LivaNova, a medical device manufacturer headquartered in London with its US operations run through LivaNova USA, disclosed that attackers reached its IT systems on or about October 26, 2023 and retained access until the intrusion was identified on November 19, 2023. The LockBit ransomware group claimed the attack in December 2023 and said it had taken 2.2 terabytes of data.
The company acknowledged the incident in a securities filing in November 2023 and issued a public notice on April 25, 2024 once its review confirmed that personal information had been taken. It reported 129,219 affected individuals to the Maine Attorney General's Office, a figure that was later revised upward to roughly 180,000.
The exposed data included names, postal addresses, telephone numbers, email addresses, dates of birth, Social Security numbers, health insurance details and medical information such as diagnoses, conditions, treatments, prescriptions, physician names, medical record numbers and device serial numbers. LivaNova offered complimentary identity protection and credit monitoring, and recorded about $2.6 million in incident costs in the fourth quarter of 2023.
Notification letters continued into mid-2024, and class action litigation followed in federal court in the Southern District of Texas over the company's handling of the breach.
Updates
The victim count is disputed. LivaNova reported 129,219 individuals to the Maine attorney general, while HIPAA Journal's July 2024 coverage of the resulting class action lawsuits put the number of affected patients at about 180,000.
Sources
- LivaNova USA Discloses Data Breach Impacting 130,000 IndividualsSecurityWeek
- Patient Data Stolen from LivaNova in October 2023 Ransomware AttackHIPAA Journal
- LivaNova gives notice of personal patient data compromised by hackersMedical Device Network
- Southern District of Texas, J.W. v. LivaNova USA, Inc., 4:24-cv-02250 complaintUS District Court