Enzo Biochem to pay $7.5 million to settle data breach class action lawsuit

Enzo Biochem, a biotechnology company and a pioneer in molecular diagnostics, has agreed to pay $7.5 million to settle a class action lawsuit after facing significant backlash over a data security incident it suffered in 2023 that compromised the sensitive personal information of nearly 2.5 million individuals.

 

In 2023, in a filing with the U.S. Securities and Exchange Commission, Enzo Biochem said that threat actors on April 6 targeted its internal network with a ransomware attack that affected a number of systems.

 

The Company promptly deployed containment measures, including disconnecting its systems from the internet, launched an investigation with assistance from third-party cybersecurity experts, and notified law enforcement about the same.

 

In a separate announcement, Enzo Biochem said that the Social Security numbers of approximately 600,000 individuals were compromised as a result of the incident.

 

New York Attorney General Letitia James, along with Attorney Generals of Connecticut and New Jersey, said that the company failed to adequately safeguard the personal and private health information of its patients and have secured $4.5 million from Enzo Biochem.

 

“The Office of the Attorney General (OAG) found that Enzo had poor data security practices, which led to a ransomware attack that compromised the personal and private information of approximately 2.4 million patients, including more than 1.4 million New York residents.

 

“As a result of today’s agreement, Enzo will pay $4.5 million, of which New York will receive $2.8 million, and will strengthen its data security practices,” reads the announcement.

 

In a recent filing with the U.S. Securities and Exchange Commission, Enzo Biochem said that it has agreed to pay $7.5 million and settle a class action lawsuit filed by affected individuals. This settlement fund “provides for the full and final release of the Company and its subsidiaries from any and all claims.”

 

The company added that it has upgraded its data protection systems as promised to prevent similar incidents in the future.