This California Health Network Was Just Hacked for the Third Time

This California Health Network Was Just Hacked for the Third Time

What went wrong?

In today's media-heavy landscape, it doesn't take long for news to spread about data breaches. Once they become public knowledge, the potentially affected individuals scramble to protect themselves by enrolling in identity theft monitoring programs while the victimized companies fix their vulnerabilities.

A single data breach experienced by a company is damaging enough, but the Verity Health System of California and Verity Health Foundation, known collectively as Verity, suffered a third such issue. What went wrong?

Unauthorized Email Access

A press release from Verity about the most recent incidents confirms that in late November 2018 and mid-January 2019, an unauthorized third party accessed three of the company’s email accounts, including the attachments contained within the respective messages. Verity’s IT security team learned of those incidents hours after they occurred and immediately began assessing the scope of the issue. They disabled the affected email accounts and took them offline as a start. The company notified all relevant regulatory bodies, too.

A more in-depth investigation of the matter showed that the compromised email accounts contained health or medical information. Verity representatives said the content included details like names, billing codes, health insurance policy numbers, treatments given and medical conditions.

They also confirmed that some of the attachments in those email accounts had Social Security Numbers or driver’s license details. But, the results of Verity’s investigation at the time the company published its press release determined that the goal of those responsible was to get the login information of fellow users.

Like many recent data breaches before this one, the details about the incidents are not sufficient to give people peace of mind. For example, Verity stated that there was no evidence that this unknown and unauthorized party accessed or distributed the information held in those email accounts.

How Did the Company Respond?

Verity noted that its decision to notify potentially affected individuals came from “an abundance of caution.”

It offered a year of free credit monitoring to people who may have had their Social Security Numbers or driver’s license numbers accessed during the breach. The company set up a call center to field questions about these incidents, too.

Moreover, Verity launched an internal initiative to improve security. It includes mandatory password resets and disabling unknown URLs. Employees also had to go through a new training module after the incident.

Not the First Issues

The most recent issues reportedly involve phishing attempts. But, cybercriminals have also targeted the company in another way. In early January 2017, a hacker got into one of the company's websites. Even though Verity was not using that site at the time of the breach, it still contained data from more than 10,000 patients. In that case, the breach exposed partial credit card numbers.

Even more worrisome — the company left that website unsecured for more than a year before noticing the problem. As in the more recent cases, the company notified the appropriate authorities and took steps to stop future issues. But as the news headlines indicate, the actions taken were not sufficient.

Health Care Issues Cause Substantial Financial Burdens

In August 2018, Verity filed for bankruptcy and said the six hospitals in its network would stay open despite the development. It did not cite the January 2017 incident as a reason for the financial woes, but there's no question that problems like these have widespread effects for the health care industry at large and the organizations directly affected.

And, poor cybersecurity alone is not responsible for a health organization's expenses. A look at whistleblower lawsuits in 2018 shows that $2.5 billion of recoveries associated with the False Claims Act during that year related to health care fraud. So, fraud is another possible expense generator for health organizations, but how does it compare to data breach costs?

A 2018 report shows that health care has the highest cost per record, totaling $408 each. Then, a different report published by Protenus shows that between July and September 2018 alone, there were 4.4 million records breached during 117 incidents. The tremendous amount of loss in that brief period shows why it's crucial for health companies to take cybersecurity seriously.

Breaches Make Health Facilities Lose Business

The costs of health breaches go beyond the direct expenses incurred by cleaning up the aftermath of those incidents. Accenture published 2017 research about how health breaches impact consumers. Perhaps surprisingly considering the events above, 88 percent of those polled trusted health care professionals or facilities to keep their data safe.

But, when things went wrong, 91 percent of those polled showed proactive responses after breaches. A quarter of respondents said they changed health care providers after breaches. That finding emphasizes why Verity needs to view its cybersecurity struggles as top-priority problems to solve. If people haven't already decided not to continue using one of Verity's six hospitals, they may reach that conclusion soon.

Too Little, Too Late

Regardless of whether people were directly affected by the Verity breaches or only read about them in the headlines, they're undoubtedly left wondering how one company could have three breaches occur in a relatively short timespan.

Some will likely decide that whatever actions the company took fell short and that they cannot continue to trust Verity to safeguard its data. Three strikes spell trouble in baseball, and especially so when a company has three failures of its own that show it can't secure sensitive information.

Featured

  • New Report Reveals Top Trends Transforming Access Controller Technology

    Mercury Security, a provider in access control hardware and open platform solutions, has published its Trends in Access Controllers Report, based on a survey of over 450 security professionals across North America and Europe. The findings highlight the controller’s vital role in a physical access control system (PACS), where the device not only enforces access policies but also connects with readers to verify user credentials—ranging from ID badges to biometrics and mobile identities. With 72% of respondents identifying the controller as a critical or important factor in PACS design, the report underscores how the choice of controller platform has become a strategic decision for today’s security leaders. Read Now

  • Overwhelming Majority of CISOs Anticipate Surge in Cyber Attacks Over the Next Three Years

    An overwhelming 98% of chief information security officers (CISOs) expect a surge in cyber attacks over the next three years as organizations face an increasingly complex and artificial intelligence (AI)-driven digital threat landscape. This is according to new research conducted among 300 CISOs, chief information officers (CIOs), and senior IT professionals by CSC1, the leading provider of enterprise-class domain and domain name system (DNS) security. Read Now

  • ASIS International Introduces New ANSI-Approved Investigations Standard

    • Guard Services
  • Cloud Security Alliance Brings AI-Assisted Auditing to Cloud Computing

    The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today introduced an innovative addition to its suite of Security, Trust, Assurance and Risk (STAR) Registry assessments with the launch of Valid-AI-ted, an AI-powered, automated validation system. The new tool provides an automated quality check of assurance information of STAR Level 1 self-assessments using state-of-the-art LLM technology. Read Now

  • Report: Nearly 1 in 5 Healthcare Leaders Say Cyberattacks Have Impacted Patient Care

    Omega Systems, a provider of managed IT and security services, today released new research that reveals the growing impact of cybersecurity challenges on leading healthcare organizations and patient safety. According to the 2025 Healthcare IT Landscape Report, 19% of healthcare leaders say a cyberattack has already disrupted patient care, and more than half (52%) believe a fatal cyber-related incident is inevitable within the next five years. Read Now

New Products

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.”

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.