Franciscan Alliance Inc dba Franciscan Working Well Data Breach — Case File

From the AG filing description

Franciscan Alliance Inc., operating through its specialized occupational health arm Franciscan Working Well, serves as a vital healthcare provider and corporate wellness partner across Indiana and surrounding regions. The organization specializes in comprehensive occupational medicine, employee physical examinations, workers' compensation case management, drug and alcohol screening, and work-related injury treatment. In the course of delivering these critical services, Franciscan Working Well collects and maintains vast repositories of sensitive data. This includes not only standard patient health information and clinical records, but also detailed employee identification records, pre-employment screening results, employer-specific health profiles, and comprehensive personal identifiers necessary for managing occupational health and workers' compensation claims. In 2025, Franciscan Alliance reported a significant cybersecurity incident to the Indiana Attorney General, raising serious concerns regarding the security posture of its network infrastructure and databases. While breaches affecting healthcare and occupational medicine providers typically stem from sophisticated cyberattacks—such as unauthorized access to electronic health record systems, ransomware deployments, or third-party vendor compromises—they highlight systemic vulnerabilities in how healthcare entities safeguard sensitive patient and employee files. In the healthcare sector, attackers are increasingly motivated by the high black-market value of medical credentials, which allow malicious actors to commit medical fraud, orchestrate complex insurance scams, and execute identity theft. The data compromised in the Franciscan Working Well security incident encompasses a dangerous mix of protected health information and personally identifiable information. Exposed categories typically include full names, dates of birth, Social Security numbers, medical record numbers, health insurance details, occupational health histories, diagnosis and treatment records, and specific workplace injury or drug screening data. The exposure of this information creates severe, long-term risks for victims. Social Security numbers and dates of birth form the bedrock of identity theft, enabling bad actors to open fraudulent financial accounts, apply for unauthorized loans, and intercept tax refunds. Meanwhile, the exposure of medical and occupational records opens victims up to targeted medical fraud, potential blackmail or workplace discrimination based on health status, and unauthorized access to health insurance benefits. As a covered entity under the Health Insurance Portability and Accountability Act (HIPAA), as well as state consumer protection statutes, Franciscan Alliance Inc. and Franciscan Working Well had strict legal obligations to secure and protect the confidential data entrusted to them. Under HIPAA and industry-standard security frameworks, healthcare providers are legally mandated to implement rigorous administrative, physical, and technical safeguards, including comprehensive data encryption, multi-factor authentication, regular vulnerability assessments, and robust employee training. A data breach of this nature represents a potential failure of these statutory obligations, suggesting that existing security controls were either inadequate or improperly maintained, leaving vulnerable electronic protected health information exposed to unauthorized third parties. Receiving a formal data breach notification letter from Franciscan Alliance is a clear legal admission that your private, sensitive information was compromised as a result of corporate negligence. For affected individuals, this notification letter serves as the necessary legal standing to participate in a class action lawsuit aimed at holding the organization accountable for failing to protect your data. Importantly, victims do not need to prove that they have already suffered direct financial loss or identity theft to seek legal redress; the increased, imminent risk of future harm is sufficient. Our firm handles these complex data privacy cases on a strict contingency fee basis, meaning you pay nothing out of pocket, and we only collect a fee if we successfully recover compensation on your behalf.