Slashdot Mirror
Blue Shield Leaks 18,000 Doctors' Social Security Numbers
itwbennett (1594911) writes "The Social Security numbers of roughly 18,000 California physicians and health-care providers were inadvertently made public after a slip-up at health insurance provider Blue Shield of California, the organization said Monday. The numbers were included in monthly filings on medical providers that Blue Shield is required to make to the state's Department of Managed Health Care (DMHC). The provider rosters for February, March and April 2013 included the SSNs and other sensitive information and were available under the state's public records law."
Ten copies were requested under the public records law.
With so many SSNs leaked, the odds of a criminal picking yours are getting worse all the time!
When you consider that most doctors are broke and teetering on the brink of bankruptcy, nobody would want to steal their identities anyway.
How could a criminal use SSNs anyway?
What types of scam/hack/crime would be possible?
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
I've been through identity theft. It's not fun. And I was lucky enough to catch it quick enough that little damage was done. Capital One approved a card for "me" based on an online form where the thieves had my name, address, DOB, and SSN. Mother's maiden name was wrong, but that didn't stop the approval process. The thieves paid for rush delivery of the card and then changed the address on it. This meant that the card was sent to me BEFORE the address change went through. If this hadn't happened, I would have only known about it once the bill collectors came barging down my door.
On a side note: Capital One was not helpful at all. They stonewalled both me ("If we tell you the address on the card and you go and kill the person, we're liable" = what they actually told me) and the police (gave them a phone number linked to an answering machine and never called back). The combination of their approval of the card, missing all of the red flags along the way, and refusing to help beyond canceling the card means Capital One will NEVER be "what's in my wallet."
For those who think they have bad credit and thus wouldn't be victims, it doesn't take much. Remember, the thieves don't care about whether you can pay back the bills they are generating. All it takes is one credit card company to approve a card and they'll tear through the balance leaving you with thousands in debt that you'll need to prove wasn't your doing. In addition, there's another form of identity theft where a criminal is arrested and gives your name/SSN/DOB instead of their own. Then your name goes into the police databases and you'll be harassed as an assumed criminal. Removal of your name can take years during which time you'll flunk any background checks.
There's no protection that I know of from the latter form of identity theft, but you can freeze your credit to protect against the former. This means that nobody - not even you - can open new lines of credit unless you first thaw the credit files. The downside is that you need to pay to freeze and for each thaw. The upside is that you have a handy retort for all of those "You can save $5 if you open up a credit account with us" offers at the cash register. "No, thanks. My credit file is frozen." I've found these people stop their sales push the minute they hear you were a victim of identity theft. (I don't think that's in the script they are supposed to read to customers. ;-) )
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
I used to work for one of companies that lives under umbrella of BlueCross BlueShield (the biggest one) as IT contractor.
Somehow, I am not surprised by the leak. Office of Information Security department was located next my office. People who worked in Info Sec, had no knowledge of security. More or less, it was managerial type of work. They knew is how to use security software, that was often outdated.
Funny part, Info Sec was responsible for keeping up with browsing habits of employees. So, one day, me and couple other guys were looking at boats on the internet. All of the sudden, one of the Info Sec officers rushes into our office, yielding at us: "Stop watching boats on the internet"
Apparently, word "boats" triggered alarm call at the Info Sec. Info Sec has Zero Competence.
to screw up is human, to really screw up requires a computer.
Another example of why stupid people shouldn't be left in charge. These folks are responsible for managing billions of dollars in health care premiums and payments and a failure in data management policies has lead to a breach. I'm sure they'll just offer the poor doctors "Lifelock" for a year. No wonder our healthcare system is so fucked up.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
I thought only the internal revenue service, credit card companies, banks and employers need a persons SSN. Why does the health care industry need it? Do they perform credit checks or something?
I'm going to guess that these filings are done electronically. And that the information provided must fit some sort of pre-arranged schema. Back in the old paper days, a form with labeled fields to be filled out. So if some moron ran a SELECT * to populate the report, the state should have rejected it as not being filled out properly.
Or is this one of these reports that the state requires but never uses? Something that has been done by tradition but everyone has forgotten about the reasoning behind it. So it just gets filed (and posted to a public server these days) with no further thought.
Have gnu, will travel.
First, it's not hard to get, if you are (1) close to the target or (2) the NSA or (3) a criminal or (4) hang around some in one of the first three groups.
Second, if people and institutions are tending to rely on this information to make decisions about particular individuals, they are just wrong. They ought not to and if they do they should be incarcerated fined and sued for damages.
Granted all that data can model groups, or insurance companies and many other similar activities just would not work. Useless in dealing with people one at a time, whether on has friendly or hostile intent.
Finally, people evolved and until recently - no more than 12,000 years ago - invariably lived so that all knew everything about everyone they dealt with. That is the normal for homo sapiens. Privacy, anonymity and so on are artifacts of incompetent technology, and seem thought to be of value because commonly said incompetent technology has been unwisely if not maliciously used.
Gossip isn't intrinsically malicious - just an effective way of pressuring people to conform, and the least violent and intrusive such thing so far discovered.
What, you're not allowed to motorboat at work?