This California Health Network Was Just Hacked for the Third Time

This California Health Network Was Just Hacked for the Third Time

What went wrong?

In today's media-heavy landscape, it doesn't take long for news to spread about data breaches. Once they become public knowledge, the potentially affected individuals scramble to protect themselves by enrolling in identity theft monitoring programs while the victimized companies fix their vulnerabilities.

A single data breach experienced by a company is damaging enough, but the Verity Health System of California and Verity Health Foundation, known collectively as Verity, suffered a third such issue. What went wrong?

Unauthorized Email Access

A press release from Verity about the most recent incidents confirms that in late November 2018 and mid-January 2019, an unauthorized third party accessed three of the company’s email accounts, including the attachments contained within the respective messages. Verity’s IT security team learned of those incidents hours after they occurred and immediately began assessing the scope of the issue. They disabled the affected email accounts and took them offline as a start. The company notified all relevant regulatory bodies, too.

A more in-depth investigation of the matter showed that the compromised email accounts contained health or medical information. Verity representatives said the content included details like names, billing codes, health insurance policy numbers, treatments given and medical conditions.

They also confirmed that some of the attachments in those email accounts had Social Security Numbers or driver’s license details. But, the results of Verity’s investigation at the time the company published its press release determined that the goal of those responsible was to get the login information of fellow users.

Like many recent data breaches before this one, the details about the incidents are not sufficient to give people peace of mind. For example, Verity stated that there was no evidence that this unknown and unauthorized party accessed or distributed the information held in those email accounts.

How Did the Company Respond?

Verity noted that its decision to notify potentially affected individuals came from “an abundance of caution.”

It offered a year of free credit monitoring to people who may have had their Social Security Numbers or driver’s license numbers accessed during the breach. The company set up a call center to field questions about these incidents, too.

Moreover, Verity launched an internal initiative to improve security. It includes mandatory password resets and disabling unknown URLs. Employees also had to go through a new training module after the incident.

Not the First Issues

The most recent issues reportedly involve phishing attempts. But, cybercriminals have also targeted the company in another way. In early January 2017, a hacker got into one of the company's websites. Even though Verity was not using that site at the time of the breach, it still contained data from more than 10,000 patients. In that case, the breach exposed partial credit card numbers.

Even more worrisome — the company left that website unsecured for more than a year before noticing the problem. As in the more recent cases, the company notified the appropriate authorities and took steps to stop future issues. But as the news headlines indicate, the actions taken were not sufficient.

Health Care Issues Cause Substantial Financial Burdens

In August 2018, Verity filed for bankruptcy and said the six hospitals in its network would stay open despite the development. It did not cite the January 2017 incident as a reason for the financial woes, but there's no question that problems like these have widespread effects for the health care industry at large and the organizations directly affected.

And, poor cybersecurity alone is not responsible for a health organization's expenses. A look at whistleblower lawsuits in 2018 shows that $2.5 billion of recoveries associated with the False Claims Act during that year related to health care fraud. So, fraud is another possible expense generator for health organizations, but how does it compare to data breach costs?

A 2018 report shows that health care has the highest cost per record, totaling $408 each. Then, a different report published by Protenus shows that between July and September 2018 alone, there were 4.4 million records breached during 117 incidents. The tremendous amount of loss in that brief period shows why it's crucial for health companies to take cybersecurity seriously.

Breaches Make Health Facilities Lose Business

The costs of health breaches go beyond the direct expenses incurred by cleaning up the aftermath of those incidents. Accenture published 2017 research about how health breaches impact consumers. Perhaps surprisingly considering the events above, 88 percent of those polled trusted health care professionals or facilities to keep their data safe.

But, when things went wrong, 91 percent of those polled showed proactive responses after breaches. A quarter of respondents said they changed health care providers after breaches. That finding emphasizes why Verity needs to view its cybersecurity struggles as top-priority problems to solve. If people haven't already decided not to continue using one of Verity's six hospitals, they may reach that conclusion soon.

Too Little, Too Late

Regardless of whether people were directly affected by the Verity breaches or only read about them in the headlines, they're undoubtedly left wondering how one company could have three breaches occur in a relatively short timespan.

Some will likely decide that whatever actions the company took fell short and that they cannot continue to trust Verity to safeguard its data. Three strikes spell trouble in baseball, and especially so when a company has three failures of its own that show it can't secure sensitive information.

Featured

  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • The Power of a Layered Approach to Safety

    In a perfect world, every school would have an unlimited budget to help secure their schools. In reality, schools must prioritize what budget they have while navigating the complexities surrounding school security and lockdown. Read Now

  • How a Security System Can Enhance Arena Safety and the Fan Experience

    Ensuring guests have both a memorable experience and a safe one is no small feat for your physical security team. Stadiums, ballparks, arenas, and other large event venues are increasingly leveraging new technologies to transform the fan experience and maintain a high level of security. The goal is to preserve the integrity and excitement of the event while enhancing security and remaining “behind the scenes.” Read Now

  • Protecting Data is Critical

    To say that the Internet of Things (IoT) has become a part of everyday life would be a dramatic understatement. At this point, you would be hard-pressed to find an electronic device that is not connected to the internet. Read Now

Featured Cybersecurity

Webinars

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3