Eight Bucks a Patient
Brockton Neighborhood Health Center runs a network of clinics serving about 39,000 patients around Boston, with roughly $84 million in annual revenue and about 830 employees. In November 2024, a ransomware crew called Interlock got in and took what it wanted. Six weeks later, Brockton sent letters to 97,488 current and former patients (the active roster runs about 39,000) explaining that their diagnoses, lab results, medications, and insurance details were now sitting on a criminal group’s leak site.
Nineteen months after the first complaint was filed, the consolidated class action settled with a hard cap of $825,000, subject to final court approval. Divide the cap by the number of victims and you get $8.46 per person, a strange number to see attached to six years of medical records dumped on the dark web.
The settlement is one line item in a bill that runs from $1.6 million to $4.3 million, while the security program that plausibly prevents this attack costs about $195,000 to $500,000 a year. Both estimates follow, itemized, because the gap between them is the whole argument for funding security before an intrusion instead of after it.
Split evenly, the settlement cap works out to $8.46 per victim. The all-in bill for the breach runs $16 to $44 per person.
An Organization With Nothing in the Tank
Start with the financials, because they explain the risk decision. Brockton’s FY2023 Form 990, the annual tax return nonprofits file with the IRS, showed a $3.8 million net loss. The FY2024 return showed another, at $3.3 million, and FY2025 added a third at $4.0 million, though that year swallows the breach itself.
What the books showed going in
- Cash collapsed from $14.5 million to $355,991 between FY2023 and FY2024
- Accounts receivable ballooned to $16.4 million, meaning billing had backed up before anyone touched the network
- Net assets fell from $29.7 million to $22.9 million in two years, based on ProPublica’s nonprofit explorer
- CEO Susan Joss departed in March 2025, four months after the intrusion, with a board that had shrunk from 17 members to 14 amid steady turnover
The audits tell the same story from a different angle. Independent auditors flagged a significant deficiency in internal controls in FY2023, FY2024, and FY2025, signed off each time by an audit committee that existed and met.
This matters for a boring reason. An organization losing money, burning reserves, and churning leadership has exactly one kind of security decision available to it, and that’s the decision to defer. Nobody writes a memo saying “let’s accept the risk of a catastrophic breach.” They just don’t fund the fix, year after year, while the audit finding repeats like a smoke detector with a dying battery.
Six Quiet Weeks
The intrusion ran November 1-3, 2024, and Brockton noticed the suspicious activity on November 3. On November 18, investigators determined that an unknown actor had viewed or copied files, and by November 29 the health center had identified the affected population: patients treated between 2017 and 2022. Individual notice letters went out December 13, and the website posting followed on December 16, 40 days after discovery and inside HIPAA’s 60-day window.
Legal paper moved faster than the patients’ mail. The first class action was filed December 20, four days after the public notice, and two more suits followed before all three consolidated into Howard v. Brockton Neighborhood Health Center in Plymouth County Superior Court.
Meanwhile, Interlock claimed 1,930 gigabytes of stolen data and published it, a fact reported by Comparitech and corroborated by the leak-site listing described in HIPAA Journal’s coverage. Brockton’s own notice said files were “viewed or copied,” a phrasing that’s technically accurate and does a lot of quiet work. The clinic closed for several days, the pharmacy didn’t partially reopen until November 15, and nobody has ever confirmed whether a ransom was demanded or paid.
What the Aftermath Cost
Some of these numbers are documented and others are estimates. Each row says which.
| Cost | Range | Basis |
|---|---|---|
| Settlement fund (claims, fees, admin, awards) | $650K-$825K | Documented in the settlement agreement; $322.5K max fees, $10K service awards |
| Defense fees and failed mediation | $250K-$750K | Estimated; 19 months of consolidated litigation |
| Forensics and incident response | $50K-$250K | Estimated; mid-market ransomware benchmarks |
| Notification, call center | $75K-$225K | Estimated; ~97,488 letters |
| Downtime and revenue interruption | $350K-$1.5M | Estimated; $230K/day revenue run rate |
| One-time remediation | $250K-$750K | Estimated; fixes documented to HHS Office for Civil Rights (OCR) |
| Total | $1.6M-$4.3M |
The settlement terms are public
Class members can claim up to $2,500 for documented losses or take a flat $50, plus three years of credit monitoring. Plaintiff attorneys capped out at $322,500, which is 39% of the $825,000 cap. What’s unknown is the claim rate, which determines the actual payout, and Morrison Foerster’s data breach litigation year in review found most breach settlements draw claim rates under 1%. The fund likely pays out well below its cap.
