Social EngineeringPhishingStolen CredentialsBusiness Associate (HIPAA)Customer Data InvolvedPHIHEALTH_BASICIDENTITY_GOVERNMENTIDENTITY_BASICFINANCIAL_ACCOUNTMediumContained
Verity Health System of California, Inc.
bd_0c503f51cc8e8c33 · schema v1 · pii pii-v1
Full breach record for Verity Health System of California, Inc. →Verity Health System notified individuals that a third party compromised an employee's Microsoft 365 email account on November 27, 2018. The attacker sent emails with malicious links to obtain credentials. Health information, including SSNs and medical records, may have been accessed from email attachments. VHS acted as a business associate for O'Connor Hospital. The incident was contained, and credit monitoring was offered.
California clockDiscovered Nov 27, 2018 → Notified Jan 25, 201959d ✓ CA 60-day OK8 weeks discovery → filing
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_c973d28fb73beca1HHS OCRfiled 2019-01-26(1d gap)Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-144152
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 25, 2019
- Raw hash
- 88dee96a26c722dff76e6e9e6c48a1f718a4469afcb6ea4ad65b986d10e5cb4a
Reporting entity
- Name
- Verity Health System of California, Inc.norm: verity health system of california
Victim entity
- Name
- Verity Health System of California, Inc.norm: verity health system of california
Incident
- Discovered
- Nov 27, 2018
- Materiality determined
- —
- Notification sent
- Jan 25, 2019
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICIDENTITY_GOVERNMENTIDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 8 weeks(59 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 59d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Nov 27, 2018→ Notified: Jan 25, 201959d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.