Enzo Biochem Security Incident

Healthcare , Industry Specific , Litigation Biotech Firm to Pay $7.5M to Settle Lawsuit in 2023 Hack Enzo Biochem Previously Paid Three States $4.5M in Fines for Same Breach Marianne Kolbasuk McGee ( HealthInfoSec ) January 17, 2025 Credit Eligible Get Permission Image: Enzo Biochem Biotech firm Enzo Biochem has agreed to pay $7.5 million to settle a consolidated proposed class action lawsuit involving a 2023 ransomware attack affecting 2.5 million people. The company has already paid $4.5 million in fines to three state attorneys general for the same incident. See Also: On Demand | From Patch to Prevention: Modernizing Remediation Across Hybrid Environments Under the settlement, class members may submit a claim for a payment of up to $10,000 for reimbursement of documented out-of-pocket expenses and losses. Class members can also instead choose a cash payment that will be based on pro-rated amount from the settlement fund once all claims are received and evaluated. Class members will also be offered two years of healthcare data and credit monitoring services. The proposed settlement, which is subject to approval by a New York federal court, also requires Enzo Biochem to make certain upgrades to its data protection systems, "which have been made," the company said in a Jan. 13 U.S. Securities and Exchange Commission filing. The proposed settlement document shows that the security improvements Enzo Biochem agreed to implement include: Multi-factor authentication for all individual user accounts, including system administrator accounts, and remote access to its network; Policies and procedures requiring strong, complex passwords that are rotated; Encryption of consumer personal information that's collected, stored, transmitted and maintained; Intrusion detection and prevention systems designed to detect and prevent unauthorized access to its IT environment. States' Findings Under the settlement signed last year...

... (truncated for display)