At issue are the obligations of health care organizations to defend their data, and victims’ ability to hold them accountable for failing to do so.

Cybercriminals reportedly posted batches of Vastaamo's patient information on the dark web and claimed that individual people could protect their data by directly paying a ransom.