Insurer Sues IT Provider Over $3M Liability Coverage Dispute Following City of Hope Data Breach Starr Surplus Lines Insurance Co., the excess information security insurer for City of Hope National Medical Center, has filed a lawsuit against IT services provider Infinite Computer Solutions Inc. The suit, filed Tuesday in the U.S. District Court for the District of Maryland, alleges Infinite violated its agreement to secure $3 million in liability insurance coverage with City of Hope named as an additional insured. The legal action follows a major data breach at the cancer treatment and research center, a nationally recognized institution. Starr Surplus Lines claims Infinite failed to fulfill its contractual obligation, leaving the insurer potentially exposed in the aftermath of the incident. The case underscores the complexities of cyber insurance agreements and third-party vendor accountability in high-stakes data security incidents.

The California Office of the Attorney General reported that City of Hope experienced a data breach involving unauthorized access to systems resulting in potential exposure of personal information between September 19, 2023, and October 12, 2023. The breach was reported on April 2, 2024, and is believed to have affected various personal information types including names, contact information, and financial details; the exact number of individuals affected is unspecified.

On April 2, 2024, the Washington State Office of the Attorney General reported a data breach involving City of Hope. The breach, which affected 3,784 Washington residents, resulted from a cyberattack that began on September 19, 2023, and was discovered on October 13, 2023. The compromised information may include names, Social Security numbers, and medical records.

The California Office of the Attorney General reported that City of Hope experienced a phishing email incident that compromised the email accounts of four staff members on May 31 and June 2, 2017. The breach potentially exposed protected health information (PHI) of individuals, including names and medical record information. The report was made on August 3, 2017.