A Georgia Supreme Court ruling from Dec. 23 will allow three former patients of Athens Orthopedic Clinic to pursue a lawsuit following a 2016 computer hack of AOC’s patient information, according to a Supreme Court of Georgia opinion.
The data breach was led by the hacker group, “Dark Overlord,” which stole Social Security numbers, addresses, birthdates and health insurance details of at least 200,000 current and former patients of the clinic, according to the opinion.
The hacker group offered some of this data on the “dark web” while also releasing stolen information on the website Pastebin.
According to the opinion, the clinic reportedly refused to pay ransom to the hacker group.
Following the hack, Christine Collins, Paulette Moreland and Kathryn Strickland, who had personal information leaked in the hack, sued the clinic through Athens-Clarke County Superior Court. The plaintiffs asserted claims of negligence, breach of implied contract and unjust enrichment, the Georgia Supreme Court opinion states. The three also claimed that the clinic violated the Georgia Uniform Deceptive Trade Practices Act, which classifies false advertisement as a misdemeanor.
Additionally, Collins alleged that fraudulent charges were made to her credit card shortly following the breach. Each plaintiff claims that she “spent time calling a credit reporting agency and placing a fraud or credit alert on her credit report to try to contain the impact of the data breach and anticipates having to spend more time and money in the future on similar activities,” according to the opinion.
The plaintiffs asked the ACC Superior Court to classify their lawsuit as a class action, which is a civil suit in which one or more members of a group represent the group as a whole. The court dismissed the case in June 2017.
An appeal made through the Georgia Court of Appeals yielded the same result, and the Georgia Supreme Court began hearing case arguments last August.
According to the court’s decision, the plaintiff’s “allegations raise more than a mere specter of harm” and merit consideration under a suit. The Georgia Supreme Court reversed the decision of the Court of Appeals to dismiss the case — it will now be heard at the ACC Superior Court.
“The honorable thing for AOC would be to reimburse people who incurred such expenses,” said Doug Monroe, a former patient of AOC, in an email. “I hope the lawsuit will compel the clinic to reimburse its patients.”
AOC and the plaintiffs’ lawyers declined to comment on this case.