Slashdot Mirror
Backup Tapes With 2 Million Medical Records Stolen
Lucas123 writes "A vehicle used by an off-site archive company to transport patient data was broken into on March 17. The University of Miami just made the theft public last week, saying the thieves removed a transport case carrying the school's six computer backup tapes. On those tapes were more than 2 million medical records. In fact, the archive company waited 48 hours before notifying the university itself. A University spokeswoman said the school has stopped shipping backup tapes off-site for now."
This case should be pretty simple to solve. Just track down whoever buys a 9-track tape reader off eBay in the next month and nail him to the wall.
John
From TFA:
After learning about the data breach, the university contacted local computer forensics companies to see if data on a similar set of backup tapes could be accessed. Menendez said security experts at Terremark Worldwide Inc. "tried for days" to decode the data but could not because of proprietary compression and encoding tools used to write data to the storage tapes.
Proprietary compression and encoding tools? the article reeks of FUD but proprietary technologies still aren't without their faults...but eh, it's not like they used this "09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0", right?
What would YOU pay for 2 million social security numbers?
Transporting confidential data off-site via any medium, including the Internet, without industry-recognized encryption (not something that is proprietary and untested) ought to be a criminal offense with severe penalties.
TFA talks about proprietary compression and encoding and not about encryption. I simply do not believe that it is difficult to recover that data - whatever proprietary software wrote those files can be obtained from somewhere for a price. You can probably Google the file extension or some information in the header to determine the format and/or software. "The university feels confident that the person who took [the tapes] doesn't know what they have." They do now! "Even though I am confident that our patients' data is safe, we felt that in the best interest of the physician-patient relationship we should be transparent in this matter." That data is not safe. At best it is in an obscure, but not secure format.
It's incredible, really. Since TrueCrypt 5.0 arrived,I don't even carry my work laptop or flash drives around without either full disk encryption or encrypted container files on them, and they do not contain anything as sensitive as 2 million medical records.
On the black market these days, a full identity (name, SSN, address, bank information, etc) can go for $14 each. If the tapes had full identities, that's 2 million x $14 = $28 million payday for a bunch of crooks. Even assume a "volume discount" for these guys and they're still in the many million dollar range. Even if it's just name, address, and SSN there's some value on the black market for these tapes.
When you're breaking into a vehicle filled with stuff that looks like computer equipment, it's hard to know whether the data is going to be social security numbers (valuable), credit card numbers (valuable), medical records (valuable if there's addresses and SSNs), or routine corporate records (not all that valuable). Enough data brokers are sloppy enough with their security that there's a good chance to get some identity information that has value.
These guys were either extremely lucky or knew exactly what they were doing. Or they're complete idiots who are wondering why these tapes won't play on their 8-track player.
I wouldn't.
The university feels confident that the person who took [the tapes] doesn't know what they have....
Ah, and how exactly does it make sense that you just told the world? (Not that I did beleve you in the first place.)
Can these hospitals not be able to use armored vehicle services, such as Brinks, to take these tapes to a bank with safety deposit boxes?????
What would be so hard to set something up like that for any of the states VIP information storing?
I'm getting a little sick and tired of the lowest guy/girl on the totem pole who is in charge of delivering off site critical information and losing it. Ok, I'm done!
Not to mention the fact that those records might be worth more than $100,000,000 on the black marked.
The article is very careful to phrase it as "2 million medical records." I somehow doubt that this means the medical records of 2 million separate individuals -- if it did, surely the news outlet would have said so, as it is much more dramatic. I bet a "medical record" is a single row in the database, and what was really stolen was a DB with 2 million records (as in "rows") in it. I seriously doubt the medical records of 2 million people are all collected on a single set of tapes.
It was only a matter of time before something like this happened.
Medical staff and any other people untrained in information security just aren't going to have the computer literacy or "computer common sense" to handle millions of peoples' medical records adequately.
On the other hand, if they were thoroughly trained, certified and passed through the wringer for those leet skillz, then the overhead for medical costs would balloon even higher as yet another bureaucracy (to manage *that*) is created within health maintenance providers.
But it's all in the name of tracking your every move, so I guess it's OK.
You can't send a takedown notice to an already printed newspaper.
For Example: Alot of people don't want to publically share that they have STDs etc. Especially not if the files are cross linked with a list of their sexual partners.
While sale for identity fraud would most likely be the most profitable, there are alternative uses for this data. Given the enterprising nature of most criminals, this is a gold mine.
Among things mentioned by others, it enables you to blackmail people who have sensitive medical conditions they don't want the whole world knowing about.
Multi key, multi volume encryption: Lock each of the tapes in a different cabinet in the van, each with a different key.
Security through obscurity: Remove large sign on van reading "Secure Data Transport, 'Transporting your valuable data since 1991'" replace with "Flowers By Irene"
Introduce comprehensive staff security training: Hold their families hostage, and tell them that if they lose the data...
Tape is so last millennium. Anybody who's anybody backs up to hard drives across the internet.
No sig for you. YOU GET NO SIG!
If the IT staff are worth their salt then these backup tapes wont be worth anything. Anything that is in danger of being stolen should be encrypted.
