This California Health Network Was Just Hacked for the Third Time

What went wrong?

• By Kayla Matthews
• Apr 18, 2019

In today's media-heavy landscape, it doesn't take long for news to spread about data breaches. Once they become public knowledge, the potentially affected individuals scramble to protect themselves by enrolling in identity theft monitoring programs while the victimized companies fix their vulnerabilities.

A single data breach experienced by a company is damaging enough, but the Verity Health System of California and Verity Health Foundation, known collectively as Verity, suffered a third such issue. What went wrong?

Unauthorized Email Access

A press release from Verity about the most recent incidents confirms that in late November 2018 and mid-January 2019, an unauthorized third party accessed three of the company’s email accounts, including the attachments contained within the respective messages. Verity’s IT security team learned of those incidents hours after they occurred and immediately began assessing the scope of the issue. They disabled the affected email accounts and took them offline as a start. The company notified all relevant regulatory bodies, too.

A more in-depth investigation of the matter showed that the compromised email accounts contained health or medical information. Verity representatives said the content included details like names, billing codes, health insurance policy numbers, treatments given and medical conditions.

They also confirmed that some of the attachments in those email accounts had Social Security Numbers or driver’s license details. But, the results of Verity’s investigation at the time the company published its press release determined that the goal of those responsible was to get the login information of fellow users.

Like many recent data breaches before this one, the details about the incidents are not sufficient to give people peace of mind. For example, Verity stated that there was no evidence that this unknown and unauthorized party accessed or distributed the information held in those email accounts.

How Did the Company Respond?

Verity noted that its decision to notify potentially affected individuals came from “an abundance of caution.”

It offered a year of free credit monitoring to people who may have had their Social Security Numbers or driver’s license numbers accessed during the breach. The company set up a call center to field questions about these incidents, too.

Moreover, Verity launched an internal initiative to improve security. It includes mandatory password resets and disabling unknown URLs. Employees also had to go through a new training module after the incident.

Not the First Issues

The most recent issues reportedly involve phishing attempts. But, cybercriminals have also targeted the company in another way. In early January 2017, a hacker got into one of the company's websites. Even though Verity was not using that site at the time of the breach, it still contained data from more than 10,000 patients. In that case, the breach exposed partial credit card numbers.

Even more worrisome — the company left that website unsecured for more than a year before noticing the problem. As in the more recent cases, the company notified the appropriate authorities and took steps to stop future issues. But as the news headlines indicate, the actions taken were not sufficient.

Health Care Issues Cause Substantial Financial Burdens

In August 2018, Verity filed for bankruptcy and said the six hospitals in its network would stay open despite the development. It did not cite the January 2017 incident as a reason for the financial woes, but there's no question that problems like these have widespread effects for the health care industry at large and the organizations directly affected.

And, poor cybersecurity alone is not responsible for a health organization's expenses. A look at whistleblower lawsuits in 2018 shows that $2.5 billion of recoveries associated with the False Claims Act during that year related to health care fraud. So, fraud is another possible expense generator for health organizations, but how does it compare to data breach costs?

A 2018 report shows that health care has the highest cost per record, totaling $408 each. Then, a different report published by Protenus shows that between July and September 2018 alone, there were 4.4 million records breached during 117 incidents. The tremendous amount of loss in that brief period shows why it's crucial for health companies to take cybersecurity seriously.

Breaches Make Health Facilities Lose Business

The costs of health breaches go beyond the direct expenses incurred by cleaning up the aftermath of those incidents. Accenture published 2017 research about how health breaches impact consumers. Perhaps surprisingly considering the events above, 88 percent of those polled trusted health care professionals or facilities to keep their data safe.

But, when things went wrong, 91 percent of those polled showed proactive responses after breaches. A quarter of respondents said they changed health care providers after breaches. That finding emphasizes why Verity needs to view its cybersecurity struggles as top-priority problems to solve. If people haven't already decided not to continue using one of Verity's six hospitals, they may reach that conclusion soon.

Too Little, Too Late

Regardless of whether people were directly affected by the Verity breaches or only read about them in the headlines, they're undoubtedly left wondering how one company could have three breaches occur in a relatively short timespan.

Some will likely decide that whatever actions the company took fell short and that they cannot continue to trust Verity to safeguard its data. Three strikes spell trouble in baseball, and especially so when a company has three failures of its own that show it can't secure sensitive information.