This California Health Network Was Just Hacked for the Third Time

This California Health Network Was Just Hacked for the Third Time

What went wrong?

In today's media-heavy landscape, it doesn't take long for news to spread about data breaches. Once they become public knowledge, the potentially affected individuals scramble to protect themselves by enrolling in identity theft monitoring programs while the victimized companies fix their vulnerabilities.

A single data breach experienced by a company is damaging enough, but the Verity Health System of California and Verity Health Foundation, known collectively as Verity, suffered a third such issue. What went wrong?

Unauthorized Email Access

A press release from Verity about the most recent incidents confirms that in late November 2018 and mid-January 2019, an unauthorized third party accessed three of the company’s email accounts, including the attachments contained within the respective messages. Verity’s IT security team learned of those incidents hours after they occurred and immediately began assessing the scope of the issue. They disabled the affected email accounts and took them offline as a start. The company notified all relevant regulatory bodies, too.

A more in-depth investigation of the matter showed that the compromised email accounts contained health or medical information. Verity representatives said the content included details like names, billing codes, health insurance policy numbers, treatments given and medical conditions.

They also confirmed that some of the attachments in those email accounts had Social Security Numbers or driver’s license details. But, the results of Verity’s investigation at the time the company published its press release determined that the goal of those responsible was to get the login information of fellow users.

Like many recent data breaches before this one, the details about the incidents are not sufficient to give people peace of mind. For example, Verity stated that there was no evidence that this unknown and unauthorized party accessed or distributed the information held in those email accounts.

How Did the Company Respond?

Verity noted that its decision to notify potentially affected individuals came from “an abundance of caution.”

It offered a year of free credit monitoring to people who may have had their Social Security Numbers or driver’s license numbers accessed during the breach. The company set up a call center to field questions about these incidents, too.

Moreover, Verity launched an internal initiative to improve security. It includes mandatory password resets and disabling unknown URLs. Employees also had to go through a new training module after the incident.

Not the First Issues

The most recent issues reportedly involve phishing attempts. But, cybercriminals have also targeted the company in another way. In early January 2017, a hacker got into one of the company's websites. Even though Verity was not using that site at the time of the breach, it still contained data from more than 10,000 patients. In that case, the breach exposed partial credit card numbers.

Even more worrisome — the company left that website unsecured for more than a year before noticing the problem. As in the more recent cases, the company notified the appropriate authorities and took steps to stop future issues. But as the news headlines indicate, the actions taken were not sufficient.

Health Care Issues Cause Substantial Financial Burdens

In August 2018, Verity filed for bankruptcy and said the six hospitals in its network would stay open despite the development. It did not cite the January 2017 incident as a reason for the financial woes, but there's no question that problems like these have widespread effects for the health care industry at large and the organizations directly affected.

And, poor cybersecurity alone is not responsible for a health organization's expenses. A look at whistleblower lawsuits in 2018 shows that $2.5 billion of recoveries associated with the False Claims Act during that year related to health care fraud. So, fraud is another possible expense generator for health organizations, but how does it compare to data breach costs?

A 2018 report shows that health care has the highest cost per record, totaling $408 each. Then, a different report published by Protenus shows that between July and September 2018 alone, there were 4.4 million records breached during 117 incidents. The tremendous amount of loss in that brief period shows why it's crucial for health companies to take cybersecurity seriously.

Breaches Make Health Facilities Lose Business

The costs of health breaches go beyond the direct expenses incurred by cleaning up the aftermath of those incidents. Accenture published 2017 research about how health breaches impact consumers. Perhaps surprisingly considering the events above, 88 percent of those polled trusted health care professionals or facilities to keep their data safe.

But, when things went wrong, 91 percent of those polled showed proactive responses after breaches. A quarter of respondents said they changed health care providers after breaches. That finding emphasizes why Verity needs to view its cybersecurity struggles as top-priority problems to solve. If people haven't already decided not to continue using one of Verity's six hospitals, they may reach that conclusion soon.

Too Little, Too Late

Regardless of whether people were directly affected by the Verity breaches or only read about them in the headlines, they're undoubtedly left wondering how one company could have three breaches occur in a relatively short timespan.

Some will likely decide that whatever actions the company took fell short and that they cannot continue to trust Verity to safeguard its data. Three strikes spell trouble in baseball, and especially so when a company has three failures of its own that show it can't secure sensitive information.

Featured

  • Just as Expected

    GSX produced a wonderful tradeshow earlier this week. Monday was surprisingly strong in the morning, and the afternoon wasn’t bad at all. That’s Monday’s results and asking attendees to travel on Sunday. Just a quick hint, no one wants to give up their weekend to travel and set up an exhibit booth. I’m just saying. Read Now

    • Industry Events
    • GSX
  • NOLA: The Crescent City

    Twenty years later we finds ourselves in New Orleans. Twenty years ago the aftermath of Hurricane Katrina forced exhibitors and attendees to look elsewhere for tradeshow floor space. Read Now

    • Industry Events
    • GSX
  • Nothing Artificial About this Intelligence

    I have been looking forward to this year’s GSX show in New Orleans, the Cresent City, or if you prefer The Big Easy. It seems like quite a while since we’ve been here. Twenty years ago, ASIS, as it was known then was literally washed out of the city by someone known as Katrina. It is a good thing to come back to NOLA. Read Now

  • From Monitors to Mission Control

    Security Operations Centers (SOC) were once defined by rows of static monitors, each displaying a single feed with operators quietly watching for issues. That model has become obsolete. Incidents evolve too quickly, data comes from multiple locations, and decisions must be made in seconds—not minutes. Read Now

  • New Gas Monkey Garage Venue Uses AI-Enhanced Video Technology

    Gas Monkey Garage, the automotive custom shop and entertainment brand founded by Richard Rawlings of Fast N’ Loud TV fame, has opened a vibrant new restaurant and bar in South Dakota, equipped with advanced, AI-enhanced video tech from IDIS Americas. Read Now

New Products

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises.

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.