Terence R. Coates

Elekta, Inc., which supplied radiation-therapy equipment and cloud data services to cancer centers, detected an attack on its cloud-based systems in the early hours of April 6, 2021. Within two days it was describing what appeared to be a ransomware attack “intended to encrypt the data stored on this system.” “There is no evidence that any data were extracted or copied,” the company said. Lifespan in Rhode Island and Southcoast Health in Massachusetts canceled some radiation appointments; at Southcoast’s cancer centers in Fall River and Fairhaven, at least 50 patients had their treatments rescheduled. On April 20 Elekta took its first-generation cloud system in the United States offline. Later it told its clients: “Elekta must conclude that all data within Elekta’s first-generation cloud system was compromised.”

The attackers had been in Elekta’s systems between April 2 and April 20. The database they reached held files that oncology providers kept there about their patients: Social Security numbers, diagnoses, treatment plans, prescription information, and, for some patients of Northwestern Memorial Healthcare in Illinois, genetic information. Eighteen months later, Advocate Aurora Health notified about three million patients that tracking code from Meta and Google on its websites, its LiveWell app, and its MyChart patient portal may have disclosed details of their appointments, their providers, and their MyChart communications to outside companies.

In the first case criminals took the data. In the second, the patients alleged, Advocate’s own web pages sent it, because Advocate had configured the code to capture what patients did there. Federal judges in Georgia and Wisconsin appointed Terence R. Coates of Markovits, Stock & DeMarco in Cincinnati to co-lead both groups of patients: with Bryan L. Bleichner of Chestnut Cambronne in Tracy v. Elekta, Inc., and with Gary M. Klinger of Milberg in In re Advocate Aurora Health Pixel Litigation.

Each case met a defense with recent law behind it. Coates told the Georgia court that Elekta and Northwestern would likely argue, as Equifax had, that Georgia law imposes no legal duty to safeguard personal information. Advocate’s patients faced Kurowski v. Rush System for Health, a March 2023 ruling in a pixel case against another hospital system in the same federal circuit, which class counsel described as finding “no viable damages claims.” Both cases ended in non-reversionary cash funds: $8.9 million for an Elekta class of about 490,000 people, with half of the net money set aside for Illinois patients whose genetic information had been exposed, and $12.225 million for about 2.5 million Advocate patients, who filed 565,543 valid claims.

Ransomware in Elekta’s Oncology Cloud

Elekta sold cancer providers a first-generation cloud storage system tied to its patient-management software and designed to give clinicians a complete picture of each patient and the course of treatment. Elekta told customers that it “ensures that safeguarding your clinical data is our highest priority.” Northwestern used the Elekta database to meet detailed state reporting requirements, including clinical and pathological information about the extent of a patient’s disease.

In April 2021 ransomware gave attackers access to that database. Elekta took its cloud systems offline, and the plaintiffs alleged that its emails to clients spoke of “cancelling or rescheduling radiation treatment appointments for cancer patients” and that cancer patients across the United States had their treatment delayed or disrupted while the systems were down. Elekta said that about 170 customers using the first-generation system in the United States were experiencing service disruptions, that fewer than a quarter of those sites had been affected in their ability to treat patients, and that the FBI was investigating. The plaintiffs alleged that about 42 health systems were affected.

Northwestern notified about 201,197 of its patients that their information had been reached between April 2 and April 20, 2021; its notice said that an unauthorized individual had “acquired a copy of the database that stores some oncology patient information.” Advocate Aurora Health was also an Elekta customer. Seven of its Illinois care sites used Elekta to coordinate radiation care, and about 68,707 Advocate patients were notified after the attack.

