SAC Health System

SAC Health Systems (CA, Healthcare Provider) reported to HHS on 2021-05-10 that its business associate experienced a ransomware attack affecting the ePHI of 28,128 individuals. Breached information was located on a Network Server. Exposed data included names, addresses, Social Security numbers, financial and health insurance information, medications prescribed, and other treatment information. The CE notified HHS, affected individuals, and the media, and subsequently terminated its relationship with the affected BA.

Affected (this filing): 28,128

SAC Health System notified California AG of a data breach involving third-party provider Netgain Technology, LLC. Unauthorized access occurred between Nov 15-22, 2020, confirmed Jan 15, 2021. Affected data includes names, SSNs, DOBs, driver's licenses, financial accounts, and PHI. SAC Health System terminated Netgain, removed data, offered credit monitoring, and notified regulators. No actual misuse known.