Long Island Plastic Surgical Group $2.6M Settlement Over 2024 Patient Data Breach

A January 2024 cybersecurity incident at Long Island Plastic Surgical Group P.C. allegedly exposed highly sensitive patient information for about 161,000 current and former patients—data that can be especially damaging in a healthcare setting because it may combine identity details (like Social Security numbers and driver’s license numbers) with medical/insurance information and even clinical photographs. In response, the practice agreed to a $2.6 million class action settlement that offers reimbursement of documented losses up to $5,000 (and up to $1,000 more for patients whose clinical photographs were compromised), or an alternative pro rata cash payment for those without documentation, with claims due by May 18, 2026. The lawsuit was filed because plaintiffs allege the practice failed to adequately safeguard patient data, leading to the breach and resulting risks such as identity theft, fraud, and costs tied to credit monitoring and remediation; the company denies wrongdoing but chose to settle to avoid the expense and uncertainty of continued litigation. Cases like this reflect a broader wave of healthcare data-breach class actions where settlements often focus less on proving direct misuse of data (which can be hard to trace) and more on compensating consumers for out-of-pocket expenses and the time and effort of protecting their identities, while also signaling that medical providers—from large hospital systems to specialty practices—are expected to treat cybersecurity as a core patient-safety obligation. Industry context matters because healthcare organizations typically handle “protected health information” (PHI) regulated under HIPAA and its Security Rule, which require administrative, technical, and physical safeguards to protect electronic PHI, and breaches can also trigger federal and state notification duties and regulatory scrutiny. Beyond HIPAA, many states have their own data-security and breach-notice laws, and plaintiffs’ lawyers increasingly point to these frameworks—along with common cybersecurity practices like encryption, access controls, and vendor oversight—to argue that an incident reflects preventable gaps rather than unavoidable criminal activity, keeping pressure on the healthcare sector to invest in stronger defenses as attacks continue to rise.