Slashdot Mirror
US Healthcare Records Offered For Sale Online
An anonymous reader writes:Three U.S. healthcare organisations are reportedly being held to ransom by a hacker who stole data on hundreds of thousands of patients. The hacker has also put the 650,000 records up for sale on dark web markets where stolen data is traded. Prices for the different databases range from $100,000 to $411,000. Buyers have already been found for some of the stolen data, the hacker behind the theft told news site Motherboard. No information about the size of the ransom payment sought by the data thief has emerged, although he did say it was "a modest amount compared to the damage that will be caused to the organisations when I decide to publicly leak the victims."
The government will probably just hire him or her.
Where do I sign up?
The last time I requested my medical records from my doctor I was told that they could not provide many of them (especially the expensive MRI images), and of those they could provide they would charge a high fee for duplication. I was looking at paying somewhere between $50-100. I'm fairly certain they were doing this to prevent me from moving to another practice.
If this guy had my records I'd be happy to pay him $10 for them.
Can't wait for there being a single-payer system. The job of hackers world-wide will be much easier as they wouldn't need to waste efforts coming up with different ingenious ways of hacking different organizations.
In Soviet Washington the swamp drains you.
Because it's usually not easy to find them, and once you do, you notice that they sit in a country that doesn't even pick up the phone when you call them to ask for them to be handed over.
Nobody outside the "west" gives a shit about data theft.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Because they likely aren't in America moron.
I can recall several reasons — all of which I've encountered here on /. over the years and they've achieved acclaim and high moderations:
In Soviet Washington the swamp drains you.
Can anyone give me one reason why the authorities shouldn't find the hacker and promptly execute him?
Yeah, didn't think so...
Because "Enhanced Interrogation" would be a lot more fun.
And while we're at it, serve up some to the bean-counters at the affected organizations who likely thought that "IT doesn't matter".
Can anyone give me one reason why the authorities shouldn't find the hacker and promptly execute him?
Yeah, didn't think so...
Short answer: Jurisdiction
But can anyone give me one reason why the authorities shouldn't find the person responsible for implementing these insecure systems and promptly put them in a pillory?
since i have never received any healthcare (and according to my HC plan, never will), i have no health care records.
PS: anybody know why my arm keeps going numb?
I've broken almost every bone in my skateboarding. I wear that as a badge of honor. If more ppl. knew that, I'd get mad rep.
That's OK, it is within striking distance of a B-2.
Eventually people will care.
Found the hacker (well, close enough). Hellfires, away!
Insurers used to insist on getting your health records before accepting you, and now are required to accept you in spite of preexisting conditions. Keeping your health records secret isn't so important as people make it out to be. Exposing them could have social consequences, but most people blab to the world about their medical problems, so that is not much of a point.
I cant imagine being so worthless that this is the only way I could make money.
But can anyone give me one reason why the authorities shouldn't find the person responsible for implementing these insecure systems and promptly put them in a pillory?
Because he's a rich white CIO and has plenty of money and corporate power behind him to make sure he faces no consequences?
Oh, sorry, that might have been four reasons, not one.
Now, then, who's gonna do one damn thing about the system that perpetuates such circumstances? I'll be out back listening to the crickets.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
It's telling that most of the posts advocating violence in this thread come from ACs. What's wrong boys, afraid to stand behind you rhetoric?
Linux, you magnificent bastard, I read the fucking manual!
Well, these people can barely eat or master the wheel, so I'm not crushed by their attitude.
You keep on invoking those bogeymen, but it never helps. And you never wonder why.
My medical records have my d.o.b, SSN, name, address, and everything needed to use my ID to get credit, file taxes, and get a host of legal docs and IDs.
Great. I can become a victim at any time and never even know it.
We should find some clever way to watermark data so we know where it leaked from, but I know that problem is intractable and has no possible technical solution. Steganography might partially work. Encryption at a minimum, c'mon guys.
You don't do that with countries that have nukes.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
If this hack was made on systems which were accessible from the Internet, why the frack were they accessible from the Internet in the first place?? If an organization is too cheap, or too lazy, or too inept, or all-of-the-above, to put in place the serious security protections needed for an Internet-facing server, then said organization should never put sensitive data on any of their Internet-facing servers. Even if the organization is on top of things security-wise, if there is no really REALLY good reason for said data to be on an Internet-facing server, do NOT put it on one. Network Security for Dummies.
Ask the content industry how well that worked out.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
You can always do it the old fashioned way.
A Pirate and a Puritan look the same on a balance sheet.
You forgot the best reason:
The "hacker" was an agent used to "leak" the documents, sell them to the pharma companies, and provide plausible deniability when people start complaining about all the junk mail they're getting.
“He’s not deformed, he’s just drunk!”
Under the GOP system there was already a risk pool of last resort.
Much less intrusive than trying to re-engineer the entire industry and less of a constitutional issue than forcing a consumer product on people.
A Pirate and a Puritan look the same on a balance sheet.
http://circanews.com/fbi-didnt-inform-some-americans-they-were-on-isis-kill-list/
Most any effective hacker has an inside tract to the data and a motive. In the case of the FBI it goes immediately international because of the amount of moles and lack of trust within the FBI.
