Verity Health System of California, Inc.

Verity Health System notified individuals that a third party compromised an employee's Microsoft 365 email account on November 27, 2018. The attacker sent emails with malicious links to obtain credentials. Health information, including SSNs and medical records, may have been accessed from email attachments. VHS acted as a business associate for O'Connor Hospital. The incident was contained, and credit monitoring was offered.

On January 26, 2019, Verity Health System of California, Inc. reported a hacking incident to HHS affecting 2,988 individuals. An unauthorized third party gained access to an employee's email account containing protected health information, including demographic, clinical, and financial data. The information was located on an email server. In response, the company implemented multi-factor authentication, enhanced password policies, and provided additional workforce training on identifying phishing attempts.

Affected (this filing): 2,988