Slashdot Mirror
HealthCare.gov Portal Suffers Data Breach Exposing 75,000 Customers (gizmodo.com)
An anonymous reader quotes a report from Gizmodo: Sensitive information belonging to roughly 75,000 individuals was exposed after a government healthcare sign-up system got hacked, the Centers for Medicare & Medicaid Services (CMS) said on Friday. The agency said that "anomalous system activity" was detected last week in the Direct Enrollment system, which Americans use to enroll in healthcare plans via the insurance exchange established under the Affordable Care Act -- also known as Obamacare. A breach was declared on Wednesday. It's unclear why the agency, which is part of the U.S. Department of Health and Human Services, chose to not announce the incident sooner. Officials said the hacked portal is used by insurance agents and brokers to help Americans sign up for coverage and that no other systems were involved. The affected system has been disabled. CMS said it hoped to restore it before the end of next week. "I want to make clear to the public that HealthCare.gov and the Marketplace Call Center are still available, and open enrollment will not be negatively impacted," CMS Administrator Seema Verma said in a statement. "We are working to identify the individuals potentially impacted as quickly as possible so that we can notify them and provide resources such as credit protection."
Seriously, I'd like to know who doesn't have my personal information at this point. Likely be a short list.
Thanks, Obama!
Wasn't Trump going to replace the ACA with "something terrific"? Whatever happened with that.
"Presumably this is just the world we live in. There doesn't seem much info in the article,..."
(Gasp) You read the article?
Vade retro Satanas!
> Trading across state lines won't help, it becomes a race to the bottom
Exactly. That's why each state has to have separate car companies, separate food companies, separate smartphone manufacturers - and separate insurance companies.
If you let people in Oregon buy a phone made in California, or a truck made in Texas, or fruit grown in Florida, you know it'll be garbage.
I say people should only be allowed to do business with companies in the same state, to avoid this race to the bottom. The fabulous success of this policy for health insurance demonstrates why we should do the same thing for all products and services.
Gizmodo slams HHS for a delay in disclosure of a week? I'm NOT a big government fan, but they should be commended for what I'd consider prompt disclosure Competence in government is the exception, so it ought to be praised not criticized.
There's no reason for it to be the world we live in. We make it cheaper for companies to be failures than successes, but that's a choice and not every country makes the same choices.
All we need are the well-regulated markets advocated by Adam Smith, where regulations protect personal information, mandate minimum standards of operation and require a warranty for fitness of purpose in software.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Maybe someone has asked his Russian friends for a favour to get rid of ObamaCare >:)
That name was dreamt up to play on the fears of Republican voters, including the suggestion that it would have "death panels". A survey early last year showed 35% of respondents still didn't realize "Obamacare" was the same thing as the ACA. We need to make decisions rationally, not out of fear.
For instance, you're more likely to be killed by pollution (200,000 early deaths per year) than an undocumented immigrant (750 per year). However, our administration wants to spend money building a wall to protect you from the "dangerous" Mexicans, but doesn't mention anything about how many people die from pollution when announcing cuts to emissions standards.
(The 750 number is 456 arrests per year, plus an estimated correction factor due to cases not being solved.)
You do understand that whilst different cars have different performance characteristics making them suitable for different conditions, there's really only one treatment for a broken leg, one treatment for any given bacterial infection, one sort of x-ray, one design of ambulance.
Not really a situation that applies to cars, toothbrushes or music.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Good thing I said "fuck Obamacare"and ignored all the warnings that it's mandatory I sign up.
The bastards expose all your info in open files in paper documents. How unsafe is that ? Imagine being a jan who knows to make use of this !!
Trump, McConnell, and Ryan: "If we can't repeal the ACA, lets destroy the legitimacy of the system by running it like idiots and allowing hackers to break in"
I take it you don't work in security.
Rule #1: The attacker always wins.
The most regulated security projects are too busy working to be OSI compliant rather than trying to figure out how to actually design their systems to be secure given their unique environment. Every environment is different and requires it's own analysis and judgement, not a cookie cutter generic set of requirements that might not apply or help in your given situation. Trying to reach an arbitrary set of compliance rules can remove you from the task of actually securing your system.
Also, the only secure machine is a machine that's not connected to the internet or is off. That is, assuming it has encrypted drives and someone walking in with a machine gun isn't an issue.
So what you're saying is that a vehicle that is optimum to drive up a snowy mountain in Colorado is different than one optimized for cruising Miami Beach, right? So to some extent, it kinda makes sense to have different cars for different states?
On the other hand, the treatment for a broken leg in Colorado is exactly the same as the treatment for a broken leg in Florida, so prohibiting people in Colorado from choosing health insurance from a company in Florida is utterly ridiculous on its face?
should only be surprised that it took this long for this sort of steaming pile to be breached. Or in a way that left enough breadcrumbs for someone to notice, anyway.
Wait. Why am I laughing? This is almost as sad as the fact that nobody gives a flying fuck about data breaches anymore.
"I want to make clear to the public that HealthCare.gov and the Marketplace Call Center are still available, and open enrollment will not be negatively impacted,"
Translation: "Please continue to put your personal information in our shitwagon."
We already have health insurance companies selling across state lines. I can start a health insurance company in Alaska, and sell health insurance in Florida.
The only caveat is that I have to comply to Florida law for the insurance policies I sell in that state.
What Republicans want to do is make it so I can set up shop in Alaska and sell insurance policies to Florida that comply with Alaskan law. And this is where we have already seen a race to the bottom in another field: Credit cards.
