US medical org pays $50M+ to settle case after crims raided data and threatened to swat cancer patients

A Seattle cancer facility has agreed to fork out around $52.5 million as part of a class action settlement linked to a Thanksgiving 2023 cyberattack where criminals directly threatened cancer patients with swat attacks. The Fred Hutchinson Cancer Center (Fred Hutch) disclosed its November 2023 attack a month later, after it confirmed that criminals had made off with personal and sensitive data, including health insurance information, patients' treatments, diagnoses, lab results, and more. That data was then used by the attackers in question to carry out highly aggressive extortion tactics, which according to the original class action complaint [PDF], allegedly included directly contacting some patients via email and threatening to swat them. The complaint claimed: The cybercriminals sending these emails demand that patients pay them to prevent the sale of that data.... The threatening emails also include specific examples of the personal data stolen and exposed for each individual recipient of the email, including their name, address, patient record number, and medical information. Further still, the emails threatened some recipients that if they did not pay the extortion demand, the hackers would initiate a swatting attack, "which occur[s] when a bogus claim is made to law enforcement so that emergency response officers, like SWAT teams, show up at a person's home. The FBI was called in. Cybercriminals often use pilfered data as a bargaining chip with the organization from w...