This California Health Network Was Just Hacked for the Third Time

This California Health Network Was Just Hacked for the Third Time

What went wrong?

In today's media-heavy landscape, it doesn't take long for news to spread about data breaches. Once they become public knowledge, the potentially affected individuals scramble to protect themselves by enrolling in identity theft monitoring programs while the victimized companies fix their vulnerabilities.

A single data breach experienced by a company is damaging enough, but the Verity Health System of California and Verity Health Foundation, known collectively as Verity, suffered a third such issue. What went wrong?

Unauthorized Email Access

A press release from Verity about the most recent incidents confirms that in late November 2018 and mid-January 2019, an unauthorized third party accessed three of the company’s email accounts, including the attachments contained within the respective messages. Verity’s IT security team learned of those incidents hours after they occurred and immediately began assessing the scope of the issue. They disabled the affected email accounts and took them offline as a start. The company notified all relevant regulatory bodies, too.

A more in-depth investigation of the matter showed that the compromised email accounts contained health or medical information. Verity representatives said the content included details like names, billing codes, health insurance policy numbers, treatments given and medical conditions.

They also confirmed that some of the attachments in those email accounts had Social Security Numbers or driver’s license details. But, the results of Verity’s investigation at the time the company published its press release determined that the goal of those responsible was to get the login information of fellow users.

Like many recent data breaches before this one, the details about the incidents are not sufficient to give people peace of mind. For example, Verity stated that there was no evidence that this unknown and unauthorized party accessed or distributed the information held in those email accounts.

How Did the Company Respond?

Verity noted that its decision to notify potentially affected individuals came from “an abundance of caution.”

It offered a year of free credit monitoring to people who may have had their Social Security Numbers or driver’s license numbers accessed during the breach. The company set up a call center to field questions about these incidents, too.

Moreover, Verity launched an internal initiative to improve security. It includes mandatory password resets and disabling unknown URLs. Employees also had to go through a new training module after the incident.

Not the First Issues

The most recent issues reportedly involve phishing attempts. But, cybercriminals have also targeted the company in another way. In early January 2017, a hacker got into one of the company's websites. Even though Verity was not using that site at the time of the breach, it still contained data from more than 10,000 patients. In that case, the breach exposed partial credit card numbers.

Even more worrisome — the company left that website unsecured for more than a year before noticing the problem. As in the more recent cases, the company notified the appropriate authorities and took steps to stop future issues. But as the news headlines indicate, the actions taken were not sufficient.

Health Care Issues Cause Substantial Financial Burdens

In August 2018, Verity filed for bankruptcy and said the six hospitals in its network would stay open despite the development. It did not cite the January 2017 incident as a reason for the financial woes, but there's no question that problems like these have widespread effects for the health care industry at large and the organizations directly affected.

And, poor cybersecurity alone is not responsible for a health organization's expenses. A look at whistleblower lawsuits in 2018 shows that $2.5 billion of recoveries associated with the False Claims Act during that year related to health care fraud. So, fraud is another possible expense generator for health organizations, but how does it compare to data breach costs?

A 2018 report shows that health care has the highest cost per record, totaling $408 each. Then, a different report published by Protenus shows that between July and September 2018 alone, there were 4.4 million records breached during 117 incidents. The tremendous amount of loss in that brief period shows why it's crucial for health companies to take cybersecurity seriously.

Breaches Make Health Facilities Lose Business

The costs of health breaches go beyond the direct expenses incurred by cleaning up the aftermath of those incidents. Accenture published 2017 research about how health breaches impact consumers. Perhaps surprisingly considering the events above, 88 percent of those polled trusted health care professionals or facilities to keep their data safe.

But, when things went wrong, 91 percent of those polled showed proactive responses after breaches. A quarter of respondents said they changed health care providers after breaches. That finding emphasizes why Verity needs to view its cybersecurity struggles as top-priority problems to solve. If people haven't already decided not to continue using one of Verity's six hospitals, they may reach that conclusion soon.

Too Little, Too Late

Regardless of whether people were directly affected by the Verity breaches or only read about them in the headlines, they're undoubtedly left wondering how one company could have three breaches occur in a relatively short timespan.

Some will likely decide that whatever actions the company took fell short and that they cannot continue to trust Verity to safeguard its data. Three strikes spell trouble in baseball, and especially so when a company has three failures of its own that show it can't secure sensitive information.


  • Progressing in Capabilities

    Progressing in Capabilities

    Hazardous areas within industries like oil and gas, manufacturing, agriculture and the like, have long-sought reliable video surveillance cameras and equipment that can operate safely in these harsh and unpredictable environments. Read Now

  • A Comprehensive Nationwide Solution

    A Comprehensive Nationwide Solution

    Across the United States, manufacturing facilities, distribution centers, truck yards, parking lots and car dealerships all have a common concern. They are targets for catalytic converters. In nearly every region, cases of catalytic converter thefts have skyrocketed. Read Now

  • Planning for Your Perimeter

    Planning for Your Perimeter

    The perimeter is an organization’s first line of defense and a critical element of any security and surveillance program. Even if a building’s interior or exterior security is strong, without a solid perimeter surveillance approach any company or business is vulnerable. Read Now

  • The Key Issue

    The Key Issue

    It is February 2014. A woman is getting ready in her room on a cruise ship when she hears a knock on the door; it is a crewmember delivering breakfast. She is not presentable so she tells him to leave it by the door. Read Now

Featured Cybersecurity

New Products

  • Tyco Kantech EntraPass security management software

    Tyco Kantech EntraPass security management software

    Johnson Controls, the global leader in smart, healthy and sustainable buildings, and architect of the Open Blue digital connected platforms, has released the newest version of the Tyco Kantech EntraPass security management software. 3

  • SecureAuth


    The acceleration of digital transformation initiatives as a result of COVID-19 has created a lasting impact on how businesses empower their workforce and engage customers. 3

  • ComNet CNGE6FX2TX4PoE

    The ComNet cost-efficient CNGE6FX2TX4PoE is a six-port switch that offers four Gbps TX ports that support the IEEE802.3at standard and provide up to 30 watts of PoE to PDs. It also has a dedicated FX/TX combination port as well as a single FX SFP to act as an additional port or an uplink port, giving the user additional options in managing network traffic. The CNGE6FX2TX4PoE is designed for use in unconditioned environments and typically used in perimeter surveillance. 3