Hacking the US Prescription System

An anonymous reader writes: It appears that most pharmacies in the US are interconnected, and a breach in one leads to access to the other ones. A security advisory released [Friday] shows how a vulnerability in an online pharmacy granted access to prescription history for any US person with just their name and date of birth. From the description linked above: During the signup process, PillPack.com prompts users for their identifying information. In the end of the signup rocess, the user is shown a list of their existing prescriptions in all other pharmacies in order to make the process of transferring them to PillPack.com easier. ... To replicate this issue, an attacker would be directed to the PillPack.com website and choose the signup option. As long as the full name and the date of birth entered during signup match the target, the attacker will gain access to the target's full prescription history.

Comments

Re:Assumptions

[OverlordQ]

> I think it is far more likely that the pharmacy sells this information to insurance, pharmaceutical, and marketing companies.

This. Pretty much every prescription the doctor writes effectively goes straight to the drug reps. If you stop prescribing, they'll know, and come in and bribe^H^H^H^Hinquire as to why you stopped prescribing their drug.

Re:Not exactly a hack

[CrimsonAvenger]

They know about your medication (see above).
What they may lack is the matching email address to your name?

They know about my meds because I pretty much have to tell someone to get the prescription filled.

They know my email address since the same people I go to to get the prescription filled have my email address so they can send me reminders that my refills are due.

So, the pharmacy has my prescription history going way back (what, you think I change pharmacies every time I get a new prescription) and my email address. And I still have never gotten any spam advertising drugs.

Note that drug advertising to me wouldn't actually do any good, since I'm not an MD, and am incapable of prescribing drugs to myself (or anyone else). That sort of thing is best aimed at doctors and hypochondriacs (the kind who will nag their doctors about the new drugs they see on TV that sound like they'd be PERFECT for their problems)....