Amazon Sued for Hosting Healthcare Provider’s Stolen Data

Amazon Web Services Inc. and a defendant whose identity is unknown have been sued by a behavioral healthcare services provider based in Fort Myers, Florida after the Doe defendant lifted confidential information from plaintiff SalusCare Inc.’s computer systems, including patients’ financial and health-related records. 

The Florida Middle District complaint for immediate injunctive relief and damages asserted that the Doe defendant then contracted with Amazon for web-based storage “buckets,” into which the hijacked data was uploaded.

The filing explained that SalusCare is the most comprehensive provider of mental health and substance abuse services in Southwest Florida. SalusCare learned of the unauthorized access to and extraction of its data when, on or about March 16, issues of “slowness” were detected within its computer network. Allegedly, a timely forensic inspection revealed that the data had been sent to storage “buckets” owned and managed by Amazon with “code” originating in Ukraine, a country to which SalusCare reportedly has no ties.

The complaint stated that once SalusCare learned of the theft, it contacted Amazon, requesting that the stolen information be locked. Amazon ostensibly responded that the accounts had been suspended but gave no indication as to how long they would remain in that state. SalusCare explained that it has yet to learn of the intruder’s identity, and that the forensic investigation, which has to date cost it more than $12,000, remains ongoing.

The complaint brings two counts against the Doe defendant under the Computer Fraud and Abuse Act and Florida’s Computer Abuse and Recovery Act, seeking a variety of damages, the disgorgement of profits, and injunctive relief. As to Amazon, SalusCare seeks injunctive relief. In particular, it asked the court to order Amazon to provide a complete copy of the stolen information with audit logs documenting all transfers in and out of the buckets, and thereafter to permanently purge all of the information.

SalusCare is represented by James Thomas Smoot, III.