Judge Certifies ‘Contract Class’ in CareFirst Breach Lawsuit

A federal judge has once again breathed life into a proposed class action lawsuit against CareFirst involving a 2014 cyberattack that affected about 1.1 million individuals. The judge ruled to certify a “contract class” of CareFirst customers who can pursue a claim that the health insurer breached its contractual obligations to safeguard their data.

See Also: Embracing Digital Risk Protection: Take Your Threat Intelligence to the Next Level

The ruling on March 29 by U.S. District Court Judge Christopher Cooper of the District of Columbia was the latest in a long series of legal ups and downs in the proposed class action lawsuit – Chantal Attias, et al. vs. CareFirst – first filed in 2015 following a hack on a company database in 2014.

In his decision last week, Cooper ruled he would certify a “contract class” of more than 1 million people who can move forward to pursue a claim that CareFirst breached a contractual obligation to safeguard customers’ data, “even though any recovery would almost certainly be limited to nominal damages.”

The “contract class” is comprised of “all persons” who reside in the District of Columbia, Maryland and Virginia who purchased or possessed health insurance from CareFirst and whose “personally identifiable information, personal health information, sensitive personal information, and/or financial information was breached as a result of the data breach CareFirst announced on May 10, 2015,” Cooper ruled.

“After careful consideration and a hearing on the matter, the court finds that certification of the proposed contract class is warranted,” he said.

“The standing issue that prevented the court from certifying the last go around has since dissolved because, as all sides agree, each member of the proposed class has allegedly suffered a concrete injury based on CareFirst’s supposed breach of its contractual obligation to safeguard its customers’ data – regardless of whether they sustained an additional, tangible injury due to the data breach.

“The court finds that all putative class members have standing to pursue their breach of contract claim – thereby settling the one issue that prevented the court from certifying the proposed class in the previous outing.”

The U.S. District Court for the District of Columbia in 2016 dismissed the proposed class action, saying it found no standing to proceed without concrete, identifiable injury to plaintiffs. But a federal appeals court in 2017 overturned that ruling (see: Appeals Court Allows CareFirst Breach Class Action Lawsuit to Proceed).

In 2018, the U.S. Supreme Court declined CareFirst’s request for review of the case and bounced the suit back to the U.S. District Court to proceed, where it has since faced another series of rulings (see: Supreme Court Won’t Review CareFirst Data Breach Case).

In March 2023, Cooper denied the plaintiffs’ motion to certify three classes – two consumer classes and one contract class of individuals – but left open the possibility for the case to proceed with certain modifications (see: Court Won’t Certify Class Action Lawsuit in CareFirst Hack).

Late last year, Cooper partially granted Washington, D.C. area-based CareFirst’s motion for summary judgment and dismissed claims under both the Maryland and Virginia consumer protection statutes. That led to additional filings by the parties and more court hearings and culminated in Cooper’s most recent ruling last week to certify the contract class.

Attorneys representing CareFirst did not immediately respond to Information Security Media Group’s request for comment on the latest ruling.

Breach Details

Background material included in Cooper’s court ruling says that in April 2014, hackers infiltrated CareFirst’s internal data system by installing a backdoor to the system using a link in an email designed to resemble one from a company employee distributing a software update.

“Although CareFirst initially identified this ‘spear-phishing’ email as a fake and took some precautionary measures to limit any data exposure, one CareFirst employee followed the link provided in the email, downloaded the hackers’ backdoor and unwittingly gave them access to certain of CareFirst’s systems,” the court documents said.

As a result, the hackers accessed CareFirst customer information including names, subscriber ID numbers, birthdates, email addresses and usernames used to log into CareFirst’s online member portal.

“Plaintiffs’ complaint initially alleged that hackers also obtained more sensitive personally identifying information, such as Social Security numbers and credit card numbers, but they later abandoned that unsupported contention,” the court document said.

In May 2015, CareFirst sent breach notification letters to all affected customers and offered them two free years of credit monitoring and identity theft protection.