A renowned San Francisco-based international law firm, Orrick, Herrington & Sutcliffe, recently suffered a data breach.
In the breach which was discovered in March 2023, sensitive health information belonging to more than 637,000 individuals was compromised. Apparently, the breach occurred on February 2, 2023, and was discovered on March 3, 2023.
During the breach, the threat actors accessed a file share, revealing personal data and sensitive health information of victims. Amongst the total of 637,620 victims, 830 were ones belonging to Maine.
The stolen data included a variety of information like names, date of birth, addresses, email addresses, and government-issued identification numbers like Social Security, passport, driver’s license, and tax identification numbers.
Moreover, medical details, insurance claims information, healthcare insurance numbers, provider details, online account credentials, and credit/debit card numbers were compromised.
According to an official filing, the company took immediate action by notifying the affected victims through a written notification. Also, identity theft protection services were offered in the form of a two-year Kroll identity monitoring service.
The data leak also impacted the data-based security services of other companies for which the company provided legal counsel. Affected individuals included customers of vision plans from EyeMed Vision Care, dental plans from Delta Dental, and data from health insurance company MultiPlan, behavioural health giant Beacon Health Options (now known as Carelon), and the U.S. Small Business Administration.
Ongoing Investigations and Legal Implications
While there are speculations of a ransomware group being involved in the incident, no official statement has been published by Orrick, leaving room for suspicion on who is behind the attack.
Also, the law firm is on its way to settle the class-action lawsuit stemming from the data breach.
Acknowledging the inconvenience it had caused, the firm came to a preliminary settlement in principle to resolve four consolidated lawsuits involving hundreds of thousands of victims.
While the specifics of the deal are still unknown, Orrick hopes to finalize agreements in 15 days. The proposed resolution tries to handle all claims connected to the breach, which exposed thousands of individuals' sensitive personal information, including names, addresses, dates of birth, and Social Security numbers. It is pending approval by U.S. District Judge Susan Illston.