---
title: "When Cyber Insurance Works as Advertised"
description: "In February 2023, with 115,940 breach notification letters fresh in the mail, the chairman of the Jefferson County Health Department's board of trustees told the local paper that the department \"does have insurance for this kind of situation.\" The only"
url: https://kaynemcgladrey.com/blog/when-cyber-insurance-works-as-advertised/
date: 2026-10-29
modified: 2026-10-29
author: "Kayne"
image: https://kaynemcgladrey.com/wp-content/uploads/2026/10/jefferson-county-health-center.webp
categories: ["Blog"]
type: post
lang: en-US
---

# When Cyber Insurance Works as Advertised

In February 2023, with 115,940 breach notification letters fresh in the mail, the chairman of the Jefferson County Health Department’s board of trustees told the local paper that the department “does have insurance for this kind of situation.” The only out-of-pocket cost, Dennis Diehl said, would be the deductible.

Three and a half years later, that claim got its test. In August 2026 the department agreed to a $2.25 million class action settlement, closing out a ransomware case that started in a Jefferson County courtroom and ended in the City of St. Louis. The public record never names the insurer as the payer, but everything visible around the case points one direction. Anyone who signs off on a cyber insurance renewal should care about how that played out.

The deal isn’t final. Judge Thomas McCarthy of the City of St. Louis Circuit Court granted preliminary approval on September 10, 2026, with the fairness hearing set for December 10, 2026.

## What Happened, and When

### The breach and the letters

The breach was discovered on November 15, 2022. The forensic firm the department hired placed the intruders’ first access somewhere between October 31 and November 15, a window the department described in [its notification coverage in the Leader](https://www.myleaderpaper.com/news/health-department-sends-thousands-of-letters-about-data-breach/article_e8655fe4-a7f9-11ed-8579-d731127dfd3c.html), the Jefferson County paper that covered the letters when they went out.

The letters went out through a mail processing vendor in Oregon, and that unfamiliar out-of-state return address is part of why recipients called the paper to ask whether the notice itself was a scam. It’s a reasonable reaction to a letter about your Social Security number arriving from an address you don’t recognize.

That same month, the department filed its report with the U.S. Department of Health and Human Services [Office for Civil Rights](https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf). The regulator’s entry lists ransomware as the cause and catalogs what was exposed:

- Names, dates of birth, and addresses
- Social Security numbers and driver’s license numbers
- Diagnoses, lab results, and medications
- Claims, financial, and other treatment information

(HHS bars deep links into that portal, so pulling the record means searching the department’s name.)

### The litigation

- Late January 2023. The first petition lands in Jefferson County Circuit Court as [case 23JE-CC00082](https://www.courts.mo.gov/casenet/cases/newHeader.do?inputVO.caseNumber=23JE-CC00082&inputVO.courtId=CT23#docket), brought on behalf of two plaintiffs identified by initials.
- May 2023. A second suit, Gurley v. Jefferson County Health Department, arrives as [case 23JE-CC00466](https://www.courts.mo.gov/casenet/cases/newHeader.do?inputVO.caseNumber=23JE-CC00466&inputVO.courtId=CT23&inputVO.isTicket=false#docket).
- June 2023. Motions to dismiss are denied.
- October 2023. The two cases consolidate, with 00082 as the survivor.
- May 27, 2025. [Class certification](https://www.courts.mo.gov/fv/c/ORDER%20GRANTING%20MOTION%20FOR%20CLASS%20CERTIFICATION.PDF?courtCode=23&di=7695102) is granted under Rule 52.08(b)(3).
- March 2026. The case moves to the city of St. Louis as [2622-CC00457](https://www.courts.mo.gov/casenet/cases/newHeader.do?inputVO.caseNumber=2622-CC00457&inputVO.courtId=CT22&inputVO.isTicket=false#docket).
- August 27, 2026. The [settlement agreement](https://jeffersoncountybreachsettlement.com/files/Ex.%201%202026-08-27%20Settlement%20Agreement%20-%20fully%20executed.pdf) is executed.

Filings wobble between three names for the defendant, Jefferson County Health Center, Jefferson County Health Department, and the Board of Trustees of the Jefferson County Health Center. The settlement agreement names it Jefferson County Health Center d/b/a Jefferson County Health Department; this piece just says the department.

## Who Ran the Defense

### The insurer was in the room from the start

Two officials told the Leader (the newspaper) that same week that insurance company counsel had advised them not to discuss what the response cost, including forensics, credit monitoring, and the mailing. Christy Coleman, the department’s attorney at the time, said the department “is being advised in issues arising from the data breach by the insurance company.”