Until a few decades ago, most states capped interest rates. Along came the Supreme Court and said that for credit cards, the state law where the company is based applies, not the state law where the credit card holder is. This turned Sioux Falls into a major base of operation for credit card companies, since South Dakota, unlike most states at the time, did not have a limit on interest rates.
I see no reason why health insurance shouldn't expect to see a similar race to the bottom if they no longer have to follow the state law where the policy holders are based.
At some point, the computing world is going to have to admit it... We need to put security before performance for servers.
If bugs can be security holes, there will always be security breaches... So for critical systems we need the computer to fix our mistakes.
This is your government at work. A shitty website that gets hacked doesn't work and cost the taxpayers 1.7 billion dollars to implement. Might as well have paid the uninsured directly with all that money.
Now they have reason to shut it down
So, approximately all of them ...
Are you sure that all medical treatments are the same at high altitude? Also, aren't broken legs more common in Colorado, due to skiing accidents?
I... think several of my past jobs qualify as working in security. And nobody works to be OSI compliant, at least not in any of the projects I've worked on. I doubt most people know any relevant OSI standards.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
I would agree with you, as far as you've gone, yes. There's nothing intrinsic about a Florida insurance company that means it can't handle a Colorado claim.
This whole in-State/out-of-State thing is, as you rightly point out, a red herring, a most scarlet fish of our times. That's not where the issues lie and there should be no constraints there.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Who did Dump/Republicans hire to carry out this attack meant to sabotage "Obamacare" and make people distrust it?
We make it cheaper for companies to be failures than successes,
That was a deliberate decision going back to the founding of the United States. You can see it in our bankruptcy laws. We Americans have decided that freedom to pursue happiness and by extension economic growth are more important than holding the feet of debtors to the fire, figuratively speaking, until every last cent is repaid. We have periodic booms and busts as a result, but most of us agree that the benefits have outweighed the downsides over the centuries. After all, the United States didn't become the wealthiest and most powerful nation on Earth by accident and this policy of debt forgiveness and promotion of risk taking played a crucial role in our economic ascent.
but that's a choice and not every country makes the same choices.
And not every country enjoys the economic success of the United States either. Take Saudi Arabia for example, a society with limited credit and strong laws enforcing repayment of debts. Nobody is running out to base their economy on the Saudi model.
All we need are the well-regulated markets advocated by Adam Smith
Adam Smith didn't have all of the answers and 242 years on we're still figuring it out. There is a tendency, especially among those on the left, to be Utopian in their policy prescriptions. However, we must be careful not to allow the perfect, which is probably impossible, to become the enemy of the good enough.
where regulations protect personal information,
Information by its very nature tends to spread. Protection is difficult to achieve and quickly becomes impractical as the amount of information needing protection grows. Moreover, the desire to protect personal information stems largely from our failure as a society to implement proper authentication. Our current identity theft problems are rooted in this failure of authentication. Finally, no matter how many laws or regulations are passed you cannot control how people or businesses think about or use that information and it tends to backfire when the government gets involved. The anti-discrimination laws and so-called "ban the box" laws are a classic example of this. When you ban a company or individual from using a piece of information in a decision, they're either going to infer the answer or use other pieces of information as a proxy for that answer. If legislating how people thought was effective then communism would have been a stunning success.
mandate minimum standards of operation and require a warranty for fitness of purpose in software.
Do you like free and open source software? Do you like the fact that you can generally obtain it without charge? If lawyers can sue developers for bugs or failure to satisfy "fitness of purpose", how much do you suppose your software will cost? The alternative may not be better software but no software at all. Be careful what you wish for because it just might come true. As a consumer you should be very suspicious of anything that gives lawyers more power to sue. It's almost certainly not in your best interest to side with the lawyers when politicians propose laws and policies.
He, like many lefties, was convinced the masses would love it once they got hooked on it. The entire freebies ideology of Democrats is based on the belief that if you offer people free stuff, they will happily take it, become addicted to it, and then become Democrat slaves; they're so wedded to this idea that they cannot comprehend anybody who rejects the freebies, or who wants these things to go away.
The problem is that, unlike most places on Earth that went to socialized healthcare, Americans had good healthcare before the Marxists got their chance. Americans were mostly just concerned about the COST of their otherwise excellent care - which is why Obama ran around the country lying hundreds of times to all of the American people that families would save $2500 USD per year, and telling them they could keep their doctors and keep their plans. Over 10 million Americans lost their coverage in the first months as Obamacare kicked in, and most middle class people are paying far more now. My personal insurance under Obamacare skyrocketed every year and is now over triplle the cost it was before the potsmoking, cocaine snorting bastard jackass became president. [READ Obama's own auto biography where he admits the drug use and parentage that makes my comment true]
Tip: If you want to convince anybody outside the progressive group think bubble, do not use NPR, Snopes, Daily Kos, HuffPo, or NBC as evidence of anything - it's about as legit as using David Duke as a character reference at an NAACP meeting.
Democrat Senator Chuck Schumer has used every senatorial trick in the rulebook to block Trump nominees; over a hundred have still not been confirmed two years into his presidency.
Smart people never signed up for insurance through the exchanges anyway - that Billion-dollar-plus website scam was never going to be trustworthy. Government never excels at such things since it has no competitors and thus has no competative pressures and no accountability. People with massive amounts of power and no accountability is never a recipe for success.
On initial release this system had an alarming number of security issues, but anyone publicly pointing them out (e.g. David Kennedy from TrustedSec) was generally marked as a conservative troll and not genuinely interested in the security of the system. I generated a shitload of 'anomalous activity' back in the day doing a little personal research and there was zero evidence of detection or responsive action. I'm sure security has improved over the years but I doubt this is the first incident.