Managing Partner
NEW YORK, NY – [March 12, 2025] – Woods Lonergan PLLC, a leading complex litigation firm, including class action lawsuits and data privacy litigation, is actively investigating a potential class action lawsuit against Community Care Alliance (CCA), a Rhode Island-based human services agency, following a major data breach that exposed the personal and protected health information (PHI) of approximately 115,000 individuals. The breach potentially compromised a wide range of highly sensitive data, including:
- Full Names
- Addresses
- Dates of Birth
- Driver’s License Numbers
- Social Security Numbers (SSNs)
- Medical Diagnoses and Conditions
- Laboratory Results
- Medication Information
- Patient ID Numbers
- Health Insurance Information
- Provider Names
- Treatment Information
If you or a family member received a data breach notification letter from Community Care Alliance concerning the recent cyberattack, your personal and medical information may be at risk. Contact Woods Lonergan PLLC, a leading firm in data breach litigation, to discuss your legal options. Call Woods Lonergan PLLC today at 212-684-2500 to speak with our Data Breach Litigation Team today.
Details of the Community Care Alliance Data Breach and Alleged Negligence
Community Care Alliance, located in Woonsocket, Rhode Island, with offices in Providence, Rhode Island and throughout Rhode Island provides a wide range of critical services, including mental health and addiction treatment, basic needs assistance (food, utilities,housing), and support for child and family well-being, including crisis intervention services. (https://www.communitycareri.org/programsservices/serviceslookup.aspx). Despite its vital role in the community and its responsibility to protect highly sensitive client data, CCA experienced a significant security failure.
The timeline of the breach raises serious concerns about potential negligence:
- Community Care Alliance Breach Start Date: July 1, 2024
- Community Care Alliance Breach End Date: July 5, 2024
- Community Care Alliance Breach Discovery Date: July 6, 2024
- Community Care Alliance Investigation Completion Date: January 8, 2025
The extended period between the breach discovery (July 6, 2024) and the completion of the internal investigation (January 8, 2025) raises questions relating to the expediency of Community Care Alliance’s security measures and incident response procedures. Further, many state data breach notification laws require notification within specific time periods of 30-45 days, and without unreasonable delay.
The Rhysida ransomware group claimed responsibility for the attack, adding Community Care Alliance to its data leak site. Rhysida claimed to have exfiltrated a 2.5 terabyte SQL database containing highly sensitive information, including names, contact information, and Social Security numbers.
Crisis Patient Care Exposed by the Community Care Alliance Data Breach:
- Mental Health and Addiction Treatment
- Social Services
- Family and Child Services
- Basic Needs Assistance (Housing, financial)
- Behavioral Health
Potential Impact on Victims of the Community Care Alliance Data Breach
The Community Care Alliance data breach places approximately 115,000 individuals at significant risk of:
- Medical Identity Theft: Stolen PHI can be used to obtain medical services, prescriptions, or equipment fraudulently, leading to inaccurate medical records and financial burdens for victims.
- Financial Identity Theft: Stolen SSNs and other PII can be used to open fraudulent accounts, apply for loans, and commit other forms of financial fraud.
- Targeted Phishing Attacks: The detailed personal and medical information makes victims highly susceptible to sophisticated phishing and social engineering attacks.
- Privacy Violations and Potential Blackmail: The exposure of highly sensitive medical information, mental health records, and details about personal circumstances can lead to severe privacy violations and even potential blackmail.
- Emotional Distress and Anxiety: The breach of such personal and private information, particularly given the vulnerable population served by CCA, can cause significant emotional distress, anxiety, and a loss of trust.
Legal Claims in the Community Care Alliance Data Breach:
Woods Lonergan PLLC’s Data Breach attorneys are focused on potential violations of:
- HIPAA (Health Insurance Portability and Accountability Act): As a provider of healthcare and social services, Community Care Alliance has a legal obligation to protect patient and client PHI under HIPAA.
- State Data Breach Notification Laws: Violations of relevant state laws (Rhode Island, and potentially other states where affected individuals reside) requiring timely notification and adequate data security measures.
- Negligence: CCA’s failure to adequately protect sensitive data, its failure to detect the breach promptly, and its potentially inadequate response to the breach, including the significant delay in notification.
- Breach of Contract: Potential breach of implied or express contracts with clients to protect their confidential information.
- Other Potential Claims: Depending on the specific circumstances and applicable state laws, additional claims may be possible.
“The delay in notification, along with the confirmed involvement of the Rhysida ransomware group and the potential exposure of highly sensitive data on the dark web, raises serious concerns. Community Care Alliance serves a vulnerable population, and the breach of this trust is deeply troubling. Woods Lonergan PLLC is committed to holding CCA accountable and securing just compensation for those harmed.” – Jim Woods, Managing Partner, Woods Lonergan PLLC
Contact our Data Breach Litigation Team
If you or a family member received a data breach notification letter from Community Care Alliance in Rhode Island concerning the recent cyberattack, your personal and medical information may be at risk. Call our Law Offices at (212)684-2500 to understand your legal rights.
About Woods Lonergan PLLC
Woods Lonergan PLLC is a leading New York-based litigation firm specializing in class action lawsuits and data privacy litigation. With over 30 years of experience, our firm is a leader in complex litigation and trial law in the New York Metro Area, collaborating with co-counsel throughout the United States.
Our firm is currently representing plaintiffs in the 23andMe data Breach Lawsuit, wherein a proposed settlement of $30 million dollars is pending approval in the U.S. District Court for the Northern District of California. Woods Lonergan has a proven track record of successfully holding large corporations accountable for failing to protect highly sensitive consumer data.
Contact Woods Lonergan PLLC, a leading firm in data breach litigation, to discuss your legal options. Please call Woods Lonergan PLLC at 212-684-2500 to speak with our Data Breach Litigation Team today.
Citations