Biotech Firm Settles Class Action Over Ransomware Attack for $7.5 Million

Enzo Biochem, a prominent biotechnology company, has agreed to settle a class action lawsuit for $7.5 million following a ransomware attack that compromised the personal and medical information of nearly 2.5 million individuals.

The company disclosed the settlement in a filing to the U.S. Securities and Exchange Commission on Wednesday, stating it would resolve all claims related to the attack. The breach, which occurred in April 2023, exposed names, diagnostic test details, and over 600,000 Social Security numbers.

The attack, which was detected on April 11, 2023, involved unauthorised access to Enzo’s clinical test data. Despite the breach, the company was able to maintain its operations. However, the exposure of sensitive personal information led to legal action.

As part of the settlement, Enzo Biochem has committed to implementing enhanced data security measures. This follows a previous $4.5 million settlement with three state governments in connection to the same incident.

An investigation led by New York’s Office of the Attorney General revealed that the attackers gained access to the company’s network using employee login credentials—one of which had not been updated in over a decade. Additionally, Enzo failed to use multi-factor authentication for remote email access, which heightened its vulnerability.

The settlement underscores the growing concern over ransomware attacks in the healthcare sector. Enzo Biochem had warned investors in 2023 of potential financial penalties from regulatory bodies, highlighting the increasing scrutiny faced by healthcare organisations dealing with data breaches.