Forest Global Training Partners

Cyber Risks · Krebs on Security

A Day in the Life of a Stolen Healthcare Record

Summary: A KrebsOnSecurity source found a darknet seller on AlphaBay posting a file titled "Tenet Health Hilton Medical Center" containing names, addresses and Social Security numbers of dozens of physicians; Tenet said the data came not from its systems but from InCompass Healthcare, whose affiliate 24 ON Physicians was affected when subcontractor PST Services, a McKesson subsidiary, left more than 10,000 patients' information exposed via Google search for over four months. In a separate Bitglass experiment, a spreadsheet of 1,568 synthetic identities posted anonymously to Dark Web marketplaces was accessed more than 1,100 times and reached 22 countries on five continents in under two weeks, with activity clustering around groups in Nigeria and Russia.

Why it matters: The InCompass breach touched roughly 10,000 patients across 29 facilities and about 40 physicians, and the company said it had no indication the data was used maliciously until a reporter called - the third-party billing chain meant neither the patient nor the covered entity could readily trace the leak back to its source.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related