Do not for one second think American spy agencies are safeguarding the Internet to protect you. They are the predators. They even named one of their drones Predator.
If only Microsoft and Facebook and Google had the balls like Ed Snowden to sacrifice for all. Remember Ed told us what they were doing back then, it is much more international now.
Send them a strongly worded letter about how angry you are with them!
I was looking at thousands to keep a complete duplicate of my medical folder dating back to birth. Worst part about it was after the last couple of years with my last medical provider I haven't trusted the medical community enough to go back for anything that doesn't involve an emergency room (and about half of those visits, including a 106F temperature would have saved time and money by just staying in bed and seeing if I died.)
Yay for health care!
Post your email and i'll send you a signed personalized threat of intense physical violence.
Since HIPAA allows virtually everyone other than yourself to access your medical records, you might want to go to this site and buy access to your own records while the opportunity exists.
Yeah, you can pretty much bet that outside of someone completely incompetent setting up their network security (which is always a possibility), it came down to "Secure implementation costs $X. Less secure implementation costs $LESS_THAN_X." and some exec or bean-counter said "Go with $LESS_THAN_X".
Mr. Hu is not a ninja.
Can anyone give me one reason why the authorities shouldn't find the hacker and promptly execute him?
Yeah, didn't think so...
Our FBI can do that only if it can be shown that the hacker annoyed Hollywood in some way. To protect yourself in the future, see your doctor and ask if there isn't some way you can work a copyrighted song lyric into your medical file.
There is a saying that only way to truly secure your server is to disconnect it from the network. However HIPAA requires EMR, so that's not an option.
So I have to ask, why are you calling for the victim to be executed and replaced with somebody who is known for less than ethical behavior?
This is similar to how Islamic countries give lashings to raped women for adultery and then let the rapist go scott free because it wasn't his fault that the woman's looks were tempting.
Wonder if this is actually being run out the White House and money funneled through British West Indies to Obama's Kenya bank accounts.
Hmmmm
Under socialistic systems, everyone gets the same crappy care. See VA hospitals for example.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Yes, this guy should be found and executed. We simply have to up the penalty on these sorts of crimes. He thinks he's special and he's on an ego trip right now, but really he's just scum and should be removed from the planet immediately.
I think he meant kidnapping (see also the practice of 'extraditing' former Third Reich fugitives to Israel in the 1950's, 1960's, 1970's... not so much these days, mostly due to attrition).
Could be a new and improved use of Guantanamo Bay, truth be told.
Quo usque tandem abutere, Nimbus, patientia nostra?
However HIPAA requires EMR, so that's not an option.
Curious as to why that can't be on its own network (or at least a network of VPNs...)
Quo usque tandem abutere, Nimbus, patientia nostra?
Woooosh...
In Soviet Washington the swamp drains you.
You only deserve, what you paid for. Whether you have a job or not is irrelevant.
You don't deserve free emergency room treatment either.
In Soviet Washington the swamp drains you.
Worked for bin laden right?
Because you inevitably have to be able to transfer those records to another health care provider (and/or the patient himself) when the patient either requests it or authorizes it, as per the law. Sure, you can keep it within a secure network, but there is basically no such thing as perfect security.
Remember, the employees are typically the weakest link. No CIO in the world (or anybody else for that matter) can 100% guarantee the security of any system that has more than one authorized user, no matter the circumstances.
Nobody cares about 99% of people's health issues, unless you have very well known people you just have a big pile of nothing.
They have no more blackmail potential than a gossipy nurse really, probably less. Stupid hackers took useless data and then put their names out there because they thought it had value. Admited to the crimes with not real money making potential.
Probably make more off ONE CC skimmer than ALL those health records AND if you get busted you face infinitely less time for the CC skimmer.. STOO PID hacker should crawl back into this corner of nothing.
Or look at the countries with better healthcare outcomes than the US, for much less money. I'll wait for you to complain about how large the US is, and I'll point out that healthcare scales very well - more people to serve = more taxpayers = money to pay for their care. Then I guess I'll wait for some nebulous argument about "diverse cultures" and how the countries which pay less for comparable or better care don't have such "problems" or some other nonsense, and point out that that argument has no bearing on anything what-so-ever, it is just a convenient excuse used by people to forgive broken systems without having to admit failings of anyone.
You are flogging a dead horse. No, wait, you are the dead horse.
they are all obese and sick with cancer, diabetes, and heart disease. These kind of "troves" become less and less worth by the year in a country like the U.S.
FYI, they also measure outcomes differently in different countries, so that even if the statistics are correct, they are measuring entirely different datasets.
For instance, it is often touted that infant mortality rates are lower in certain countries. While that Statistic is accurate as a statement, the two countries are measuring it differently. In the US, Premature births of all types and kinds are included, where they are not in other countries. And if you include premature birth rates, the Actual statistics flip.
If people die of cancer waiting for treatment, and they aren't counted as "cancer patients" because they never were.
Statistics are meaningless unless they are being used the exact same way across the board, and they are not.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Got a citation for that? Because I have one that shows you are spouting more libertarian BS:
The real "Libtards" are the Libertarians!