Lehigh Valley Health Network: the acquisition that let BlackCat into a cancer ward's cameras
The ransomware didn't hit LVHN's own network first. It hit the systems of an oncology practice the health network had acquired two years earlier — and when LVHN refused to pay, BlackCat didn't publish spreadsheets. It published photos of breast-cancer patients mid-treatment, disrobed, taken inside a radiation oncology suite.
Background
Lehigh Valley Health Network (LVHN) is a large Pennsylvania health system. In 2021, it acquired Delta Medix, an oncology practice group in Lackawanna County — the kind of bolt-on acquisition health systems make constantly, folding a smaller practice's patients, staff and IT systems into a larger network. In February 2023, the BlackCat (ALPHV) ransomware group got in through Delta Medix's systems, not LVHN's core network. Two years is a long time for an acquired environment to still be running as its own island, security-wise — and that's exactly where this started.
From an acquired practice's systems to a $65.8 million combined settlement
What actually happened
In February 2023, LVHN disclosed it had been hit by BlackCat (also known as ALPHV) ransomware. The intrusion reached IT systems belonging to Delta Medix, the oncology practice LVHN had acquired in 2021 — not the health network's broader core network. LVHN's CEO publicly confirmed the attack and stated the organization would not pay the ransom BlackCat demanded.
BlackCat responded the way double-extortion ransomware groups do when a victim refuses: it published stolen data on its dark-web leak site. What it published went well beyond the usual breach fare of names and Social Security numbers. Among the files were photographs — including images of breast-cancer patients, disrobed from the waist up, taken during radiation oncology treatment at a Delta Medix facility — alongside passport images and patient intake questionnaires containing personal information.
That specific category of leaked material is why this case drew sustained press attention and, eventually, patient lawsuits that went well past the standard identity-theft framing most breach litigation uses. A stolen Social Security number is a financial risk. A published photograph of yourself, undressed, taken during cancer treatment, is a different kind of harm entirely — and the subsequent class-action complaint treated it that way, with a dedicated, higher-relief tier specifically for patients whose clinical images were posted.
Two distinct legal processes followed, on different timelines, and they shouldn't be conflated. A consolidated class action brought by affected patients settled for $65 million, covering roughly 134,000 patients, with tiered compensation — the highest tier reserved for the patients whose clinical images were the ones actually published. Separately, the Department of Health and Human Services' Office for Civil Rights (OCR) investigated LVHN's HIPAA compliance and, on October 29, 2026, announced an $800,000 settlement with a three-year corrective action plan — OCR's 22nd ransomware-related enforcement action to date, part of a sustained campaign of ransomware enforcement actions it ran through 2026.
Root cause
- BlackCat (ALPHV) ransomware compromised IT systems belonging to Delta Medix, an oncology practice LVHN had acquired in 2021, in February 2023 — the intrusion point was the acquired practice's environment, not LVHN's core network.
- LVHN publicly confirmed the attack and refused to pay the ransom BlackCat demanded.
- BlackCat published stolen data to its leak site after the refusal, including clinical photographs of cancer patients (some disrobed) taken during radiation oncology treatment, along with passport images and patient questionnaires.
- OCR's investigation found LVHN had failed to conduct an accurate and thorough risk analysis to identify risks and vulnerabilities to electronic protected health information — the HIPAA Security Rule's foundational requirement — among findings spanning both the Security Rule and the Breach Notification Rule.
- The exact technical initial-access method into Delta Medix's systems — phishing, an exploited vulnerability, compromised credentials, or something else — has not been publicly documented in any source reviewed for this case study. This is a genuine, acknowledged gap in the public record, not a detail being glossed over.
- One secondary source references a February 2026 intrusion date and a May 2026 OCR notification, which directly conflicts with the far better-corroborated February 2023 attack date reported consistently across primary news coverage at the time. That later date is treated here as likely confusion with a separate administrative or amended filing, not as the actual intrusion date — this case study uses the 2023 date as confirmed.
