Finjan Inc. has issued a press release and report [pdf, free subscription required]. While coming as no surprise, their findings should alarm us all. From the press release:
Finjan Inc., a leader in secure web gateway products, today announced its discovery of a server controlled by hackers (Crimeserver) containing more than 500Mb of premium data. The data included healthcare and business related data, as well as personal identifiable information (stolen Social Security Numbers). This data is part of the premium offering that the cybercriminals operating the Crimeservers were selling to the highest bidder online.
The compromised data came from all around the world and contained information from individuals, businesses, airlines and healthcare providers. The report contains examples of compromised data that Finjan found on the Crimeserver, such as:
* Compromised medical related data of hospitals and publicly owned healthcare providers
* Compromised business related data of a U.S. airline carrier
* Identity theft (stolen Social Security Numbers)Some of the implications of stolen medical and patient data include: illegal and/or bogus treatments; obtaining prescription drugs for the purpose of selling them; loss of health coverage for the victimized patient; inaccurate records of victimized patients, which could result in incorrect and potentially harmful treatments. Healthcare providers could also face potential HIPAA violations or breach of general data protection legislation.
As one example of what they found:
We also found data of a publicly owned healthcare system in the US. This premier, multi-faceted healthcare organization owns, leases and manages hospitals, nursing homes, physician practices, home health agencies, radiation therapy facilities, physical therapy facilities, and other healthcare-related operations.
…. The above log contains Citrix credentials that enable access to systems of this US healthcare institution. After authentication, we believe resources inside the organization (including patient, treatment and financial data) can be accessed freely.
Well, Congress, do you hear me now?