Consumers file multiple class actions over Acadian Ambulance data breach

Acadian Ambulance data breach class action overview: 

• Who: Two Louisiana residents and a Texas man have each filed separate class action lawsuits against Acadian Ambulance. 
• Why: The plaintiffs all allege they were harmed by a June 2024 Acadian data breach. 
• Where: The three lawsuits were all filed in a Louisiana federal court.

Acadian Ambulance has been hit with three new class action lawsuits claiming its negligence led to a major data breach in June that exposed the private information of millions of its current and former patients and staff members.

Two Louisiana residents and a Texas man each filed separate class action complaints against Acadian Ambulance Service Inc. in the first week of August in a Louisiana federal court, alleging negligence and violations of state and federal consumer laws. 

The three lawsuits are the most recent in a string of class actions filed against the Louisiana-based private ambulance service business.

Major June data breach

The lawsuits arise out of a June incident in which a well-known cybercriminal organization called Daixin Team accessed and exfiltrated the personally identifiable information (PII) and protected health information (PHI) of current and former patients and employees of Acadian, the lawsuits say.

Acadian is a private ambulance service that operates throughout Louisiana, Texas, Tennessee, and Mississippi. 

According to the lawsuits, the company failed to implement and maintain reasonable data security measures, essentially allowing the data breach to happen. 

The data stolen included full names, Social Security numbers, dates of birth, medical record numbers, and medical and treatment information.

According to the lawsuits, after the breach, the Daixin Team demanded that Acadian pay a ransom of $7 million for the return of the information it stole.

The plaintiffs claim Acadian refused to pay the ransom, instead offering to pay $173,000, which Daixin Team rejected. 

“As a result, Plaintiff’s, and Class Members’ PII and PHI is at continued risk of being leaked on the dark web,” the Texas plaintiff’s lawsuit says.  

Long Wait To Notify Those Affected

Despite the likelihood that the private information stolen in the data breach will now be used maliciously, Acadian did not start notifying victims of the data breach until July—long after recognizing the risk its patients and staff were facing, the lawsuits say. 

“Although Defendant has reprehensibly chosen to keep many details of the Data Breach secret, the evidence available thus far indicates that it is more likely than not that Defendant failed to implement and maintain reasonable data security measures,” the Texas plaintiff says. 

The lawsuit alleges Acadian did not properly encrypt or redact PII and PHI, retained PII and PHI longer than necessary, and failed to adequately secure user credentials for internet-facing applications on its network.

As a result, they are each seeking to represent classes of all United States residents who were employed by or customers of Acadian whose PII and PHI may have been compromised in the data breach. 

Each of the lawsuits seeks certification of the class action, damages, fees, costs, a jury trial and an order forcing Acadian to improve its cybersecurity practices. 

Meanwhile, multiple class action lawsuits have recently been filed against companies due to data breach incidents. The class action lawsuits argue that companies, including Intuit, Ticketmaster, Live Nation, AT&T and several others failed to adequately safeguard and secure consumers’ data in such a way that would have prevented the data breaches. 

Were you affected by the Acadian data breach? Let us know in the comments. 

The plaintiffs are represented by Milberg Coleman Bryson Phillips Grossman PLLC, Chestnut Cambronne, Kopelowitz Ostrow Ferguson Weiselberg Gilbert and The Consumer Protection Firm PLLC.

The Arcadian data breach class action lawsuits are Benjamin Fontenot v. Acadian Ambulance Service Inc., Case No. 6:24-cv-01045; April Butler v. Acadian Ambulance Service Inc., Case No. 6:24-cv-01044; and Angela Broussard v. Acadian Ambulance Service Inc., Case No. 6:24-cv-01033-DCJ-CBW all in the U.S. District Court for the Western District of Louisiana.

Read About More Class Action Lawsuits & Class Action Settlements:

• HealthEquity class action alleges co. failed to secure customer data
• Delta says outage cost it $500M as CrowdStrike hits back over responsibility
• Neiman Marcus class action claims retailer failed to protect customers from data breach
• AT&T class action claims data breach affected others using network