Hapy Bear Surgery Center is facing a class action lawsuit over a December 2023 ransomware attack but it settled for a sum of money that is undisclosed. The pediatric dental clinic in Tulare, California discovered the cyberattack on or about December 27, 2024, and reported on March 19, 2024 the potential access or theft of data including names, addresses, medical data, medical insurance data, driver’s license numbers, and Social Security numbers. In compliance with HIPAA Breach Notification law, the surgery center issued breach notification letters in April 2024.
Plaintiffs filed in California Superior Court for Tulare County the class action lawsuit over the data breach, In re: Hapy Bear Surgery Center Data Security Incident Litigation. According to the plaintiffs, the dental clinic was negligent when it did not employ proper measures to protect the confidentiality of patient information. The lawsuit additionally stated claims of unjust enrichment, breach of implied contract, unfair business practices, and a breach of the California Confidentiality of Medical Information Act.
Hapy Bear Surgery Center rejects all allegations and states that it did not do anything wrong. Instead, the entity opted to resolve the lawsuit to end the litigation and avoid more legal expenditures as well as the uncertainty of trial. As per the conditions of the settlement, class members could file claims for $500 maximum to pay for recorded ordinary out-of-pocket losses as a result of a data breach, which include credit monitoring expenses, credit fees, and as much as 4 hours of lost time valued at $25 an hour. Individuals may also file claims for recorded, unreimbursed extraordinary losses like losses as a result of identity theft and fraud with a maximum of $7,500 for every class member. Class members who reside in California during the breach are also eligible to receive a $50 cash payment.
The settlement additionally involves three-bureau credit and dark web monitoring services for two years and an identity theft insurance policy worth $1 million. Hapy Bear has focused on undertaking extra data protection measures. The court has given preliminary approval of the settlement. Claims should be filed on or before February 4, 2025. The schedule of the final approval hearing is February 24, 2025.