Health Plan of San Joaquin Data Breach Class Action Lawsuit

On May 5, 2022, our data breach attorneys filed a class action lawsuit against Health Plan of San Joaquin for its failure to implement reasonable and adequate cybersecurity controls to protect the personal health information of its members.

 

According to the lawsuit, hackers gained access to HPSJ personnel’s email accounts in September and October 2020, which contained member personal health information. The lawsuit alleges that HPSJ “failed to put in place proper security protocols to protect against the unauthorized release of patient information and failed to properly train its employees on such protocols, resulting in the unauthorized release of private data,” seeks compensation for the data breach victims, and demands that HPSJ adequately protect member’s sensitive personal health information from future data breaches.

 

Sensitive information compromised in the breach includes:

 

• Social Security number
• Member name
• HPSJ member ID number
• Claim ID number
• Date of birth
• Lab results
• Medical ID number
• Prescription information
• Treatment information
• Driver’s license or other government issued ID number
• Financial account information
• Health insurance information
• Medical record number (MRN)
• Username and password
• Prescription ID number

On January 6, 2026, Plaintiffs filed a motion to certify this case as a class action on behalf of all individuals to whom HPSJ or its vendors sent a Notice indicating that their medical information was present in the affected email accounts at the time of the incident.

Gibbs Mura partner David Berger has represented consumers in some of the largest and most influential privacy and data breach cases in the country and has repeatedly obtained record-setting settlements. Notably, David was appointed co-lead counsel to fight for over 10 million MGM customers whose information was stolen in a data breach in 2020. He frequently speaks at conferences on data breach cases and other class action topics. David is a former Chair of the American Association for Justice’s Consumer Privacy and Data Breach Litigation Group.

Gibbs Mura is a nationwide leader in class action lawsuits seeking to holding companies accountable for large-scale data breaches.  It has prosecuted some of the largest privacy cases throughout the country, and the firm’s attorneys have received numerous awards for their privacy and data breach work including “Cybersecurity & Privacy MVP,” “Top Cybersecurity and Privacy Attorneys Under 40,” and “Titans of the Plaintiffs Bar.”

 

The firm achieved a historic $1.5 billion settlement from Equifax in 2019, on behalf of 147 million consumers whose social security numbers and other private data were exposed in a breach.  Described by the court as “the largest and most comprehensive recovery in a data breach in U.S. history by several orders of magnitude,” the settlement also required Equifax to spend over $1 billion in data security technology and to make comprehensive security reforms.  Previously, the firm negotiated a $115 million settlement in the Anthem data breach, the largest data breach settlement at the time, after approximately 80 million personal records were compromised in a massive data breach of health insurance giant.