Yikes! Hacker steals 8,000,000 patient records, demands $10MM

[lblanchard]

Here's a cheerful note about online medical records:

Hackers break into Virginia Health Professions Database, Demand Ransom

If you follow this Washington Post story back to Wikileaks, you can see a replica of the taunting message left on the site's home page.

Comments

[johnpalmer.livejournal.com]

Well, if the records were encrypted, the threat is "pay me or the records go bye-bye".

If the records were not encrypted (or encrypted with insufficient strength, someone needs to be executed to lose their job. In fact, everyone competent (e.g., IT professionals and those who manage them) who had anything to do with it who didn't register their objections to a lack of encryption should lose their jobs.

[johnpalmer.livejournal.com]

Oh: And if they followed proper best practices for offsite backups, the threat is "somewhere between 24-48 hours of records go bye-bye." Repeat my prior comment, but I might reconsider the strike through on "to be executed" here. Off site backup is even more obvious than encryption.

[lblanchard.livejournal.com]

Not "pay me or I sell them to identity thieves and it will be lawsuit city for you"---?

[johnpalmer.livejournal.com]

If those records are properly encrypted, they're unreadable without the key.

(Checks the article)

Ah, I see.

What happened was, someone broke in (presumably digitally), erased the records, and encrypted the backups.

So, it *is* loss of the records that's at risk.

When done properly, a database of sensitive information will be encrypted, so that no one can read the records without the key. Now, if someone can get the key, they can pull the unencrypted information, but that's always going to be a risk. That's the same risk as hospital employees revealing confidential health records (e.g., of celebrities).

Attackers can threaten loss of the data - they can erase the files - but typically can't threaten revelation of the data because they can't read the records. And proper encryption takes a good many years to break, even using the fastest publicly-available systems. (The NSA might be able to do it faster - if so, they ain't telling.)

[lblanchard.livejournal.com]

Looks to me like someone broke in (presumably digitally) and left a really snotty message saying that they'd erased the message etc.

They may or may not have actually done it.

If I were the health folks, I'd lock that sucker down tight as a drum until I could be sure they hadn't run off with anything. And I wouldn't say jack until I knew.