I work in Health IT, and it is standard practice for us to, at a minimum, GPG encrypt any backup going offsite. Infact a practice cannot pass accreditation unless this is the case.
If this wasn't the case in this situation, then all parties involved need to have a serious think about what they're doing.
More often than not, homeless people, and petty crooks just steal AYTHING out of cars hoping to get pennies on the dollar for whatever they stole. A nice looking, shiny case was probably thought to have some nice stuff in it, other than tapes. I bet the tapes are in some sewer drain or dumpster by now, and the case is being pawned for 5 dollars.
..........FULL STOP.
Let's see here. Archive America waited 2 days. Then the university waited 27 more days. Who needs to do the most explaining?
now we need to go OSS in diesel cars
Proprietary compression cannot be cracked? I can tell you that this can be hard to do. And this is from experience. I once worked at a company where a project one year involved writing some programs to extract data from files stored be various competitor products to enable customers to easily migrate to our products. I was given the one that the managers thought wasn't even possible to do, because the data look like gibberish (because, unknown to them at the time, it was compression). It took me FIVE weeks to reverse engineer it. It was not quite as good as UNIX compress, but it was much better than run length compression.
Whether these data tapes are crackable is unknown to me. But if they were encrypted by today's strong forms of encryption, then I know I could not crack that.
now we need to go OSS in diesel cars
Some vendors like Sun and IBM give the key management stations away for free if you use encryption. People just do not understand how hi-tech tape is nowadays. Everyones perception of tape is old DAT, people need to look at Sun T10000, IBM TSxxxx or LT04. If you are archiving data for a long time there is no other ecological option than tape. It's longevity (of the quality products) has been proven over the last 20yrs. Tape is not that interesting, but it is like brushing you teeth, you know it is a good thing for the long run.
I wouldn't buy a stolen rolex for 30$ either, therefore no stolen rolex is ever resold.
Awful logic isn't that?
The correct question is: how much would you pay for 2M medical records if you were in the insurance business?
There's nothing in the article that says they were encrypted. They were compressed and some kind of encoding was involved. But encoding could be any number of things, and quite possibly the coding used by medical records systems to compact common terms to numbers. It could be hard to make use of the data. But if it was an "inside job", or the perps can get the software used on this, it can be cracked easily. This is not strong encryption.
now we need to go OSS in diesel cars
"For now".
I highly suspect this translates as "until we think people have forgotten about this". Why fix the problem when we can just pretend it's gone away?
Breaking Into the Industry - A development log about starting a game studio.
It shouldn't be easy to steal these things. It's time valuable data is treated like it has value. That means armored vehicles for transport.
Maybe they should list SSNs, Birthdays, and Addresses in the foreign exchange markets so people will get a clue.
The exact same thing happened at Louisiana State University in sept of last year.
That time it was the fasfa records for the entire school.
I'm actually starting to get a little bit suspicious that there is a pattern forming.
I started to try and compile a listing of backups, laptops, Usb keys and hard drives stolen from universities, but the listing quickly grew beyond what I would like to post on slashdot.
Instead, i'll just post a site that has most of them listed already. Just do a search for the word UNIVERSITY.
http://attrition.org/dataloss/
Get your most closely kept personal thought: .doc with a password lock. .rar with extraction precluded .rar because so far they ain't impressed. .pgp and print the hex of it out,
put it in the Word
Stock it deep in the
by the ludicrous length and the strength of a reputedly
dictionary-attack-proof string of characters
(this, imperative to thwart all the disparagers
of privacy: the NSA and Homeland S).
You better PGP the
You better take the
scan that into a TIFF. Then, if you seek redoubt
for your data, scramble up the order of the pixels
with a one-time pad that describes the fun time had by the thick-soled-
boot-wearing stomper who danced to produce random
claptrap, all the intervals in between which, set in tandem
with the stomps themselves, begat a seed of math unguessable.
Ain't no complaint about this cipher that's redressable!
Best of all, your secret: nothing extant could extract it.
By 2025 a children's Speak & Spell could crack it.
You can't hide secrets from the future with math.
You can try, but I bet that in the future they laugh
at the half-assed schemes and algorithms amassed
to enforce cryptographs in the past.
Say bad words about my book, in cold oatmeal, or I shall sue!
Anybody who uses encryption wisely knows that they should guard the key with their life (not literally), not just from being stolen but also from being -lost-. That typically includes keeping a second set of the keys (protection against loss; unless both sites are hit at the same time) somewhere only you know about (protection from targeted theft) in a way that makes it nigh impossible to determine what they're for (protection from random theft); or just useless once realized they're compromised (change the keys, change the location, move on).
Encryption is pointless if the key itself is stored with the encrypted content (as various media protections show), and dangerous if the key can be 'lost'.
"On the black market these days, a full identity (name, SSN, address, bank information, etc) can go for $14 each."
Good answer. Next question: Doesn't all modern tape backup software encrypt all data?
Even my personal DVD backups are encrypted automatically.