The exposed files held names, Social Security numbers, dates of birth, addresses, clinical information related to treatment, medical record numbers, medical histories, dates of service, treatment plans, physician names, diagnoses, prescription information, health insurance information, and genetic information. The plaintiffs alleged that the genetic information of Northwestern patients included BRCA1 and BRCA2 testing, colorectal genetic-variant testing, biomarker testing, and sequencing. “Cancer is a genetic disease,” their complaint said, and it explained that hereditary tests help show whether a patient is “more susceptible” to certain cancers. The complaint counted the genetic tests of a patient’s family members among the information protected by the Illinois Genetic Information Privacy Act.

Carla Tracy of DeKalb, Darryl Bowsky of Chicago, and Deborah Harrington of Oak Park, all Illinois residents, had been treated for cancer at Northwestern. Each received a notice dated June 25, 2021, saying that their information had been compromised. Bowsky had taken part in a clinical trial in which his DNA was submitted, analyzed, and stored.

Coates, Bleichner, and the Genetic-Privacy Count

Tracy sued Elekta in the Northern District of Georgia on July 16, 2021. MaryBeth V. Gibson of the Finley Firm in Atlanta signed the complaint, and Coates was listed on it, with Bleichner, Gary M. Klinger, and Nathan D. Prosser, as counsel whose admission pro hac vice was forthcoming. Coates applied for admission to the case in early August and was admitted on August 16. Harrington brought a separate suit on September 28, 2021, and on February 2, 2022, the plaintiffs filed a consolidated amended complaint against Elekta and Northwestern, signed by Coates and Bleichner as interim co-lead counsel, with Gibson as liaison counsel.

The consolidated complaint pleaded seven counts, among them negligence; negligence per se, resting on the allegation that Section 5 of the Federal Trade Commission Act required the defendants to take reasonable measures to protect patients’ information; breach of implied contract; and a count under the Illinois Genetic Information Privacy Act charging the defendants with “recklessly disclosing the genetic information to criminal third parties.” It alleged that the defendants failed to maintain adequate security, to limit the use and disclosure of patient information, and to reduce the risk of a breach.

Elekta and Northwestern moved to dismiss in March 2022. They argued that the Georgia Supreme Court, in Department of Labor v. McConnell, had “abandoned the practice of implying a duty based on foreseeability,” that Section 5 of the FTC Act set no concrete standard of conduct and gave no private right of action, and that the genetic-privacy count was speculative because no actual disclosure of genetic information had been alleged.

Advocate Aurora’s Pixels and a Suit Filed Two Days Later

Advocate Aurora Health is a nonprofit system that the plaintiffs described as 26 hospitals and 500 care sites in Illinois and Wisconsin. On October 22, 2022, it issued a notice saying that it had used tracking technologies from Google and Meta, as “many others in our industry” had, “to understand how patients and others interact with our websites,” and that when patients used some of its sites, “certain protected health information (‘PHI’) would be disclosed in particular circumstances to specific vendors because of pixels on our websites or applications.” Unable to determine exactly how many patients were affected, Advocate decided to treat every patient with a MyChart account, every LiveWell user, and every patient who had used its online scheduling tools as possibly affected.

Advocate said the pixels “would be very unlikely to result in identity theft or any financial harm” and that it had “no evidence of misuse or incidents of fraud stemming from this incident.” Its notice told patients: “We have disabled and/or removed the pixels from our platforms and launched an internal investigation to better understand what patient information was transmitted to our vendors.”

The notice listed what the pixels could have carried: the dates, times, and locations of scheduled appointments; a patient’s proximity to an Advocate location; information about the provider; the type of appointment or procedure; MyChart communications that may have included a patient’s name and medical record number; whether the patient had insurance; and, for proxy accounts, the first names of the patient and the proxy.

On October 24, two days after the notice, Shyanne John and Angelica Hudy sued Advocate in the Eastern District of Wisconsin. Richard Webster filed on October 27 and Deanna Danger on November 3. The three cases were consolidated on November 29, and on December 22, 2022, Judge J.P. Stadtmueller granted an unopposed motion and appointed Klinger and Coates interim co-lead counsel for all plaintiffs. Two cases transferred from the Northern District of Illinois joined the consolidated action on April 5, 2023.

