AlphV/BlackCat ransomware: Lehigh Valley Health Network — HHS OCR settles ransomware breach investigation after patient photos leaked
Severity: high · Patch status: no-fix-needed · Since 2026-11-02
HHS Office for Civil Rights has settled its ransomware investigation of Lehigh Valley Health Network, stemming from the 2023 AlphV (BlackCat) ransomware attack. The attackers exfiltrated and encrypted data and crossed a line by posting nude photographs of patients on their leak site, drawing wide public attention. Patients filed civil litigation, settling for $65 million in 2024. The HHS settlement resolves OCR charges related to the health system's handling of the breach under HIPAA. Affected are patients whose data and images were compromised in the 2023 incident. No technical fix applies; remediation is regulatory and legal, with the resolution now public as of 2026-11-02.
What to do
- Review OCR settlement terms and apply equivalent HIPAA security controls to your own ransomware resilience program
- Ensure incident response plans cover extortion/leak-site scenarios including sensitive imagery
- Verify encryption, segmentation, and tested offline backups against ransomware exfiltration
- Confirm breach notification and patient-support procedures meet OCR expectations
Sources
All live incidents on Threat Watch