### The counsel rotations

The docket reads like a carrier was running the show. Katherine Rhoten entered her appearance for the health department in August 2023 and withdrew in October 2024, with Colin Finnegan replacing her. By February 2025 the defense table carried Christi Coleman and William Hellmich, who represented the Board of Trustees, and Rachel Rivers of Pierson Ferdinand was signing motions by the October 2025 venue fight. Hellmich and Rivers were the counsel of record when the settlement was executed. That much turnover costs money, and somebody besides the department was evidently willing to spend it.

### What the fund covers

Because the fund is capped and non-reverting, the department’s exposure is bounded the moment the deal closes.

| Settlement component | Amount |
| --- | --- |
| Total fund | $2,250,000 |
| Class counsel fees at 35% | $787,500 |
| Service awards, three class representatives | $15,000 |
| Fixed cash payment option | $150 |
| Documented loss reimbursement cap | $300 |
| Remainder to charity, if any | Up to 25% |

On paper, $2.25 million spread across 115,940 people is about $19.41 a head, or roughly $12.60 once the 35% contingency comes out and before administration costs. That even split never happens. In cases like this most class members never file, so the fund concentrates on the minority who do, and those claimants are positioned to collect the full $150 while most of the class never opens the envelope.

The agreement also closes the door on clawbacks.

> In no event shall any money or any part, portion, or remainder of the Settlement Fund revert back to or be refunded to Defendant.

Whatever goes unclaimed funds three Missouri nonprofits, Adapt of Missouri, PreventEd, and Chestnut Health Systems, up to a quarter of the fund. Elsewhere in the papers, the department asserts it’s “a political subdivision of the State of Missouri,” a sovereign immunity posture that sits awkwardly beside a negotiated cash payment.

None of this proves who wrote the check. The agreement doesn’t say the insurer funded it, and the policy, the premium, and the deductible aren’t public records. What’s public is a board chairman expecting out-of-pocket costs to stop at the deductible, and insurer counsel steering the response from the first weeks. A public entity absorbed a seven-figure settlement without visible distress.

## The Attack Named in a Court Order

The most specific public detail about who attacked the department sits in the class certification order Judge Travis Partney signed on May 27, 2025. His findings describe the incident this way.

> A double extortion, Lockbit 3.0 attack.

That line deserves a qualifier before it goes anywhere. A certification order reflects what the plaintiffs showed, and at that stage the court takes their evidence as true rather than testing it. Read it as allegation with a judicial stamp, not adjudicated fact, because the original complaints aren’t available through the dockets.

With that said, the strain matters. News coverage never got past the word ransomware, which mirrors the notification letters, and one later trade writeup went the other direction entirely by saying no group ever claimed responsibility. The courtroom record names the strain, and the plaintiffs attached the Cybersecurity and Infrastructure Security Agency (CISA) advisory on LockBit, along with the agency’s StopRansomware guide, to their certification motion.

If the LockBit reading holds, it supports the theory that patient records left the network, since LockBit 3.0 is built around stealing data before encrypting it. The department’s forensic firm would only concede that “a limited amount of files may have been accessed,” a hedge that’s easier to hold when you’re characterizing your own investigation. The finding never got tested at trial, because the case settled first.

## A Class That Swallowed the Courthouse

The class grew larger than the county courthouse could accommodate. In October 2025 the defense told Judge Partney that more than 40% of Jefferson County’s inhabitants were presumed class members, that he was among them, that at least 27 other judges, clerks, and court employees appeared on the list, and that hundreds more were probably relatives of courthouse staff. The [motion for change of venue](https://www.courts.mo.gov/fv/c/Defendants%20Motions%20for%20Change%20of%20Judge%20for%20Cause%20and%20for%20Change%20of%20Venue%20from%20Inhabitants%20for%20Cause.PDF?courtCode=23&di=8016272) doesn’t dress it up. Jury selection with those numbers is close to impossible.

The class spread well past Jefferson County, per the same filing:

- St. Louis County, 10,056 members
- St. Louis City, 5,954
- Franklin County, 1,474
- St. Francois County, 1,045
- Ste. Genevieve County, 637

Partney recused himself on December 8, 2025. The case landed in St. Louis City in March 2026, and by September the parties had preliminary approval in hand.

## The Numbers Nobody Published

The deductible, the premium, the policy limits, and whoever funded the $2.25 million all stay private. The department’s [2024 annual report](https://jeffcohealth.org/wp-content/uploads/2026/04/2024AnnualReport.pdf), published January 30, 2025, points to a “stronger IT system.” The [2025 edition](https://jeffcohealth.org/wp-content/uploads/2026/04/2025-Annual-Report-5.pdf), published February 26, 2026, says the department “conducted regular HIPAA and cybersecurity training” and that “IT systems are secure, and we’ve strengthened internal processes.” The first went out four months before a judge certified the class; the second went out mid-litigation, with trial then set for later that year.

Judge McCarthy decides on December 10 whether the settlement is fair. If he approves it, the clearest account of a LockBit attack on a Missouri health department stays where it’s been since May 2025, in a court order that never made the news.