Defense fees are the softest number, so here’s the reasoning
Winget Spadafora & Schwartzberg, a Stamford firm, defended the three consolidated actions over the case’s 19-month run. It briefed a motion to dismiss that was never ruled on, sat through a failed full-day mediation in October 2025, and negotiated the deal. The closest comparable I found is Lamie v. LendingTree, an $875,000 settlement for a 69,142-member class that is structurally almost identical to this one. For a regional firm on a case that never reached discovery, $250,000 to $750,000 is a defensible band. No 990 filed yet captures it; the FY2025 return showed only $103,839 in legal fees, with the bulk accruing later.
Downtime deserves a caveat
Brockton’s revenue ran about $230,000 a day, the clinic closed for days with disruption lingering past the November 15 pharmacy reopening, and FY2025 revenue fell $10.2 million year over year. I’m not attributing that entire $10.2 million to the breach, because grants were already shrinking and pharmacy sales were contracting before the attack. Some deferred revenue eventually collected, which the receivables cleanup suggests. Three to seven days of serious disruption, discounted for later recovery, gives the $350K to $1.5M range.
Brockton told class counsel what its security fixes cost. The number exists, written down. The court keeps it sealed.
One more detail the settlement documents reveal. Brockton agreed to give class counsel a confidential declaration describing its post-incident security enhancements and their estimated annual cost, to be filed under seal if necessary. The rest of us have to estimate.
What Prevention Would Have Cost
We don’t know how Interlock got in, but we can model the costs of the control package a court or auditor would have expected; this is also what Brockton later implemented. The amended complaint alleged missing encryption, no network monitoring, and inadequate workforce training. Brockton’s own breach report to HHS says that afterward it adopted encryption, retrained its workforce, and added technical safeguards.
The shopping list, priced
- Managed detection and response (MDR) across ~800 endpoints (roughly one per employee), at published rates from firms like Huntress and Sophos: $95K-$190K per year
- A fractional security executive, per IRM Consulting’s 2026 pricing guide for a 200-500 person organization: $60K-$144K per year
- Security awareness training for 830 staff at the $1.50-$3.00 monthly per-user rates Symbol Security reports: $15K-$30K per year
- Multi-factor authentication, identity, and encryption tooling, often already bundled in Microsoft licensing, which is why this line starts near zero: $0-$60K per year
- Backup verification, endpoint management, and patching discipline: $25K-$75K per year
That totals about $195,000 to $500,000 annually, or 6-16% of Brockton’s FY2024 IT budget of $3.1 million.
For calibration, Censinet reports healthcare organizations average about 7% of IT budget on cybersecurity, and a 2023 HIMSS survey found 60% of medical organizations spend less than 6%. Brockton’s pre-breach 990s show no security vendor in its top contracts, no CIO in the leadership roster since 2021, and a security-typed contractor appearing only after the incident.
Two Numbers, One Organization
Brockton is a nonprofit, so there’s no profit to take a percentage of. However, we can evaluate the effects on their balance sheet:
- The aftermath equals as much as a full year of the operating deficits the health center was already running
- Against annual revenue, aftermath is 1.9-5.1% versus prevention’s 0.2-0.6%
- Against the $23 million net asset cushion, aftermath is 7-19%, and the liquid position, $355,991 in cash plus $6.28 million in savings and short-term investments, covered about a month of the $87.6 million expense base
Run the ratio both ways and it survives every assumption. The aftermath bill is roughly 3 to 22 times a single year of the prevention package, and even stacking the worst case for breach costs against the best case for prevention, the breach loses.
The audits flagged control deficiencies three years running. Then a ransomware outfit that had only been operating since October 2024 walked through the gap in November.
Each of those was a business decision, not a technical failure, and each looked reasonable in isolation. Together they compounded until 97,488 people’s medical records showed up on a leak site.
Somebody at that health center had the power to approve the smaller number for years. This is what risk acceptance looks like.
