pennsylvania system had been running without the visibility controls the Security Rule demands.
The attack reached a subsidiary the network had absorbed two years earlier. Delta Medix, acquired in 2021, was the entry point for ALPHV/BlackCat, which pulled files covering 248,359 people and demanded payment. Lehigh Valley refused, and the stolen material surfaced on the group’s public leak site.
What drew the penalty was not the break-in itself. OCR concluded the health system had never completed a thorough risk analysis and had no routine practice for reviewing audit logs, access reports, or incident tracking. Investigators also found the notification clock blew past its limit: the intrusion was spotted February 4, 2026, and the department learned of it May 15, 2026, well outside the 60-day window. Individual notices were late as well.
“Failure to conduct an accurate and thorough risk analysis and to undertake regular review of information system activity makes regulated entities attractive targets for cyberattacks,” OCR Director Paula M. Stannard said in the announcement.
The corrective action plan commits the network to a fresh risk analysis, a risk management plan, revised policies, and workforce training, with OCR watching for three years. Breach notification failures have now featured in five of the 12 HIPAA settlements announced this year.
