'Hacker' threatens to expose health data, demands $10M

'Hacker' threatens to expose health data, demands $10M

www.computerworld.com

May 6, 2009 (Computerworld) Days after a hacker claimed to have broken into a database and encrypted millions of prescription records at the Virginia Department of Health Professions, it remains unclear what happened.

Whistleblower Web site Wikileaks.org last Sunday carried a report from an anonymous poster who said that the secure site for the Virginia DHP Prescription Monitoring Program (PMP) had been broken into by a hacker who made a $10 million ransom demand.

(visit the link for the full news article)


Related News Links:
fredericksburg.com
www.vnunet.com
voices.washingtonpost.com

If this is true, and so far there's no reason to suspect it's not (It's that or a hacker's really bad joke) then it shows a vital flwa in our nation's computer systems that are supposed to safeguard our private data and keep it out of the wrong hands.

Can you imagine how much money would be made by someone getting into a national heath database that they are proposing and selling off records?

The thought just boggles the mind to think we are still this lax with our security in certain areas.

www.computerworld.com
(visit the link for the full news article)

Originally posted by vkey08
...supposed to safeguard our private data and keep it out of the wrong hands.

Impossibility.

It's idiotic that our government uses computers to keep data.

If I were running the government...I'd keep everything ON PAPER. Nothing on a computer ANYWHERE.

Nothing is unhackable...yet you will see our government use this very threat to infringe on our internet freedoms.

I don't care how safe they think something is....someone will find a way to hack it.

Remember all the hacks from last fall that happened when the bailouts first started?

They nailed many government agencies.

It's stupid for our government to keep this crap on computers...especially those with internet access. At the least they should ban computers with sensitive information to ever being connected to an internet source.

Originally posted by David9176
It's idiotic that our government uses computers to keep data.

If I were running the government...I'd keep everything ON PAPER. Nothing on a computer ANYWHERE.

Nothing is unhackable...yet you will see our government use this very threat to infringe on our internet freedoms.

I don't care how safe they think something is....someone will find a way to hack it.

Remember all the hacks from last fall that happened when the bailouts first started?

They nailed many government agencies.

It's stupid for our government to keep this crap on computers...especially those with internet access. At the least they should ban computers with sensitive information to ever being connected to an internet source.

Either that or just not have them connected to the internet.

Originally posted by David9176
It's idiotic that our government uses computers to keep data.

If I were running the government...I'd keep everything ON PAPER. Nothing on a computer ANYWHERE.

Nothing is unhackable...yet you will see our government use this very threat to infringe on our internet freedoms.

I don't care how safe they think something is....someone will find a way to hack it.

Remember all the hacks from last fall that happened when the bailouts first started?

They nailed many government agencies.

It's stupid for our government to keep this crap on computers...especially those with internet access. At the least they should ban computers with sensitive information to ever being connected to an internet source.

To revert to paper now would require millions of trees, the amount of paper needed at this point would be absolutely mind boggling.

But you're right, theres no such thing as unhackable. If it was made by a human, then a human can beat it - given enough time of course.

The thing with these type of systems though, is that they are encrypted but in almost every case, the hacker gained access through a staff members login that was compromised. Why smash the steel reinforced walls when you can wait for a staff member to open the door for you, right?

I'm 25 and a guy I used to go to high school with got caught after breaking inside a doctors office and was downloading the patient data.

So it does happen, question is who do you sell it to and what can they use it for??

Originally posted by breakingdradles
I'm 25 and a guy I used to go to high school with got caught after breaking inside a doctors office and was downloading the patient data.

So it does happen, question is who do you sell it to and what can they use it for??

Been treated for the clap? I bet your wife would like to know.

Been treated for addiction? Bet your employer would like to know.

Have HIV/AIDS? What would you pay to keep that private?

See where this is going?

Originally posted by loam

Originally posted by vkey08
...supposed to safeguard our private data and keep it out of the wrong hands.

Impossibility.

