A Pennsylvania-based nonprofit, Drug and Alcohol Treatment Services, Inc. (DATS), is facing multiple class action lawsuits following an October 2024 ransomware attack that compromised the protected health information (PHI) of 22,215 individuals. The breach, attributed to the Interlock ransomware group, allowed unauthorized access to sensitive data including names, birth dates, medical and treatment history, health insurance details, Social Security numbers, and financial information. The attackers reportedly stole 150 GB of data, which was later published online after the organization refused to pay the ransom.

Although DATS confirmed the breach in December 2024, affected individuals were not notified until May 2, 2025, nearly seven months later. This delay, along with allegations of inadequate security practices, has led to at least eight class action lawsuits. The legal complaints allege negligence, breach of confidence, invasion of privacy, and other claims, arguing that the breach was preventable had DATS implemented industry-standard cybersecurity measures. Plaintiffs are seeking damages, legal cost reimbursement, and a court order mandating stronger security protocols.

This incident underscores the critical importance of having full visibility into your network and infrastructure. Without comprehensive oversight and robust cybersecurity measures in place, organizations risk not only devastating data breaches but also costly lawsuits and long-term reputational harm. Proactive monitoring, timely threat detection, and forensic readiness are no longer optional — they are essential pillars of responsible data stewardship. Read more about this story on our LinkedIn page