Slashdot Mirror
CareFirst Admits More Than a Million Customer Accounts Were Exposed In Security Breach
An anonymous reader writes with news, as reported by The Stack, that regional health insurer CareFirst BlueCross BlueShield, has confirmed a breach which took place last summer, and may have leaked personal details of as many as 1.1 million of the company's customers: "The Washington D.C.-based firm announced yesterday that the hack had taken place in June last year. CareFirst said that the breach had been a 'sophisticated cyberattack' and that those behind the crime had accessed and potentially stolen sensitive customer data including names, dates of birth, email addresses and ID numbers. All affected members will receive letters of apology, offering two years of free credit monitoring and identity threat protection as compensation, CareFirst said in a statement posted on its website." Free credit monitoring is pretty weak sauce for anyone who actually ends up faced with identity fraud.
The only way to fix this is criminal liability, with very stiff fines.
If they're going to continue to be incompetent at security, hit them where it hurts ... right in the profits.
As long as corporations can say "oops" and just pretend that two years of credit tracking like this, nothing at all will change.
Until then, corporations will be as incompetent and lazy as the law allows ... which is pretty much as incompetent and lazy as they want to be.
If you don't make the company pay actual fines, escalating to much bigger things for repeat offenses, corporations will simply do whatever their PR consultants tell them they can get away with ... basically nothing.
Lost at C:>. Found at C.
They had almost no real security. The database wasn't even encrypted.
I don't give it to insurance companies, nor to the utilities (yes I pay a deposit but I don't give them my SS number), etc.
You may have to argue a bit and get a manager, but if nothing else, if you can keep your SS number out of systems that will potentially be broken into, at least they won't get that info.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
This is the third news about massive amounts of accounts being hacked in less than eight hours.
Get free satoshi (Bitcoin) and Dogecoins
Insert joke about caring first about our data here -->
I'm just waiting till the treasure trove that is the national ACA exchange gets hacked.
I imagine if/when it happens there will be no mention of it as it would mean every American registered in it would want heads to actually roll.
I am Bennett Haselton! I am Bennett Haselton!
The more I see this happen - the more I think we need to change the economy for stolen data. Remember when they stopped arresting prostitutes and targeted the John's ? Locks can be picked and there to keep honest people honest. Credit monitoring must be pretty cheap as more companies buy it as an insurance product. This data is going to be stolen !
Now we need to make it worthless.
In the world of digital "signup on the web" stolen data can be used pretty quickly. Like the bad checks loop hole (popular on Craigslist and others). The detection of bad id's needs to be easier and products for purchase harder to get. There are days that I believe the 3 credit reporting agencies are responsible - they created a market & product that is easy to abuse. Yes - I can flag my credit rating (even "lock" it) - but then my life becomes difficult.
Maybe a smartApp that allows easier monitoring and blocking of requests. My AMEX credit card already gives real time purchase details on my phone. This might aid in detection.
Now - how to reduce the value of the products? (or increase the cost to acquire).
And just maybe - make it expense for the companies that hold this data to the point they find another way.
We did get a letter about the security breach, and the offer for 2 free years identity theft protection, so...thanks, I guess? Nothing horrible has happened yet, but as far as I can tell, we don't really have any recourse other than sitting and waiting for bad things to occur. No actionable information provided.
The notice they sent us went out months after they found out about it. Which I'm kind of grumpy about, but at least to some degree makes sense. They don't want to go public with the information until they've locked down as much as they can.
One last gripe: the letter was mostly worded in the "protect our own butts legally and limit our liability as much as possible" sense, not the "we're sorry this happened to your personal information and we want to make it right" sense. Which, I mean, come on. This is an insurance company. That's literally what they do for a living.
It's sad I have been offered this
two years of free credit monitoring and identity threat protection as compensation
6 times now, and from 6 different corps.
And this..
'sophisticated cyberattack'
is bullshit..
http://krebsonsecurity.com/201...
Turns out, the same bulk registrant in China that registered the phony Premera and Anthem domains in April 2014 also registered two Carefirst look-alike domains — careflrst[dot]com (the “i” replaced with an “L”) and caref1rst[dot]com (the “i” replaced with the number “1”).
Additionally, ThreatConnect has unearthed evidence showing the same tactics were used on EmpireB1ue.com (note the “L” replaced with a number “1”), a domain registered April 11, 2014 (the same day as the phony Carefirst domains). EmpireBlue BlueCross BlueShield was one of the organizations impacted by the Anthem breach.
"If any question why we died, Tell them because our fathers lied."
Companies that get breached should be fined $1M per identity breached, paid directly to the person affected. If that were the case .. I'd be $12M richer, minus the
40% the Feds would take in income taxes
Try taking that with you to the bank when you try applying for a loan after your credit has been trashed by an identity thief. See how far along the loan approval process that letter gets you.
WTF are you supposed to do with a damned letter? Feel all warm and fuzzy that they care?
