Rise Interactive Media & Analytics Sued Over Edgepark Medical Supplies Data Breach
A lawsuit has been filed against the digital marketing agency, Rise Interactive Media & Analytics, over a cyberattack in which the protected health information of approximately 54,500 patients of Edgepark Medical Supplies was compromised.
On November 14, 2022, a hacker gained access to Rise’s network and accessed files containing sensitive patient data, including names, email addresses, phone numbers, provider information, diagnoses, expected delivery dates, and health insurance information. Rise discovered Edgepark data had been compromised on December 2, 2022, and the affected individuals were notified about the attack on February 10, 2023.
The lawsuit was filed by the law firm Wolf Haldenstein Adler Freeman & Herz LLC in the U.S. District Court of the Northern District of Illinois Eastern Division on behalf of plaintiff Tiffany Roper and similarly situated individuals. The lawsuit alleges Rise was at fault for the breach due to the failure to implement reasonable security measures to protect consumer data that was provided by Edgepark.
The lawsuit also calls into question why Edgepark provided patient data such as health insurance information to Rise and seeks to establish how that information is relevant to the digital marketing services the company provides to Edgepark, especially since permission must be obtained from patients before disclosing protected health information for marketing purposes. The lawsuit also takes issue with the length of time it took to notify the affected patients about the breach – three months after the intrusion was detected and for the lack of information in the breach notification letters. The lawsuit claims the notification letters did not explain how the breach occurred, how the information was stolen, and what steps Rise has taken to prevent misuse of patient data.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Shortly after the data breach, in late December 2022 or early January 2023, the plaintiff claims that her information was used to fraudulently fill a prescription using her health insurance, which indicates her data had been rapidly traded on the dark web. She also claims she faces a present and imminent lifetime risk of identity theft and fraud as a result of the data breach.
The lawsuit alleges negligence, unjust enrichment, and invasion of privacy and seeks class action status, a jury trial, damages, legal costs, and injunctive relief, including 16 requirements for Rise to improve security to prevent further cyberattacks and data breaches.
