Verity Health System of California, Inc.

On January 26, 2019, Verity Health System of California, Inc. reported a hacking incident to HHS affecting 2,988 individuals. An unauthorized third party gained access to an employee's email account containing protected health information, including demographic, clinical, and financial data. The information was located on an email server. In response, the company implemented multi-factor authentication, enhanced password policies, and provided additional workforce training on identifying phishing attempts.

Verity Health System notified individuals that a third party compromised an employee's Microsoft 365 email account on November 27, 2018. The attacker sent emails with malicious links to obtain credentials. Health information, including SSNs and medical records, may have been accessed from email attachments. VHS acted as a business associate for O'Connor Hospital. The incident was contained, and credit monitoring was offered.

Verity Health System experienced a phishing incident on April 27, 2016, where an employee was targeted by a scammer impersonating a Verity executive. The employee disclosed names, addresses, Social Security numbers, and W-2 earnings information for current and former employees. No patient information or systems were breached. Verity notified law enforcement, engaged outside experts, and provided two years of free identity protection services through Equifax to affected employees.