A lawsuit has been filed against Community Health Systems (CHS) in relation to a major data breach it experienced that might have compromised more than four million personal records. 

Attorneys at Alabama-based law firm Stewart & Stewart filed the lawsuit against the hospital operator – which has 11 different locations in the state – on August 21. The suit represents five patients treated at Riverview Regional Medical Center, Gadsen Regional Medical Center, South Baldwin Regional Medical Center and Stringfellow Memorial Hospital, according to Alabama.com

The suit claims CHS failed to meet security standards to protect the personal information belonging to patients. 

According to a recent blog post by David Kennedy, principal security consultant and CEO at Ohio-based TrustedSec, attackers were able to obtain the data by exploiting the Heartbleed bug for access.