Timeline
Detection
LVHN disclosed the attack publicly in February–March 2023, with its CEO confirming the BlackCat intrusion; public sources don't specify the internal technical signal that first surfaced the compromise, only that it was identified and disclosed within the same window the ransomware activity occurred.
Not disclosed with precision. The intrusion is dated to February 2023, and LVHN's public disclosure and refusal to pay followed within the same month, suggesting a relatively fast internal-to-public timeline once detected — but the gap between initial compromise of Delta Medix's systems and internal detection itself has not been stated.
- Delta Medix had been acquired two years earlier, in 2021, and whether its IT environment had been folded into LVHN's broader security program and monitoring by the time of the attack has not been publicly detailed — but the fact that this is specifically where the intrusion landed is itself suggestive of a monitoring gap.
- OCR's investigation found LVHN had not conducted an accurate and thorough risk analysis to identify risks and vulnerabilities to electronic protected health information — meaning the organization could not have systematically known where a gap like this existed, by the regulator's own finding.
What to monitor for in your own environment
Ransomware-characteristic file encryption or mass file-modification activity on systems belonging to a recently acquired entity
Endpoint/file-integrity monitoring extended specifically to acquired-entity environments, not just the core networkA security risk analysis identifying an acquired entity's environment as not yet integrated into the parent organization's monitoring and controls
HIPAA Security Rule risk analysis process, applied per-entity rather than organization-wide onlyUnusual, large-volume access to or export of clinical imagery or similarly sensitive data categories
Access and audit logging on clinical-imaging systems specificallyContainment, eradication & recovery
Containment
Feb–Mar 2023- LVHN publicly confirmed the BlackCat attack and stated the organization would not pay the ransom demanded.
- Public sources don't detail the specific technical containment steps taken on Delta Medix's compromised systems (isolation, credential revocation); this case study does not assume what was done beyond the confirmed public disclosure and no-ransom decision.
Eradication
Not detailed in public disclosure- Sources reviewed for this case study don't itemize specific remediation of the Delta Medix environment itself (rebuilding systems, security hardening) separate from the later, broader risk-analysis commitment made under the OCR corrective action plan.
Recovery
2023 – Oct 2026- BlackCat published stolen data, including clinical photographs, passport images and patient questionnaires, after LVHN's refusal to pay.
- A consolidated class action settled for $65 million covering roughly 134,000 patients, with a dedicated higher-compensation tier for patients whose clinical images were published.
- HHS OCR settled separately for $800,000 with a three-year corrective action plan, announced October 29, 2026, requiring LVHN to conduct a proper risk analysis, build a risk management plan from it, and revise its Security and Breach Notification Rule policies.
Security control analysis
OCR's core finding: LVHN had not conducted an accurate and thorough risk analysis to identify risks and vulnerabilities to ePHI. This is the single most common finding across OCR's ransomware enforcement actions generally, and it was true here too.
Delta Medix was acquired in 2021, two years before the 2023 attack. Whether its IT environment had been folded into LVHN's broader security program and monitoring by then, or was still operating as a separate, less-scrutinized environment, has not been publicly detailed — but the fact that this is where the intrusion landed is itself suggestive.
LVHN's CEO stated publicly that the organization would not pay. That's a clear, accountable decision stated in the open, consistent with how other refused-ransom cases in this series have been handled.
Clinical photographs — an unusually sensitive data category even within a healthcare breach — were exposed and published. Whatever access controls or data-handling practices existed around this category of imagery didn't prevent it from being taken and leaked.
OCR's findings included violations tied to the Breach Notification Rule specifically, alongside the Security Rule findings — the exact notification deficiencies aren't fully itemized in public reporting, but OCR's own settlement cites both categories.
The three-year CAP requires LVHN to conduct a proper risk analysis, build a risk management plan from it, revise its Security and Breach Notification Rule policies, and repeat the analysis periodically — a real, monitored, multi-year remediation commitment rather than a one-time fine with no follow-through.