It's going to keep happening. This sort of sloppy data handling is going to continue until there's proper incentive to protect data. And that means (IMHO) crippling penalties for those involved. Penalties so immense that the business nearly goes under. Penalties for the individuals who allowed unencrypted data to be put at risk - not just the peons swapping tapes, but the executives who didn't mandate/allow proper procedures. All the way up the food chain.
This stuff has to be taken seriously, but right now - no one does.
I wonder if the HIPPA compliance officer got canned. Why the hell wasn't this data encrypted?
HTH, HAND :)
Seriously though, there's overhead and hassle involved with encrypted backups. The value of a backup is greatly diminished if you can't restore it.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I work for a health care organization. We ship our backups off-site just like these guys. When it comes to encrypting hard drives, what you say makes sense. When it comes to backup tapes, it's not going to happen. The main reason is that encryption is slow. If I have to restore 500 GB of data and decrypt it, suddenly you're telling physicians that they can't get to the patient information they need to treat the patient even later than before. If someone loses the encryption keys, the information patients need to stay alive is simply gone forever.
I think it's important to safeguard information. At the same time, I see these sort of cases sensationalized and lawyers demand decisions that are incredibly stupid. We don't save e-mail past a year any more because of legal issues. This means that I can't solve issues or know what was going on unless I take cumbersome actions to save data off somewhere (made deliberately difficult). What you're suggesting is that lawyers should run even more of our business.
I've worked on a project from a very large software company that deals with encrypted tapes and is on the market. The idea is that the tape has been stolen. Who cares? You need to get the key that encrypted it, the key of the tape drive that wrote the tape, and get a drive itself. Not easy as they vet who buys. Yes, it can be done but not by your ordinary thief. Could it have contained 2 mil medical records? I don't know, the tapes we were using two years ago were 400 gig. One person mentioned it must be related to a mainframe. Nope, modern workstations and tape drives. Tape is a thriving medium in some circles. A buttload of storage the size of a cigarette pack that is dirt cheap. The system I've worked on is on the market and the idea is very good. There were some serious problems with the project and I don't know (and truthfully don't care) if they've been worked out. However, a thief without a large, well equipped organization behind them would still be at a loss what to do with the encrypted tape.
I really don't understand why companies use "archive companies". It's like online backup as well. I don't trust ANYONE with my freakin data. It works simply in our shop. Every morning I take the tape from the day before and put it in my briefcase. I take it home with me so it is offsite. Why didn't the school simply just have a trustful employee take the tapes home with him? taking tapes offsite is definitely a good thing in case the building were to catch fire and whatnot, but christ, what the fuck is an archive company and why would you trust them?
*plays the Apogee theme song music*
Well after the "complete idiots" who stole the tapes read Slashdot, they know know they hit the jackpot.
Gotta be a lot of retired mainframe guys around who would "do a consulting job".
If I ran a medical insurance company, those tapes could let me know whose applications to deny and whose to accept. Very valuable indeed.
But it's all in the name of tracking your every move, so I guess it's OK. Your network should be secure (they don't set that up)
The software they use should be secure (they didn't write it)
The method you use to transmit your claims should be secure (they don't set that up)
All you have to tell them is "don't email claim/medical record files" I have taught literally hundreds and hundreds of shockingly stupid people (the people at your doctor's office or the hospital that do the billing are almost certainly the lowest paid people in the chain...in the ballpark of minimum wage) how to zip and encrypt a file so they can email it. With 7zip it is a 3 step process.
Insurance companies have to track your every move when it involves you going to the doctor/hospital.
http://www.hhs.gov/ocr/hipaa/
The key here is knowingly or recklessly doing it, The university is in the clear here. They had every reason to expect that the company they were using was protecting the data they gave them.
If I used the same company and heard about this I would immediately switch companies, so although they probably won't get in any legal trouble they will certainly pay a penalty for it.
Complete idiots don't read Slashdot. Oh, wait ...
I work for the University of Miami. These tapes will be entirely useless to anyone who snags them, and no, we haven't stopped off-site shipping. All of our off-site tapes are highly encrypted. We aren't idiots.
Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo!
Mr. Obvious asks:
What does a University need with 2 Million medical records? Since when did patients agree that Universities could have a copy of their information?
No trees were killed in the making of this post; however, many trillions of electrons were horribly inconvenienced.
University of Miami partially runs one of the largest hospitals in Miami, Jackson Memorial.
Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo!
Apparently not. Incompetents.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Every week there is a new article about tapes stolen, backups lost, website reveals SSN's, X thousand/million SSN's or personal info...
idtheft?
idiotsloosedata?
The last time I bought tapes (SDLT2 600GB tapes) they were $80 each. $80 x 6 = $480
Beyond that, the value depends on how resourceful you are. If it were me (running across tapes..not stealing them) I'd spend some time getting to know the data involved. Then, I might start investigating parties who might be interested in that data.
Your average car thief doesn't have the skills or the thousands of dollars of equipment necessary to really utilize that data.
If I had to guess...the case was sold (if it was a nice one) after the thief threw the tapes in a dumpster.
"Lame" - Galaxar
$0.00, before court, legal fees, etc.
I've never been happier to be unable to afford to go to a doctor. :D
Oh, fuck yes.
Please stop stalking me, bro.