Court order merges Acadian Ambulance class actions over data breach

LAFAYETTE, La. (KLFY) — Eight class actions against Acadian Ambulance over a June data breach have been consolidated, according to court records.

On Wednesday, U.S. Magistrate Judge Carol B. Whitehurst granted a request made by the lead plaintiffs to join their separate suits for the sake of simplicity and efficiency. That request was made in a motion Tuesday, saying consolidation is appropriate because their individual suits arise out of the same incident and assert similar claims for relief.

Any new case stemming from the June data breach will be directed to join the consolidated action, according to the order.

The council for the lead plaintiffs did not immediately respond to a request for comment.

View a copy of the order below. The story continues beneath the embedded document.

Acadian Ambulance Consolida… by eenfinger

The individual lawsuits started popping up less than two weeks after the medical transport company announced that protected patient health information was accessed by a hacker earlier this year.

The federal suits, lodged by both patients and former employees of the company, allege that cybercriminal organization Daixin Team managed to access patient information such as full names, social security numbers, dates of birth, and medical and treatment information.

According to the lawsuits, the hackers demanded Acadian Ambulance pay a $7 million ransom for the return of the stolen information. The ambulance company refused the ransom demand and instead offered to pay $173,000, which the hackers rejected, the lawsuits said.

Acadian Ambulance previously told KLFY News 10 that the data breach is part of a “growing trend of data security incidents that have affected numerous large companies, including prominent technology and healthcare firms.”

Acadian Ambulance said its IT department observed unexpected activity within its network that “disrupted the operability of certain computer systems.” The company responded quickly to maintain security of its systems and make sure there was no disruption of patient care, the company said.

“Acadian quickly resumed normal business operations, notified federal law enforcement, and will comply with all necessary legal requirements,” Acadian Ambulance said in the statement.

The transport company said it continues to work with third-party specialists to investigate the nature and scope of the data breach.

“Despite claims made by the perpetrators of this cyber attack, we believe the number of affected persons is much less than reported, and private employee data, such as full social security numbers, were not compromised,” Acadian Ambulance said in the statement.

According to its website, Acadian Ambulance provides service to more than 21 million residents across Louisiana, Mississippi, Tennessee and Texas.