A class action lawsuit has been filed against UCLA Health System after a breach exposed the personal data – including social security numbers and medical information – of 4.5 million individuals.

The suit, filed by Michael Allen in a federal court in California, accused UCLA of violating the state's Confidential Medical Information Act among other violations. UCLA Health announced July 17 that it had detected suspicious activity on its network on October 2014, and determined on May 5 that attackers accessed parts of the network containing the sensitive information.

The suit said the health system failed to properly secure the data and said victims “face a long term battle against identity theft.”

An investigation over several months revealed that “unknown cyber thieves now possess nonpublic personal and health information” on customers across the nation, according to court documents published by Health Law Policy Matters.