Hoag and Delta Dental of Missouri face separate data incidents

Two separate data incidents surfaced this week, one at a hospital and one at a dental benefits carrier, and they illustrate two very different stages of how a breach becomes public.

Newport Beach, Calif.-based Hoag Memorial Hospital Presbyterian is notifying individuals of a cybersecurity incident that may have exposed personal and protected health information, according to a Nov. 4 notice filed with the California attorney general's office (Becker's Hospital Review). Hoag discovered suspicious network activity on Oct. 8, found that certain files may have been accessed without authorization, and engaged an independent team to review them. On Oct. 25 that review determined some individuals' information may have been included. The public letters list names and other personal or health information, with the remaining data elements shown as placeholders. The notice does not disclose how many people were affected or the cause. Hoag says it added security measures and is offering complimentary identity protection services.

Separately, dark web monitoring sites Ransomware.live and HookPhish posted that the n0n hacking group was responsible for a suspected breach at Delta Dental of Missouri, reportedly on Nov. 5 (Becker's Dental Review). Data reportedly exposed includes member and subscriber names, Social Security numbers, dates of birth, home addresses and dental treatment details. A company spokesperson said it is aware of the posting, has engaged independent forensic specialists, and that systems and services remain operational. The investigation is ongoing.

The evidence differs in strength. Hoag's account rests on its own regulatory filing. The Delta Dental claim rests on postings by a purported threat actor relayed through monitoring sites and has not been confirmed. Leaders should treat it as a credible signal to prepare for, not as an established fact.

For security and compliance teams, the Hoag timeline is a useful benchmark: roughly 17 days from discovery to a determination about affected data, and under four weeks from discovery to a filed notice. Measure your own playbook against it, including how quickly you can engage outside reviewers and stand up identity protection offers. Also note the gap Hoag's letters leave around data elements, which can generate patient and staff questions your phone teams will need scripts for.

For people leaders and benefits owners, the Delta Dental posting is a third-party risk. Confirm whether your patients or employees are covered by Delta Dental of Missouri, prepare communications that explain what is and is not confirmed, and ask your vendors how they would notify you if a claim like this named them.

You are a security and compliance advisor to the CISO and executive team of [your organization], a medical, health or wellness organization.

Context. Becker's Hospital Review reports that Hoag Memorial Hospital Presbyterian is notifying individuals of a cybersecurity incident that may have exposed personal and protected health information. Hoag discovered suspicious network activity Oct. 8. A review determined on Oct. 25 that some individuals' information may have been included. Hoag filed a notice with the California attorney general's office on Nov. 4. Becker's Dental Review reports that the dark web monitoring sites Ransomware.live and HookPhish posted that the n0n group was responsible for a suspected breach at Delta Dental of Missouri, reportedly on Nov. 5. Member names and Social Security numbers were among the data reportedly exposed. That claim rests on dark web postings and has not been confirmed in the source.

Task, to finish this week. First, set out how to confirm whether any of our patients or employees are covered by Delta Dental of Missouri, using [your benefits carrier list] and [your payer contract list]. Second, test our breach notification playbook against the Hoag timeline, comparing it with [your current days from discovery to determination] and [your current days from discovery to filed notice].

Output. A one-page memo for the executive team with these sections: What happened and how confirmed it is; Our exposure to Delta Dental of Missouri; Playbook timeline compared with Hoag; Gaps and owners, naming [your incident response lead] and [your benefits owner]; Decisions needed this week.

Guardrails. Use only the facts given here and the slots I fill. Cite Becker's Hospital Review and Becker's Dental Review by name. Keep the unconfirmed Delta Dental claim clearly labeled as unconfirmed. Flag anything uncertain or that must be verified with our legal counsel or the carrier. Do not request or include any patient data. Nothing here is medical or legal advice. Mark the memo as a draft for the team to check.