Controls that would have prevented or limited this
Would have surfaced the specific risks and vulnerabilities in Delta Medix's environment well before the two-year gap that preceded this attack, matching what OCR's corrective action plan now requires after the fact.
Would have reduced the chance that clinical photographs specifically — the data category that caused the most severe harm here — were reachable and exfiltratable in the same way as routine records.
Would address the compounding Breach Notification Rule violations OCR cited alongside the core Security Rule findings.
Blast radius
What was exposed
- Clinical photographs of cancer patients taken during radiation oncology treatment, some disrobed
- Passport images and patient intake questionnaires containing personal information
- Data belonging to roughly 134,000 patients, per the eventual class-action settlement's scope
What LVHN held the line on
- No ransom paid, a position stated publicly rather than negotiated quietly
- A three-year corrective action plan accepted and now underway, not just a fine paid and forgotten
- A tiered settlement structure that specifically recognized the patients whose clinical images were published as having suffered a distinct, more severe harm
Two resolutions, two very different numbers
What they got right
LVHN refused to pay BlackCat's ransom and said so publicly, rather than negotiating quietly and leaving patients to find out what happened from a leak site instead of from the hospital.
LVHN accepted a three-year corrective action plan with OCR rather than treating the $800,000 settlement as the end of the obligation — a monitored, multi-year commitment to actually fixing the risk-analysis gap OCR identified, not just paying to make the finding go away.
The eventual class-action settlement structure specifically distinguished patients whose clinical images were published from the broader affected population, building a higher-relief tier for that group rather than treating every patient's harm as identical.
Why this keeps happening
OCR has now taken 22 ransomware-related enforcement actions, and a failed or missing risk analysis is the single most recurring finding across nearly all of them — not a sophisticated technical failure, but the absence of the basic, required exercise of knowing where your own risks actually are. LVHN's case fits a pattern OCR has been actively, publicly building a case against all through 2026: four settlements in April, a 20th ransomware action in July, this as the 22nd in October.
Acquired practices and subsidiaries are a structurally underappreciated risk in healthcare specifically, because M&A activity in this sector is constant and the security due diligence on an acquisition often focuses on licensing, billing and clinical compliance — not on whether the acquired entity's own IT environment has been brought up to the parent organization's security standard. Two years after the Delta Medix acquisition, its systems were still where the intrusion happened.
Double-extortion ransomware groups specifically target healthcare because the data itself carries leverage no other threat does — publishing a Social Security number creates financial risk; publishing a patient's own medical images creates a kind of harm that no amount of credit monitoring addresses. That asymmetry is exactly why healthcare keeps appearing as a preferred target for this ransomware model.
Lessons for your own environment
- An acquisition's IT environment is part of your attack surface until you've actually integrated it
Delta Medix was acquired in 2021. The attack landed on its systems in 2023. Two years is long enough that "we just acquired them" stops being an excuse for a separate, less-scrutinized security posture.
- A missing risk analysis is the finding regulators look for first
OCR's core violation here — and in the large majority of its ransomware enforcement actions — is the absence of an accurate, thorough risk analysis. This is the single highest-leverage compliance exercise a HIPAA-covered entity can actually complete, and it's the one most often missing when a ransomware incident gets investigated.
- Some data categories carry harm no identity-theft framework addresses
A leaked clinical photograph isn't a financial-fraud risk in the way a stolen SSN is — it's a different kind of harm entirely, and data classification and access controls should treat genuinely sensitive imagery with a different, higher bar than routine PII.
- The civil settlement will likely dwarf the regulatory fine
$65 million in class-action liability against $800,000 in OCR penalties is not a close comparison. A security program built to satisfy a regulator's minimum bar, while treating patient litigation risk as secondary, is optimizing against the smaller number.
- Refusing to pay a ransom is a real, defensible decision — but it's not the whole response
LVHN's no-payment stance was the right call and a genuinely held line. It didn't, on its own, prevent the data from being published or the harm that followed — ransom-payment governance and data protection are two separate problems, and solving one doesn't solve the other.
