Fred Hutchinson Cancer Center settles data breach lawsuit for $11.5 million

Fred Hutchinson Cancer Center and the University of Washington have agreed to a $11.5 million settlement to resolve a proposed class action lawsuit stemming from a significant data breach that exposed the personal and medical information of approximately 2.1 million individuals. In addition to the monetary settlement, the institutions have committed to investing $13.5 million in cybersecurity enhancements over the next three years.

The data breach, attributed to the Hunters International threat group, occurred between November 10 and November 25, 2023, and was discovered following the Thanksgiving weekend. Hackers infiltrated the network and accessed sensitive data, including names, contact details, medical information, and Social Security numbers. The attackers initially demanded a ransom from Fred Hutchinson Cancer Center, and when the payment was not made, they sent direct ransom demands to affected individuals, threatening to publish their data unless they paid $50 for its deletion.

In response, multiple lawsuits were filed against Fred Hutchinson Cancer Center and the University of Washington. These suits were consolidated into a single case, In re: Fred Hutchinson Cancer Center Data Breach Litigation, in the Superior Court for the State of Washington in King County. The lawsuit accused the defendants of negligence in failing to implement adequate security measures, breach of implied contract, unjust enrichment, and violations of the Washington Consumer Protection Act.

Despite denying any wrongdoing or liability, Fred Hutchinson Cancer Center and the University of Washington opted to settle the lawsuit to mitigate the risks and costs associated with prolonged litigation. Under the terms of the settlement, class members may submit claims for up to $5,000 to cover documented out-of-pocket expenses related to fraud or identity theft resulting from the breach. Additionally, class members are eligible for two years of credit monitoring and identity theft protection services, along with a pro rata cash payment of $599.

As part of their commitment to enhanced cybersecurity, Fred Hutchinson Cancer Center will implement additional security measures valued at no less than $13.5 million. The court has granted preliminary approval of the settlement, with a final fairness hearing scheduled for May 20, 2025. Affected individuals have until April 7, 2025, to object to or opt out of the settlement, and claims must be submitted by May 7, 2025.