Banner Health Agrees to $6M Settlement to Resolve 2016 Data Breach Lawsuit

Phoenix-based Banner Health, one of the largest healthcare systems in the U.S., has agreed to pay $6 million to breach victims to resolve a lawsuit stemming from a 2016 cybersecurity incident in which attackers gained unauthorized access to computer systems that process payment card data at food and beverage outlets at certain Banner locations.

That 2016 breach involved cyber attackers targeting payment card data, including cardholder name, card number, expiration date and internal verification code, as the data was being routed through affected payment processing systems.

The investigation at the time initially revealed that the attack did not affect payment card payments used to pay for medical services, but Banner Health later learned that the attackers may have indeed gained unauthorized access to patient information, health plan member and beneficiary information, as well as information about physicians and healthcare providers. How the hack expanded from certain food and beverage outlets to patient information systems has remained somewhat unclear, but ultimately, hackers had access to Banner Health systems for approximately two weeks.

The health system ended up mailing letters to 3.7 million patients, health plan members and beneficiaries, food and beverage customers and physicians and healthcare providers related to the attack, while offering a free one-year membership in monitoring services to those impacted. However, a class-action lawsuit led by an Arizona physician that was filed in August 2016 on behalf of nearly 3 million individuals affected by the data breach noted that the credit monitoring offering was inadequate.