The plaintiffs alleged that Advocate configured the pixels to capture both the identifying details of each communication—IP addresses, Facebook IDs, cookie and device identifiers, account numbers—and its content: the buttons, links, pages, and tabs a patient clicked and viewed. A patient who typed “Crohn’s Disease” into the search bar on advocateaurorahealth.org, they alleged, set off a request to Facebook that carried the patient’s Facebook ID and the address of the results page, ending in “site-search/?q=crohns%20disease.” The Facebook ID was carried in a cookie called c_user, and anyone could find the account it belonged to, the plaintiffs alleged, by typing www.facebook.com/ followed by the number. They quoted Meta’s own business terms, which barred sharing data that a business knew or reasonably should have known included health information.

The second amended complaint, filed May 5, 2023, named plaintiffs from Wisconsin and Illinois and pleaded eleven counts, among them intrusion upon seclusion, publication of private facts, breach of confidence, interception under the federal Electronic Communications Privacy Act, and violations of the Wisconsin and Illinois statutes protecting the confidentiality of patient health records. Among the named plaintiffs, Shyanne John had been receiving care from Advocate since 1999, and James Gabriel of Wisconsin since the 1970s.

Deanna Danger’s Off-Facebook Activity File

Deanna Danger, a Wisconsin resident, had received care from a hospital in the Advocate network since 2006 and had used the LiveWell app and MyChart since 2013. She had been on Facebook since 2011. Her download of her own Off-Facebook activity listed the dates and times that Advocate’s tracking pixel communicated with her Facebook account from different pages on Advocate’s website, including 11:23 a.m. and 2:30 p.m. on September 22, 2021, 12:57 p.m. on November 4, 2021, and 7:38 a.m. on April 7, 2022. It listed eleven more from myadvocateaurora.org, the site that held the LiveWell app and access to the MyChart portal, the first at 11:29 a.m. on January 25, 2021, and the last at 11:37 a.m. on March 19, 2021. That site’s home page offered links to “message your doctor,” “get your test results,” and “manage appointments.”

From January to March 2021, Danger sought and received treatment, communicated with her providers about her medical conditions, records, and lab results, and used LiveWell and MyChart to schedule appointments and procedures. The plaintiffs alleged that her download showed “the real-time transmission of Private Information from Defendant’s Website to Facebook on dates and times that Plaintiff Danger communicated Private Information to Defendant.” Advocate’s notice had told patients only that they might have been affected; the complaint used Danger’s file to tie the alleged transmissions to particular days of her own care.

Three Rulings in March 2023

The parties first mediated in person in Milwaukee on February 6, 2023, before retired U.S. Magistrate Judge David E. Jones. The session did not produce a settlement. On March 3, 2023, the court in Kurowski v. Rush System for Health ruled on a motion to dismiss in another hospital pixel case. Class counsel later told Judge Stadtmueller that Kurowski was “one of the only motion to dismiss opinions that had been issued in a pixel privacy case,” that it found “no viable damages claims,” and that it “injected significant additional risk to this already risky data privacy class action case and certainly weakened Plaintiffs’ damages claims.” Advocate had consistently denied the allegations and, class counsel told the court, had made clear that it would vigorously defend the case. Still ahead for the plaintiffs were a motion to dismiss, expensive expert discovery, and class certification, which a court had denied on March 10, one week after Kurowski, in a data privacy case against MedStar Health.

In Atlanta, U.S. District Judge Steven D. Grimberg heard oral argument on the Elekta motion to dismiss and ruled on March 31, 2023. He read the Georgia Supreme Court’s decision in Collins v. Athens Orthopedic Clinic to hold that “an injury exists where, at the very least, criminals have hacked into a data system” and taken personal information from it. Agreeing with an earlier decision of his court, Purvis v. Aveanna Healthcare, he found that “Defendants owed Plaintiffs a duty to safeguard their information based on the foreseeable risk of a data breach.” On the federal statute he wrote: “Ultimately, this Court, like many others, concludes that Section 5 of the FTC Act can support a negligence per se claim.”

