Slashdot Mirror
Personal Healthcare Info of Over 11M Premera Customers Compromised
An anonymous reader writes: U.S. healthcare provider Premera Blue Cross has suffered a data breach that resulted in a potential compromise of personal, financial and health-related information of as many as 11 million applicants and members. The breach was detected on January 29, 2015, and the investigation mounted by the company and by forensic investigators from Mandiant has revealed that the initial attack happened on May 5, 2014. The FBI has also been notified, and is involved in the investigation."
And they've compromised about 5% of the US population...
As an admin, I'd love to see the actual technical aspects of the breach. How did they get in? How did they compromise your security? How long were they in the system before being detected? How did you detect them? Were you logging information that did catch them, but some oversight caused that data to be missed? How do you KNOW they are out of the system without flattening the entire infrastructure?
Knowing this data can help security professionals add more security layers to keep the evil-doers out of the network.
Yet another company that "protect your data", that failed to do so.
If you don't depend on them, then you have no reason to provide them with information. No need to pay them with money or by giving up your control.
They won't protect it
They will share it
They are not liable when it is stolen
There is no upside for customer
wow, first Anthem BCBS, and now Premera BCBS.
Updated Date: 19-jan-2015
Creation Date: 20-mar-2012
Expiration Date: 20-mar-2016
so, uh....exactly how long did we know/did we think this would become a massive fucking issue?
Good people go to bed earlier.
I for one am glad that there is no imminent danger from anyone compromising health information.
No choice. They'll get it anyways. My employer gave it to Aetna without my permission.
I had a procedure done at a hospital recently. During registration, I glanced at the computer screen and they had my freakin drivers license photo! This was a private for-profit hospital and they have realtime access to the DMV database, so SSN should be easy.
Good luck with that.
Doctors offices are the most incompetent people when it comes to business.
When I put up a fuss, there's always this "office manager' who insists they need it for "identification purposes".
Medical is extremely careless with our information and when you try to take prudent precautions, they get all bitchy.
Or as an ex-medical consultant friend of mine liked to say, "Doctors let their wives play office manager and the trouble is, doctors marry women who flunk out of beauty school."
I've heard about protecting your SSN nearly my entire life. Can anyone actually steal your identity with just your SSN? Given the world we live in nowadays, what sort of half-wit organization would consider your SSN some personal passcode that no one else should know? Frankly, I think we should just make them all public records, and then get over the asinine notion that we can use them as some sort of damned security code. As has been aptly demonstrated, it's not like we can really keep them secret for long anyhow. You're constantly forced to give it to strangers. What sort of "secret number" is that?
Sorry, I'm not ranting at you. The inability of major corporations to keep customer data secret is really getting on my nerves. It's just ridiculous.
Irony: Agile development has too much intertia to be abandoned now.
This will continue to happen until the C-level executives are held personally liable for the lack of effective security. (Threaten to) send the CEO, CFO etc. to jail and they'll soon change things for the better. Fines against the business wont work since they'll just get passed on to the consumer.
You picked up a clue with the words 'half-wit'.
Faster! Faster! Faster would be better!
So, who is the customer for all of this stolen health and patient information? Who is it valuable to? The hackers would only do this to sell this to someone. Why do I suspect that it's insurers themselves that want this data?
... ???
It little behooves the best of us to comment on the rest of us.
The main discussion on this breach, as well as others involving medical records, is their use in financial identity theft, especially fraudulent insurance claims. That's the main motive for the attacker. What about the consequences? I wonder if this has or will start to have an affect on the patients. In other words, reluctance to seek care because the diagnosis won't remain private. Maybe it would also cause an increase in people seeking, so called, alternative medicine where they don't have to standardize records and put them online as HIPAA requires.
Obamacare
So How Do We get Access to the Stolen Data? I need to hire some people. And I want to avoid getting people that have health problems.
Does anyone have any details as to how this data breach was achieved and what platform Premera Blue Cross computer system runs on?
# You thought I was PARANOID and crazy for wanting to create isolated networks,
extreme ACLs , banning windows, javascript, attachments, building in-house
javascript-free apps
#
# I TOLD you .
The whole concept of "identity theft" is daft. Nobody gets their identity stolen. They continue to be who they always were. What actually happens is that the bank gets defrauded and then the credit agencies commit libel. But our system of laws for some reason gives them a pass on that whole evidence thing that should stop them from harassing a third party (the so called victim of identity theft).
The solution is actually simple. Require the banks to ACTUALLY present evidence before attempting to collect on a debt and nail the credit agencies to the wall when they publish disparaging credit information with zero evidence of it's accuracy (that is, with wanton disregard for the truth).
Exactly, why isn't incorrect information at a credit agency considered libel?
I have no idea other than that they are a big financial institution and so get a pass from the old boy network. It certainly should be considered libel under current law.
One thing I've noticed about these data breaches is that they happen at companies who don't really care that much about IT. Almost everywhere these days, IT departments in organizations like that have been outsourced. So the question is, does that extra layer of abstraction cause in-house staff to miss stuff?
Let's assume the outsourcer is competent and doing an OK job. Even with that assumption, you now have another level that any IT change has to go through before it is implemented. Is it possible that the patch schedule takes so long to complete that key system vulnerabilities sit around for months while ITIL and friends approve the approval process to kickoff the change control meeting, notify all stakeholders, have meetings to schedule change planning meetings, etc. etc. etc.? (You can tell I've been on both sides of this fence...) It gets so bad that staff sometimes try to avoid making necessary changes because they don't want to fill out 2 hours' worth of ITIL paperwork.
The other problem is that outsourcing inserts another layer that has to make money. I guarantee you that the best and brightest are not working for outsourcers for the most part, and they squeeze every single nickel out of every process and employee. We'll see what the security consultants dig up on this one, but I'll bet it has something to do with this.
You picked up a clue with the words 'half-wit'.
Absolutely this!!! My SSN is an ID. It's not a damn password, but too many half-wits treat it as such.
Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
I read this "As an asian, I'd love to know the actual technical aspects..."
Stereotypes. I'm allowed to chuckle about it because I'm Asian. However, if any white people laugh, I will howl racism and sue the shit out of you.
get this type of data off the fucking internet. simple.
medical records of any and all kinds (except perhaps for your pets and livestock) have NO PLACE on the internet or on an internet-accessible network.
The summary says "Premera Blue Cross has suffered a data breach". But have they suffered? No doubt there will be lawsuits that drag on for years, but how much will this cost them in relation to their overall wealth and income? And how many executives will lose their bonus for the year (of course none will be fired)? Where and how exactly are they suffering? Has any company or executive ever paid a substantial penalty for losing identity data? Perhaps the penalty is having to distribute donations to their congress people who will protect them from prosecution.
...omphaloskepsis often...