Vasindas’ Around the Clock Care, Inc. has finalized its class action litigation settlement terms related to a January 2024 targeted cyberattack incident that compromised personal data and protected health information (PHI).
Cyberattack and Unauthorized Network Access
HIPAA-covered home care services provider, Vasindas’ Around the Clock Care, Inc. in California, identified suspicious activity with its computer systems on or about June 18, 2024. It launched an investigation and confirmed that the unauthorized third-party access occurred on January 30, 2024. The hacker had access to the system for more or less five months. In that period of time, the hacker copied files that included personal data and PHI that belong to clients, staff, and patients.
The breached data included names, driver’s license numbers, Social Security numbers, and state ID numbers, financial account details, medical data, and medical insurance details. The breach report sent to the HHS’ Office for Civil Rights indicated that the breach affected 3,785 individuals. Vasindas’ Around the Clock Care sent notifications to the affected individuals on August 16, 2024.
The healthcare provider saw its first class action lawsuit filed on August 27, 2024. The lawsuit claimed that the incident involved a ransomware attack, which could have been avoided if proper cybersecurity measures were enforced.
The lawsuit likewise claimed that the defendant did not implement basic cybersecurity measures and that it did not adequately monitor network activity since the unauthorized access was not noticed for almost five months.
Another class action lawsuit was later filed, which was consolidated with the first. Nelson et al. v. Vasindas’ Around the Clock Care, Inc. lawsuit was filed in the Superior Court for Kern County, California.
The parties opted for an early resolution of the lawsuit. Mediation did not result in an agreement, however, the parties eventually consented to a settlement.
Settlement Terms
The court already approved the finalized settlement terms. The defendant didn’t acknowledge wrongdoing or liability as per the settlement. Vasindas’ Around the Clock Care, Inc. still refutes the allegations and claims stated in the lawsuit. The company moreover stated that the plaintiffs did not experience damages as a result of the data incident.
The settlement states that the defendant will cover attorneys’ fees and expenses, settlement management fees, and the class representatives’ service awards.
Class members can avail medical data monitoring services for two years. They could also choose from two payment options. Option one is compensation up to $2,500 for documented, unreimbursed losses related to the data breach. Option two is a cash payment of $70.
The last day to file objections or opt out of the settlement is October 26, 2026. Claims must be submitted on or before November 23, 2026. The final fairness hearing is scheduled for December 3, 2026.
