LivaNova notified about 130,000 people after LockBit ransomware attack

LivaNova, a medical device manufacturer headquartered in London with its US operations run through LivaNova USA, disclosed that attackers reached its IT systems on or about October 26, 2023 and retained access until the intrusion was identified on November 19, 2023. The LockBit ransomware group claimed the attack in December 2023 and said it had taken 2.2 terabytes of data.

The company acknowledged the incident in a securities filing in November 2023 and issued a public notice on April 25, 2024 once its review confirmed that personal information had been taken. It reported 129,219 affected individuals to the Maine Attorney General's Office, a figure that was later revised upward to roughly 180,000.

The exposed data included names, postal addresses, telephone numbers, email addresses, dates of birth, Social Security numbers, health insurance details and medical information such as diagnoses, conditions, treatments, prescriptions, physician names, medical record numbers and device serial numbers. LivaNova offered complimentary identity protection and credit monitoring, and recorded about $2.6 million in incident costs in the fourth quarter of 2023.

Notification letters continued into mid-2024, and class action litigation followed in federal court in the Southern District of Texas over the company's handling of the breach.