Hacking Theft of Patient Data May Count as Injury in Negligence Suit, Georgia Supreme Court Rules

​The Supreme Court of Georgia has held that a hacker's theft of patient information from an orthopedic clinic's databases could count as an injury in a negligence suit. In so ruling, the court reversed the decision of the intermediate appellate court, which had affirmed dismissal of the patients' claims for failure to state a claim after finding that the patients had not alleged a legally cognizable injury.

A hacker stole personally identifiable information for at least 200,000 current and former patients of the clinic, demanding a ransom. The information stolen included Social Security numbers, birth dates, addresses, and health insurance information. The clinic refused to pay the ransom. The hacker posted at least some of the stolen information for sale on the dark web and made at least some information available on a data storage website. The clinic informed patients of the...