- A corrective action plan is worth more scrutiny than the settlement number next to it
An $800,000 fine paired with a three-year, monitored corrective action plan is a meaningfully different outcome than an $800,000 fine with no follow-through. The CAP is where the actual security improvement is supposed to happen — read it as the real deliverable, not the dollar figure.
CISO & board lessons
- Ask specifically whether your organization's HIPAA risk analysis covers every acquired entity's systems, not just the core organization's — and when each acquired environment's risk analysis was last actually performed, not assumed to be inherited from the parent.
- Treat security due diligence on an acquisition as seriously as financial due diligence. By the time a security gap in an acquired entity becomes a breach, the acquisition decision is years in the past and the liability lands on the parent organization regardless.
- Model breach cost for the board using the civil-litigation exposure, not just the regulatory-fine exposure. This case's $65 million class-action settlement against an $800,000 OCR fine is the concrete number to cite the next time risk is being sized for a healthcare organization specifically.
- If your organization handles any category of data more sensitive than standard PII — clinical imagery, biometric data, anything where exposure itself (not downstream fraud) is the harm — confirm it has its own, stricter access and retention controls, not the same baseline as a patient's mailing address.
Action plan
First 24 hours
- If ransomware activity is confirmed anywhere in the environment, immediately check whether the affected systems belong to a recently acquired entity, subsidiary, or practice — and whether that environment has ever been through the organization's own security assessment.
- Identify whether any especially sensitive data categories (clinical imagery, biometric data, anything beyond standard PII) are stored on the affected systems, and prioritize containment around those specifically.
- Make and communicate the ransom-payment decision at the executive level early, rather than leaving it open during active negotiation pressure.
First 7 days
- Begin or accelerate a formal HIPAA risk analysis covering the affected environment specifically, documenting findings as you go rather than reconstructing them later under regulatory pressure.
- Separate and track two distinct notification/response tracks: regulatory (OCR, state authorities) and patient-facing — each has different requirements and different audiences.
- If clinical imagery or similarly sensitive material is confirmed exposed, build patient communication and support resources specifically for that harm category, not a generic breach-notice template.
First 30 days
- Complete a full risk analysis across every acquired entity's IT environment, not just the one affected by this incident, and build a documented risk management plan from the findings.
- Review the organization's M&A security-integration process and close the gap that let an acquired entity's systems run years behind the parent organization's security standard.
- Prepare for the likelihood that civil litigation exposure will substantially exceed any regulatory fine, and brief the board on that cost model specifically rather than only the compliance exposure.
Could this happen in your organization?
- Has every entity your organization has acquired in the past five years had its own, independent HIPAA risk analysis — or is it assumed to be covered by the parent organization's analysis?
- Do you know which systems in your environment hold data categories more sensitive than standard PII (clinical imagery, biometric data), and do those systems have access controls stricter than the baseline?
- If a ransomware group threatened to publish your most sensitive data category specifically, would your incident response plan treat that differently than a threat to publish names and addresses?
- Has your organization's leadership already decided, before any incident, whether it will pay a ransom — or would that decision be made for the first time under pressure?
- Could your organization produce a current, accurate, organization-wide risk analysis today if a regulator asked for one tomorrow?
- Does your board understand breach-cost exposure primarily in terms of regulatory fines, or does it also account for the civil-litigation exposure that, in cases like this one, is the far larger number?
- When you acquired your most recent subsidiary or practice, how long did it take before that entity's IT environment was brought fully under your organization's security monitoring and controls?
If this happened to you: what to ask, and what to say
Knowing the lesson isn’t the same as knowing what to do with it Monday morning. A security lead, a CISO, and a customer-facing team each need something different from this incident.
- "Has every acquired practice or subsidiary's environment actually been through our own risk analysis, or are we assuming it inherited ours?"Ask for a specific answer per acquisition, with a date. "We assume so" is exactly the gap that let this intrusion land on Delta Medix's systems two years after acquisition.