He held that the plaintiffs had alleged enough facts to plead a meeting of the minds with Northwestern, which supported their implied-contract claim. His order denied the motion as to the negligence and negligence per se claims, the implied-contract claim against Northwestern, and the genetic-privacy claim of Darryl Bowsky, who alleged that his genetic information had been provided during his treatment and was in his medical records. The parties then exchanged written discovery.

Judge Jones and the June 1 Mediation

The second mediation, held remotely with Judge Jones on June 1, 2023, produced a settlement in principle. Advocate, denying wrongdoing, agreed to pay $12,225,000 into a non-reversionary fund. Class members with valid claims would receive pro rata cash payments of up to $50 each from what remained after fees, expenses, administration costs, and service awards. Class counsel told the court that Advocate was “implementing remedial measures” so that its use of tracking pixels would adhere to HIPAA, and Advocate removed the tracking tools from its website, MyChart portal, and LiveWell app.

Judge Stadtmueller granted preliminary approval on August 21, 2023. He found “no barrier to conditional certification” of a class covering everyone residing in the United States whose personal or health information “was or may have been disclosed to a third party without authorization or consent” through a tracking pixel on Advocate’s websites, LiveWell app, or MyChart portal between October 24, 2017, and October 22, 2022. He found that the settlement “appears to be fair, reasonable, and adequate” and noted that it had been negotiated with a mediator. The order appointed Klinger and Alexandra Honeycutt of Milberg, and Coates and Dylan J. Gould of Markovits, Stock & DeMarco, as class counsel. He set the final approval hearing for 8:30 a.m. on March 8, 2024, in Courtroom 425 of the federal courthouse at 517 East Wisconsin Avenue in Milwaukee.

565,543 Valid Claims

Kroll, the settlement administrator, sent notice by email to class members with valid email addresses and by postcard, and the postcard reached 98.18 percent of the class members to whom it was mailed. A claim form was attached. Beyond a name and address, the form asked whether the class member wanted a pro rata cash payment, with Yes and No to circle, and required the claimant to swear under penalty of perjury to having lived in the United States and visited Advocate’s websites. The return panel read “Postage Required.” Claims were due by January 18, 2024.

Advocate’s records put the class at about 2.54 million people. Class members submitted 570,963 claims to Kroll—363,304 by mail and 207,659 online—and 71 asked to be excluded. Coates and Klinger supported the motion for final approval with a joint declaration. Judge Stadtmueller held a fairness hearing in March 2024 and granted final approval on July 10, 2024, finding that Kroll had validated 565,543 claims, a claim rate of more than 22 percent of the class.

In the final approval order he wrote that the case had presented “substantial risk of either an uphill battle or no recovery at all” because similar cases had been dismissed at the pleading stage around the time it was filed. “No federal district court has reached the issue of class certification in a health data privacy case like this, as far as the Court is aware,” he wrote, and “success was far from guaranteed in this case.” He weighed the fund against those odds: “The $12+ million nonreversionary common fund recovery achieved is significant relative to that risk and suggests that Plaintiffs’ case has merit.”

Half the Net Fund for Genetic Data

In Georgia the parties exchanged detailed mediation statements before an all-day session with Jill R. Sperber on April 24, 2024. Through answers to informal settlement requests, the plaintiffs confirmed a class of roughly 497,000 people, the data sets potentially compromised, the number of people whose Social Security numbers were among them, and the insurance coverage available. Coates later swore that both sides were “strident in their mediation positions while remaining professional.” That session ended without a settlement in principle. The parties reached an agreement in principle at their second mediation, a full-day session on May 10, 2024. Elekta and Northwestern denied wrongdoing, and Elekta agreed to pay $8.9 million into a non-reversionary common fund.

