You’re not paranoid: lawyers ARE coming to get you.

A March 2022 ransomware attack on ambulance billing vendor Comstar, LLC encrypted network servers and affected protected health information for roughly 585,621 patients linked to 70+ healthcare entities. HHS OCR settled for $75,000 with a corrective action plan, while Connecticut and Massachusetts AGs reached a $515,000 settlement requiring controls such as MFA, vulnerability management, asset inventory, IDPS, SIEM, endpoint security, and annual security assessments; related federal class actions were consolidated and dismissed without prejudice after a confidential settlement, underscoring the need for thorough risk analysis and stronger access/storage controls.