Breach Report: NuLife Med data breach affects 80,000+, results in class-action lawsuit and potential $2 million settlement

(image source: (Chief Outsiders (NuLife Med), 2018))

One-sentence summary:

NuLife Med, a healthcare equipment company, was breached in March 2022 potentially affecting 81,000+ patients and resulting in a potential $2 million class-action lawsuit settlement.

Who was involved?

NuLife Med, LLC, 81,000+ patients, and a threat actor.

What was the timeline?

March 9, 2022: Attacker breaches NuLife Med

March 11, 2022: Attack ends after NuLife Med discovers unusual activity

April 13, 2022: NuLife Med discovers the breach (per Maine OAG report)

May 5, 2022: NuLife Med posts breach notice on their website

December 6, 2022: Class-action lawsuit is filed against NuLife Med in Broward County, Florida

February 6, 2023: Lawsuit settlement is filed and eventually approved

What occurred?

NuLife Med, a healthcare equipment company based in New Hampshire, was breached in March 2022, potentially resulting in the disclosure of the following sensitive data for over 81,000+ patients: “name,
address, medical information and/or health insurance information” … “Social Security number, driver’s license information, and/or financial account or credit card information” (NuLife Med, 2022; HHS, 2022). A class-action lawsuit ensued that was eventually settled for 1-year of credit monitoring or up to $25 per claimant, which comes out to over $2 million (no cap specified) (Pires v. NuLife Med, LLC, 2022; Pires v. NuLife Med, LLC, 2023).

Estimated costs:

Associated incident response costs, breach notification costs, litigation defense costs, settlement costs: (1 year free credit monitoring or up to $25 “for documented proof of loss” (potentially $2 million: 80,000 x $25) (Pires v. NuLife Med, LLC, 2023, p. 39), M-F call center

Involved laws:

Federal: HIPAA and HITECH

State: Maine: 10 M.R.S.A. § 1346

Root cause:

TBA or N/A (see disclaimer)

Lessons learned:

TBA or N/A (see disclaimer)

Sources:

Chief Outsiders (NuLife Med). (2018, March 12). AAEAAQAAAAAAAAYkAAAAJDA2YTY0OTMxLTliZTctNDhkZC04MzM1LWQ4Mzk2ODNjMDIzYQ.png. Chief Outsiders. https://www.chiefoutsiders.com/clients/nulifemed

HHS. (2022). Cases Currently Under Investigation. In Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information. U.S. Department of Health and Human Services Office for Civil Rights. Retrieved April 14, 2023, from https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf

NuLife Med. (2022). NuLife-Preliminary-Website-Notice-with-JBS-responses. In NuLife Med. NuLife Med, LLC. Retrieved April 14, 2023, from https://www.nulifemed.com/wp-content/uploads/2022/05/NuLife-Preliminary-Website-Notice-with-JBS-responses.docx-003.pdf

Pires v. NuLife Med, LLC, Class Action Complaint, Filing No. 162480785 (Bro. Co. 2022). https://angeion-public.s3.amazonaws.com/www.NuLifeMedClassSettlement.com/docs/Class%20Action%20Complaint.pdf

Pires v. NuLife Med, LLC, AMENDED SETTLEMENT AGREEMENT AND RELEASE, Docket No. CACE-22-017828 (Bro. Co. 2023). https://angeion-public.s3.amazonaws.com/www.NuLifeMedClassSettlement.com/docs/Amended%20Settlement%20Agreement%20and%20Release.pdf

About Post Author

Kyler Kent CISSP

Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike’s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation—turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master’s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect – Professional, AWS Security – Specialty, and multiple CrowdStrike credentials. He writes to close the gap between “what the textbook says” and what analysts actually do on shift with his published book: "SOC Analyst Career Guide" (ISBN-13: 9781835467466). https://linktr.ee/kentprotect.com Corrections: [email protected]

http://kylerkent.com