Sutter Health and Welltok Under Investigation for Data Breach of 845,000 Patient Records

Schubert Jonckheer & Kolbe LLP is investigating a data breach impacting the sensitive personal and health information of 845,000 patients of Sutter Health, a California-based healthcare provider.

According to the company, Sutter Health provided sensitive patient information to Welltok, Inc., a third-party contact-management company. Welltok then used a third-party file transfer program called MOVEit, which attackers exploited using a security vulnerability reportedly present in software versions dating back to 2021. On May 30, 2023, hackers accessed Welltok’s systems and stole the private personal and health information of Sutter Health’s customers.

The company recently informed patients that the following personal and health information may have been stolen in the breach: names, dates of birth, health insurance information, provider names, treatment cost information, and treatment information and diagnoses.

Although the breach occurred over five months ago, Welltok, on behalf of Sutter Health, only began notifying impacted patients on or around October 31, 2023, which may have violated state and federal laws.

If your personal information was impacted by this incident, you may be at risk of identity theft and other serious violations of your privacy. As a result, you may be entitled to money damages of $1,000 per violation and an injunction requiring changes to Sutter Health’s security practices.

If you received notification of this data breach or are a patient of Sutter Health and wish to obtain additional information about your legal rights, please complete the form below for a free legal consultation.