- "Do we treat clinical imagery or other especially sensitive data with stricter controls than standard PII?"If the honest answer is "it's all under the same policy," that's worth revisiting given what happened here.
- "If we had to produce our risk analysis for a regulator tomorrow, is it current and would it hold up?"OCR's single most common finding across its ransomware enforcement actions is a missing or inadequate risk analysis. Confirm yours actually exists and is current, not assumed.
- "What's our actual process for bringing an acquired entity's security posture up to our own standard, and how long does it take?"Two years passed between the Delta Medix acquisition and this attack. Ask whether your own timeline would realistically be faster.
- Say what happened, in one plain sentence.A board member should hear the actual mechanism, not a euphemism."Ransomware compromised systems belonging to a practice we'd acquired two years earlier, and when we refused to pay, the attackers published sensitive patient data, including clinical photographs."
- Model the cost using both numbers, not just the regulatory one.Give the board the full financial picture, not the smaller, more comfortable figure."The regulatory settlement was $800,000. The patient class-action settlement was $65 million. If we're sizing this risk for the board, the second number is the one that matters more."
- Address the acquisition-integration gap directly.Don't let this read as a one-off technical failure disconnected from how the organization grows."This intrusion happened on systems from an entity we acquired. We are changing our M&A process so a security assessment is part of every acquisition's integration timeline, not an afterthought."
- Commit to a concrete, dated remediation milestone.A vague promise to "improve security" doesn't survive scrutiny the way a specific plan does."We've accepted a three-year corrective action plan with federal regulators, with specific, monitored milestones. I can walk the board through exactly what's required and when."
- Tell patients plainly and specifically what was exposed.Don't make patients guess from a vague notice, especially given the sensitivity involved here."Data from your care at [acquired practice] may have been affected, including images taken during treatment. We are telling you this directly and specifically, not in general terms."
- Acknowledge the distinct harm for patients whose images were published.Treat this harm category differently than a standard data-exposure notice."If your treatment images were among the data published, we recognize that is a different and more serious harm than a typical data exposure, and our settlement reflects that directly."
- Explain what's changing, specifically."We take security seriously" tells a patient nothing concrete."We have completed a full security risk analysis of every facility in our network, including recently acquired practices, and we are under a monitored, multi-year plan with federal regulators to sustain those improvements."
- Point patients to concrete support resources.A settlement notice without a clear next step helps no one."If you are eligible under the settlement, here is exactly how to file a claim, and here is who to contact directly if you have concerns about how your specific information was affected."
References & confidence
- ConfirmedHHS Press Release — OCR settles ransomware investigation with Lehigh Valley Health Network
- ConfirmedHHS OCR Resolution Agreement / Corrective Action Plan
- ConfirmedGovInfoSecurity — Pennsylvania health system CEO confirms BlackCat attack — Primary source for the 2023 attack date and LVHN's no-ransom statement.
- ConfirmedLehighValleyNews.com — Hackers posted photos of LVHN cancer patients receiving treatment
- ConfirmedCyberScoop — Patient sues Lehigh Valley over ransomware
- ConfirmedTEISS — Lehigh Valley Health Network to pay $65 million in landmark ransomware settlement
- ConfirmedSC World — Lehigh Valley Health Network to settle breach class action for $65M
- ConfirmedPaubox — OCR ransomware settlement after HIPAA penalty freeze — Context on OCR's 2026 enforcement pace (20th and 22nd ransomware actions, April settlements).
- DisputedA secondary source's claim of a February 2026 intrusion date and May 2026 OCR notification — Conflicts with the far better-corroborated February 2023 attack date reported consistently in primary coverage at the time; likely confusion with an unrelated or amended filing. This case study uses the 2023 date.
- UnknownThe exact technical initial-access method into Delta Medix's systems — Not documented in any source reviewed. This case study does not speculate on a specific mechanism.