CUR ALLOC 20195.....5804M
At this point the whole country should be getting free credit monitoring. Pay for it with a tax on domain names or corporate internet access or something.
And it took a year to notify customers because....???
Care first.. security a distance third?
I know very few people agree with me on this one, but this is a perfect example of where professional licensure of at least the design part of IT and SW development could prevent problems. No civil engineer with the PE designation would sign off on a dumb design because they and/or their firm would be personally responsible for faulty work, and companies couldn't pressure people into doing so. Engineering of real world systems involves using proven methods and thoroughly testing anything new or different before it gets anywhere near the real world. IT is famous for "oh well, it compiles, we're done" and "I want to implement this in LangDuJour On Rails because it'll look good on my resume." I'm not saying it will solve all problems, but that would certainly weed out most bad design and many bad practitioners. You would standardize the education requirements, and at least ensure that people who get the license to practice think twice about taking dumb shortcuts. Lots of people would complain, and yes, it would slow the insane pace of new technology introduction, but it's been decades...it's time for the profession to grow up.
Licensing would not fix the other part of this problem -- companies not devoting the right amount of resources to IT. IT is almost always considered a cost center, and not understood by anyone in the executive suite (including the CIO.) I don't know this for a fact, but I'll bet that at least some of CareFirst's IT is outsourced to a lowest-bidder contractor -- just because I know companies that aren't IT-centric don't care about what happens in IT. That outsourcing either has their entire infrastructure in a disinterested third party's hands, or a split that's painful enough to make in-house staff think twice about changing something.
Finally, the problem is that companies get away with this all the time. Credit card fraud is completely victimless in the eyes of companies as long as they passed their PCI audit...their insurance company just pays and the banks eat the rest of the losses. Same goes with personal data -- it's always "oops, here's some credit monitoring service for you." Any class action lawsuits end up settled 10 years later for a few dollars per claimant. Until companies get in serious trouble for this, it will continue to happen.
If they actually cared they would have disclosed this information a hell of a lot sooner than now. Instead they gave hackers almost a full year to fuck unsuspecting victims.
Do the people a favor and change your name to CareLater.
... All affected members will receive letters of apology, offering two years of free credit monitoring and identity threat protection as compensation, ...
So they're saying that they have such monitoring/protection, but members who aren't explicitly paying extra for such monitoring/protection aren't being protected from identity theft in any way?
Somehow, I don't find this surprising. But I'm a bit surprised that they'd admit it so blatantly and openly.
(Actually, I'm a bit dubious about their implicit claim to have such monitoring/protection already. But it's fairly common for companies to make such claims for PR purposes, without bothering to actually implement what they're claiming to supply until something like this hits them. Maybe they had another similar incident happen sometime in the past, and are finally getting around to doing something about it?)
(And what exactly does "identity threat protection" mean? Google doesn't seem to have any matches for that phrase, and automatically replaces it with "identity theft protection", which doesn't sound like the same thing at all. ;-)
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
"[...] announced yesterday that the hack had taken place in June last year" Why the heck did it take them a year to disclose this? Did someone finally leak this information and they finally had to admit to it?
n/t
what a great way for IT professionals to get rich: breach their own employer's computer systems and steal their own data.
That I originally read the article title as "CareFist"?
Are there any technical details regarding this 'sophisticated cyberattack', or was it yet another SQL exploit or altering a URL and scraping the database?
1. Somewhere along the line, businesses started assuming they had a RIGHT to collect, store, use, and sell information about other people. Nobody actually gave them this right. Nobody legally codified the scope of this right. Medical firms, insurance firms, credit reporting/rating firms, and even Radio Shack all built business models that included (or were principally-based on) the presumption that they had the right to hold and trade this data. At this point, when anybody tries to say "Hey, wait a minute! You can't do THAT!", these multi-billion-dollar interests simply remind their purchased politicians that there will be future elections that must be funded...
2. Businesses and unions, who pretend to be mortal enemies, actually have the same relationship with their politician "friends"; They have large sums of cash which they can contribute to make sure the politicians see them as "too big to fail". This is how the unions got protected in the auto company bailouts, while all the little gray-haired folks with retirement funds in auto stocks lost everything. It's also how the bankers avoided ANY responsibility for the 2008 meltdown. When any big business loses the data of average citizens, exposing each of them to an almost unlimited (in both time and cost) financial hit, the government they bought will make sure they pay no penalty. Funny thing, but that same government helped music companies drop the hammer on individual people who posted music online based on the same theory of practically unlimited damage since data cannot be "gotten back"....
When rules only work in one direction, start looking for crony relationships between people with cash and politicians.
This will NOT change by voting Democrat or voting Republican.... this will ONLY change if voters of all parties let their representatives know they will no longer vote along party lines (George Washington warned against forming political parties for this very reason) and tell them they will only get the votes if they oppose this sort of corruption and start protecting the rights of the individual. The key is that money does not vote... only individuals do, so the voters need to de-couple their votes from campaign ad money and make it clear that REAL ACTIONS are all that matter.