Class-action complaint filed against Palomar Health Medical Group amid ‘security breach’ allegations

ESCONDIDO, Calif. (FOX 5/KUSI) — Online system disruptions with Palomar Health Medical Group or PHMG have been ongoing for nearly two months and its users are fighting back. Now, FOX 5/KUSI have obtained a class-action complaint against the provider – claiming negligence and failure to maintain cybersecurity.

“It’s just unbelievable how much anxiety this has created for me,” shared PHMG user John Tucker of Encinitas. For nearly 60 days and counting, Tucker has lost simple access to health care.

Our crews first met Tucker this June after Gray Bill Medical, also known as Palomar Health Medical Group’s phone and online system, went dark following “suspicious activity,” according to the provider.

“Nothing has changed, at all,” Tucker said. “…Still can’t get prescriptions without going into the office, and then it takes three to five days to process it.”

It’s a reality Tucker says is adding to his ongoing burden amid his fight against cancer and his wife’s struggles with multiple sclerosis.

“My wife is like, we should just file a lawsuit because she’s had to go to the hospital, to get her catheter changed,” he said.

While Tucker hasn’t filed yet, FOX 5/KUSI has since obtained a class-action complaint filed against PHMG at the end of June with the San Diego Superior Court. The suit alleges negligence and failure to implement and maintain reasonable cybersecurity measures.

“They’re playing chess, and we’re playing checkers,” said cybersecurity and ethical hacker Steven McKeon, who is the CEO of MacguverTech.

McKeon suggests medical groups are easy prey for hackers who can then sell the most precious of personal data on the dark web for a nice profit.

“These systems are not able to defend themselves against the more sophisticated hackers using AI and more of the newer tools – so that’s why a lot of these hospital systems have been hacked because it’s an easy target,” McKeon said.

The complaint goes on to suggest the plaintiff and others have suffered harm, alleging personal information exposed to criminals has increased stress and fear of identity theft or fraud.

“Quality medical care relies on the information we share with our medical provider – the most sensitive information – But even if you don’t have concrete evidence that your confidential information has been compromised, there’s that anticipatory trauma that it could be,” FOX 5 and KUSI legal analyst Wendy Patrick explained.

As far as Tucker, not only worries about his family’s dire care, the burden of the unknown state of his privacy looms.

“My social security, what can you do with that? Everything. My birthday and social security, you can do even more, my personal records? Now you know everything about me,” Tucker said.

On Wednesday, Palomar Health Medical Group responded to FOX 5/KUSI in a statement saying that their “investigation is ongoing, and, at this time, it is not able to determine the specific individuals and information that may have been impacted.”

“It will provide more information as its investigation continues, but in interim is sharing the information known with all its patients,” the medical group said.

Palomar Health revealed in the statement that “an unauthorized actor gained access to certain files within PHMG’s network from April 23, 2024, to May 5, 2024, and may have copied those files,” causing “certain files to become unrecoverable.”

The medical group added that it is “continuing its efforts to restore all files and identify the specific individuals and information that may have been impacted so it can provide individualized notice with additional information when its investigation is complete.”

Palomar Health also advises patients to remain vigilant against identity theft and fraud by reviewing account statements and explanation of benefits and monitoring credit reports for unauthorized or suspicious activity.

For the latest news, weather, sports, and streaming video, head to FOX 5 San Diego & KUSI News.