A ransomware group attacked Lehigh Valley Health Network in 2023, stealing patient treatment photos and medical information and posting some images publicly. Patients later received a $65 million civil settlement, and HHS has now settled its own federal investigation into the breach. Affected patients should monitor credit reports, insurance statements, and watch for phishing attempts referencing their medical care.
| Company | Lehigh Valley Health Network |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Patient Photographs, Medical and Treatment Information |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Lehigh Valley Health Network Data Breach?
Lehigh Valley Health Network, a major hospital system, suffered a ransomware attack in 2023 that led to one of the most troubling healthcare breaches in recent memory. A ransomware group infiltrated the network’s systems and stole sensitive files before attempting to extort the organization. When the health system refused to pay, the attackers escalated their tactics dramatically.
The group behind the attack posted nude photographs of cancer patients on its dark web leak site. These images had reportedly been taken as part of radiation oncology treatment records. This unusual and deeply personal method of pressure drew national attention to the case and highlighted how far some extortion groups will go.
The incident prompted a federal investigation by the Department of Health and Human Services’ Office for Civil Rights, the agency that enforces HIPAA compliance. As a result, that investigation concluded with a formal settlement in 2026. The settlement addressed the health network’s security practices at the time of the breach and required corrective action going forward.
Separately, the health system also faced civil litigation from affected patients. In 2024, those patients reached a $65 million settlement to resolve claims tied to the breach. Together, these two resolutions show the scale of harm regulators and courts recognized in this case.
Who was affected?
The breach affected patients of Lehigh Valley Health Network, including individuals who received cancer treatment through the system’s radiation oncology program. Because the attackers specifically targeted and released treatment-related photos, this incident caused a uniquely invasive harm beyond typical data theft.
The exact number of affected individuals has not been publicly disclosed in connection with the federal settlement. However, the scale of the civil settlement suggests a substantial patient population was affected. Given that hospital networks serve patients across a wide age range, it is likely that both adults and vulnerable patients, including those undergoing serious medical treatment, were among those affected.
Because this was a healthcare network, the affected population is almost entirely made up of patients rather than employees. This distinction matters because patients did not choose to do business with a company in the way a retail customer might. Instead, they were seeking medical care and had little choice but to trust the network with deeply personal information.
What Information Was Potentially Exposed?
The breach exposed specific categories of sensitive information tied to patient care. Based on what has been publicly reported, the following information was involved in this incident.
- Patient photographs related to cancer treatment
- Medical and treatment information
This type of exposure creates risks that go beyond standard identity theft concerns. For example, the release of treatment photographs represents a severe invasion of medical privacy that cannot be undone once images are posted publicly. Patients in this situation may experience lasting emotional distress, in addition to any practical fraud risk.
In addition, medical information tied to a cancer diagnosis could be misused in targeted scams. Fraudsters sometimes use real medical details to craft convincing phishing messages or insurance fraud schemes. Because the exposed content included both images and treatment records, affected patients face a combination of emotional and practical harms that typical data breaches do not involve.
What is the company doing?
Following the attack, Lehigh Valley Health Network cooperated with the federal investigation into its security practices. As part of resolving the matter, the health system reached a settlement with the Department of Health and Human Services’ Office for Civil Rights. This settlement required the organization to address the compliance issues identified during the investigation.
The health network also filed formal notification with the HHS Office for Civil Rights regarding this breach, consistent with federal reporting requirements for healthcare organizations. This filing is part of the broader enforcement record now associated with the incident.
Beyond the regulatory settlement, the health network previously resolved civil claims from patients through a $65 million settlement in 2024. That resolution addressed compensation for patients harmed by the breach. Together, these actions represent the organization’s documented response to both the regulatory and civil dimensions of this case.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected patients should check their credit reports regularly for any unfamiliar accounts or inquiries. Even when financial information is not the primary concern, identity thieves sometimes combine stolen medical details with other data to open fraudulent accounts.
You can request free credit reports from each of the three major credit bureaus. Reviewing these reports every few months makes it easier to catch suspicious activity early. If you notice anything unusual, report it immediately to the credit bureau and consider placing a fraud alert.
Watch for Health Insurance and Medical Fraud
Because this breach involved medical treatment information, patients should carefully review any insurance statements they receive. Fraudsters can sometimes use stolen medical details to submit false insurance claims or obtain medical services under someone else’s identity.
If you notice unfamiliar charges or services listed on an insurance explanation of benefits, contact your insurer right away. This step helps limit the financial damage and corrects your medical record before errors cause further harm.
Stay Alert for Phishing Attempts
Scammers often use breach events as an opportunity to send convincing phishing emails or text messages. Because this breach involved emotionally sensitive medical content, affected patients could be targeted with messages referencing their treatment history.
As a result, you should avoid clicking links or sharing information in response to unexpected messages, even if they appear to reference your medical care. Instead, contact your healthcare provider directly through a known phone number to confirm any request.
Consider Consulting a Data Breach Attorney
Given the severity of this breach, affected patients may still have options for seeking accountability or compensation. A data breach attorney can review your individual circumstances and explain whether you may be eligible for relief tied to this incident.
Because settlement terms and deadlines can vary, speaking with an attorney promptly is often the best way to understand your options. Many offer free case evaluations, which makes this a low-risk first step for concerned patients.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.