We previously reported that Banner Health (Banner) started sending notices to over 3.7 million individuals about a data breach that started with food and beverage purchases and ended up compromising employee and patient information [view related post]. This data breach is the largest so far this year.

Less than a week after Banner started sending out the notices to individuals, two class action lawsuits have been filed against it—one by a physician and one by a physician’s assistant.

Just days following the notification, a physician on staff at Banner filed a class action lawsuit against Banner alleging that Banner was negligent and allowed the breach to occur. He seeks identity protection and credit monitoring, despite the fact that Banner is offering free credit and identity monitoring for one year.

According to the plaintiff, this is a “skimpy fix,” and the plaintiffs in that suit will be “asking for a more robust package.”

The second suit, filed in Arizona on August 9, 2016, by a physician’s assistant employed by Banner, alleges that Banner neglected its duty to protect sensitive information. It states that “[T]his data breach is a direct result of Banner Health’s failure to implement adequate cybersecurity measures commensurate with the duties it undertook by storing large amounts of customer information on its computer servers.”

The suit further alleges that one year of credit and identity monitoring for one year is “inadequate” and Banner’s provision of details surrounding the breach is “alarming.” The suit contends that Banner has not provided sufficient information to the affected individuals about the breach. The suit seeks compensatory and punitive damages.