The settlement divided the money by the kind of information exposed. After attorneys’ fees and expenses, administration costs, and reimbursement of documented losses, half of what remained was reserved for an Illinois GIPA subclass—Illinois residents whose genetic information hosted by Elekta had been compromised—as pro rata payments capped at $1,000 each. The other half, plus anything the cap left over, was reserved for pro rata cash payments to the other class members who filed claims. Any class member could also claim up to $5,000 for documented, unreimbursed losses incurred on or after April 1, 2021, including payment-card fees, credit freezes, attorneys’ fees, and postage.

Coates swore that the defense had made changes to its business practices after the attack to improve its information security. The settlement agreement required the defendants to confirm those changes to class counsel in writing and kept their cost separate from the $8.9 million fund.

The motion for preliminary approval that Coates signed set out the risk the class was avoiding. When Judge Thrash approved the Equifax data-breach settlement, he wrote that Equifax would likely renew its argument that Georgia law imposes no legal duty to safeguard personal information, an argument “strengthened following the Supreme Court of Georgia’s decisions in Georgia Dep’t of Labor v. McConnell.” Coates told Judge Grimberg that Elekta and Northwestern “would likely assert the same argument.” The fee motion he signed later described the genetic-privacy claims as “largely untested.”

Coates had been practicing since 2009, the year he graduated from Thomas M. Cooley Law School; he had earned his undergraduate degree at Wittenberg University in Springfield, Ohio, in 2005. He is the managing partner of Markovits, Stock & DeMarco. By August 2024, he swore, he was participating as plaintiffs’ counsel in more than 70 data breach and data privacy cases pending around the country. In 2026 he became president of the Cincinnati Bar Association, and he serves as executive director of the Potter Stewart American Inn of Court and as an appointed member of the Southern District of Ohio’s local rules committee.

In a sworn declaration signed in Cincinnati on August 23, 2024, Coates measured the result per person. “In my experience of handling many data breach class actions around the country including many other common fund cases,” he wrote, “the payment of $8,900,000 for a common fund settlement for roughly 497,000 class members (equivalent to roughly $17.90 per Class Member) is a strong recovery for the Settlement Class, including the Illinois GIPA Subclass.” He weighed the settlement against “the uncertainty of damages even following a successful finding of liability.”

He set that figure beside seven other recent common-fund settlements in breaches of sensitive information, which ran from $6.23 per class member in the C.R. England data breach litigation in Utah to $15.10 in Migliaccio v. Parker Hannifin Corp. in the Northern District of Ohio, and told the court that class counsel and the plaintiffs believed the Elekta settlement “exceeds the settlement amount recovered per class member in other recent data breach class action settlements.” Tracy, Bowsky, and Harrington, he wrote, had reviewed and approved the settlement and had “spent substantial time and effort protecting the Class’s interests.”

Judge Grimberg’s Final Approval and the Payments

Judge Grimberg granted preliminary approval on August 28, 2024, and named EisnerAmper the settlement administrator. Notice went to class members by direct mail; under the plan Coates described to the court, each mailed short notice carried a tear-off claim form. The claims deadline was December 26, 2024, and the final approval hearing was set for 2:00 p.m. on January 6, 2025. No objection had been filed with the court or received by the settlement administrator.

On January 7, 2025, Judge Grimberg granted final approval. He certified, for settlement, a nationwide class of approximately 489,932 people and the Illinois GIPA subclass; found that the direct-mail notice “was the best notice practicable”; held that the agreement was “fair, reasonable, and adequate” and had been reached “in good faith, at arm’s length, and without collusion”; and appointed Coates and Bleichner class counsel.

EisnerAmper began sending payments to class members with timely, valid claims on April 8, 2025, by Zelle, PayPal, Venmo, ACH transfer, virtual prepaid Mastercard, or paper check; a digital payment that failed or was not accepted in time was reissued as a paper check to the address on the claim. Any money left in the fund more than 120 days after those payments goes to the American Cancer Society, the residual recipient Judge Grimberg approved.