A healthcare data breach involving Allegheny Health Network (AHN) and its IT services vendor, IntraSystems, has led to the filing of at least seven federal class action lawsuits. The breach, reported on January 17, 2025, affected approximately 293,000 patients and resulted from an unauthorized access incident that began on October 11, 2024. AHN discovered the breach on November 19, 2024, and has since been notifying affected individuals. The lawsuits, filed in federal courts in Massachusetts and Pennsylvania, allege negligence in securing sensitive personal and health information.
AHN operates 14 hospitals and over 200 clinical locations in western Pennsylvania. The breach occurred when an “unauthorized user” hacked into systems managed by IntraSystems, which supports AHN’s home medical equipment and home infusion services. The compromised data includes patients’ names, Social Security numbers, health insurance information, and treatment details. AHN has stated that steps were taken to investigate and secure the systems upon discovering the breach, including disconnecting affected systems and notifying law enforcement.
Despite these measures, the breach has raised significant concerns about data security in the healthcare sector. Multiple law firms are investigating the incident for potential class action litigation. As of the latest updates, neither AHN nor IntraSystems has responded to requests for further details about the breach, such as any ransom demands or the impact on other IntraSystems clients.
The incident with IntraSystems is part of a broader trend of breaches involving third-party vendors in the healthcare industry. According to the U.S. Department of Health and Human Services, there have been 49 major health data breaches reported in 2025 alone, affecting around 651,000 individuals. Of these, 32 incidents involved third-party business associates, highlighting the vulnerabilities in partnerships with external service providers.
In the previous year, business associate breaches were responsible for affecting a significant number of individuals. The HHS Office for Civil Rights reported 725 major breaches in 2024, impacting over 185.3 million people, with 220 related to business associates. A notable case involved Change Healthcare, which disclosed a ransomware breach affecting 190 million people, underscoring the escalating threat landscape for healthcare data security.