Charleston Area Medical Center $1M Settlement for 2024 Email Phishing Data Breach

In October 2024 an email phishing attack on Charleston Area Medical Center (CAMC) allegedly exposed personal, medical and financial data for more than 67,000 people; a class action claimed CAMC failed to adequately safeguard that information and the parties agreed to a $1 million settlement. Under the deal, class members who received notice may claim up to $6,080 (combining documented out‑of‑pocket losses and up to four hours’ time) or receive a pro rata cash share, plus four years of identity‑theft monitoring — while CAMC denies liability it settled to avoid the expense and uncertainty of continued litigation. The suit’s significance lies in the direct financial relief for victims and the message it sends about the exposure risk and legal costs hospitals face after phishing incidents. The CAMC settlement fits a broader pattern of healthcare cyberclaims and regulatory scrutiny: high-profile incidents at other health systems have produced large civil settlements and OCR enforcement actions, and class actions increasingly follow patient‑data breaches. Healthcare entities operate under HIPAA and state breach‑notification laws that require safeguards, timely notices, and risk mitigation; failures to implement basic controls like multi‑factor authentication, email filtering and staff training frequently underlie phishing‑related compromises. For patients and providers alike, the case underscores the persistent threat of social‑engineering attacks, the value of identity monitoring for affected individuals, and the continuing legal and compliance pressures on the healthcare sector.