Slashdot Mirror
Thousands of Patient Records Held for Ransom in Ontario Home Care Data Breach, Attackers Claim (www.cbc.ca)
CBC reports: The detailed medical histories and contact information of possibly tens of thousands of home-care patients in Ontario are allegedly being held for ransom by thieves who recently raided the computer systems of a health-care provider. CarePartners, which provides home medical care services on behalf of the Ontario government, announced last month that it had been breached. It said only that personal health and financial information of patients had been "inappropriately accessed," and did not elaborate further. However, a group claiming responsibility for the breach recently contacted CBC News and provided a sample of the data it claims to have accessed, shedding new light on the extent of the breach. The sample includes thousands of patient medical records with phone numbers and addresses, dates of birth, and health card numbers, as well as detailed medical histories including past conditions, diagnoses, surgical procedures, care plans and medications for patients across the province.
Once again, a company that is supposed to protect sensitive personal information fails to provide available security measures and exposes sensitive personal information to a host of bad actors. This kind of neglect usually is not at the IT level, but all the way at the top.
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
What kind of patient records do they have
â"patient hosehead was hurt while drunkenly clubbing baby seals
â"hoser drunkenly body checked a grizzly bear, eh
and they denied it. So who is to say there has even been a breach?
While not downplaying the impact of the breach, the exposure of Canadian healthcare records isn't as dire as the same thing would be in the USA. There are no insurance premiums to raise on anyone with any condition since almost everything is covered regardless. No worries about condition X getting out and being denied a claim based on it.
This kind of neglect usually is not at the IT level, but all the way at the top.
HAH. While I am not certain about this particular company, when these companies are only engaged in neglect, it's a win. (There are some good staff at some of the companies, but they generally have to keep their noses down because of the culture. If you did real undercover inspections of elder care in Ontario you would be terrified.)
Screw the "civilized" way of dealing with this kind of filth. Track them down, find them, kill them.
This kind of scum is cancer, and must be delth with accordingly.
This isn't holding something for ransom. When you pay ransom, you (in theory) get your property back safe and sound and the culprits no longer have it. Here, the culprits have a copy of the data, and they say that if they're given money, they won't release it. Paying them won't make their copy vanish; there's no guarantee they won't take the money and then sell the data to other people. This is simple extortion. I guess that doesn't sound as exciting in a headline, though.
When someone says, "Any fool can see
Having been through the process of a formal complaint, Privycom (Privacy Comissioner), is a part of it too. They have _zero_ actual enforcement powers. Instead they are in effect a feel-good pat on the back for the Canadian Government when it needs someone to take the fall.
The fines they "issue" are slaps on the wrist, nothing more. If you've ever had the rather unfortunate luck of dealing with them you'd know there's _zero_ fucks given toward actual long term damnages of having your data stolen. The issue "guidelines", with more exemptions then our immigration policy and use it as a self fulfilling, rhetorical bible -- "Our guidelines state companies cannot do X unless Y". Yet in my case they couldn't even provide a document stating what landlords can access from credit agencies (turns out it's a fuck of a lot).
At the end of the day we have little to no privacy.