Not at all. Had the data been encrypted in place, it wouldn't matter whether the hacker got the data or not...it would be of no use without the key.

May as well go back to prehistoric times, and start writing on stone.

Originally posted by David9176
It's idiotic that our government uses computers to keep data.

If I were running the government...I'd keep everything ON PAPER. Nothing on a computer ANYWHERE.

Keeping paper records has it own set of problems. The issue is not that the data is stored on a computer but rather that there was not adequate security in place.

There are layers upon layers of security that can be deployed and it is because of this kind of thing that HIPPA regulations are undergoing a complete overhaul.

One of the measures that can be taken is to encrypt data. Not just data that is in transit but data as it sits on the storage platform. Had this been done, all the hacker would have is line after line of gibberish.

According to my wife who is in Health Information; FOIA is going to play an ever increasingly invasive role in our health records. A couple of weeks ago she attended a Indian Health seminar in Reno and they were told there for the first time that everything they have learned about patient confidentiality "HIPPA" is being thrown out the door if you're receiving federal assistance. Using the FOIA and "open government" guidlines, President Obama has signed over confidentiality to anyone that needs your records (including income). She's waiting for the official documentation on this policy and I was going to post a thread regarding this when she receives it. Just waiting for the source info.

[edit on 6-5-2009 by The Undertaker]

Originally posted by The Undertaker
According to my wife who is in Health Information; FOIA is going to play an ever increasingly invasive role in our health records. A couple of weeks ago she attended a Indian Health seminar in Reno and they were told there for the first time that everything they have learned about patient confidentiality "HIPPA" is being thrown out the door if you're receiving federal assistance.

[edit on 6-5-2009 by The Undertaker]

I don't think your wife got the whole story. HIPPA regulations are being extended to, for one thing, require that any data that is transmitted, no matter the method, email, text, etc, will have to be encrypted.

They are still working the details but trust me, they are not going to relax the regulations. Quite the contrary they are going to be significantly tightened.

I never did like giving my social when filling out doctor office paperwork.
I also usually pay out of pocket for visits ( can't afford the insurance) and usually cash.

Never had to show my SS card to the office lady either.

Figured it would be fun to change up a few digits on the paperwork. Never got questioned on it.

Don't guess he got any of my info then.....

reply to post by Night Watchman


Let me put it this way. When the attendees at the conference received the information on the new FOIA rules coming out their jaws dropped. She said everyone looked at each other in awe as too what they had just heard. They couldn't believe it.
I'll be back on this thread in about an hour with the expert at my six and I'll relay a more accurate accounting on the rules going into effect. It is significant to our health record confidentiality.

How much, only 10million, what a moron. Either way its very funny how people scramble for life preservers when the water is only up to their ankles.
It reminds of ants, just before it begins to rain and the atmospheric pressure has fallen you notice how they scramble to reach for cover. Well its inevitable and its only going to get worse. The only thing that the whistle blower achieved was to create problems on the black market for those who deal with this type of occupation.

I only hope his not taking about this on any online transfer as he is being target by both sides. Sure i agree with what he did, but i dont agree how he went about it.

Originally posted by The Undertaker

Let me put it this way. When the attendees at the conference received the information on the new FOIA rules coming out their jaws dropped. She said everyone looked at each other in awe as too what they had just heard. They couldn't believe it.

I'm very interested in hearing more. My business revolves around data protection and security and we have all been told from our "insiders," that the regulations were going to be tightened significantly.

I'd be absolutely shocked if they loosened the regs given the lawsuits and costs associated with data breaches.

Something about this dosen't add up 10 million dollar ransom thats ridiculous. Why do something thats obviously going to get you caught when you can just sell the personal information and remain anonymous. This is either some clown whos seen to many movies or something else is going on here.

Oh well, so much for the lesson that needed to be learned.

We simply CANNOT trust the government or there agents with confidential information.

Maybe we should let NSA secure the data.... at least they have a clue what cyber-security is all about.

can you imagine all the fake prescriptions you could generate with those hacking skills?

boggles the mind