Craig Hoffman raises some valid points about lessons that can be learned following a security incident. Here are just a few of his points: Acknowledging that trust but verify is important (e.g., if someone says a network is segmented, check the ACLs and firewall rules to confirm this). Knowing that you can have great security…
Category: Commentaries and Analyses
Black market medical record prices drop to under $10, criminals switch to ransomware
Maria Korolov reports: The black market value of stolen medical records dropped dramatically this year, and criminals shifted their efforts from stealing data to spreading ransom ware, according to a report released this morning. Hackers are now offering stolen records at between $1.50 and $10 each, said Anthony James, CMO at San Mateo, Calif.-based security…
Fairbanks Hospital notifies patients after discovering employees could have been inappropriately accessing patient records for years (UPDATED)
Fairbanks Hospital in Indianapolis is notifying an undisclosed number of patients that employees could have been accessing protected health information of patients since at least November 2013 (and possibly earlier). The information that was accessed included current and former patients’ social security numbers, contact information, diagnosis, treatment and health insurance. In a notification dated December 16, the hospital…
1,000 UK government laptops, computers and data sticks missing since election
The Irish Examiner reports: At least 1,000 government laptops, computers and data sticks have been reported lost or stolen since the general election, according to official figures. Equipment went missing from the Ministry of Defence (MoD) at an average rate of more than one a day, according to records obtained under Freedom of Information (FoI)…
CRA spends millions but fails to stop tax workers from snooping on Canadians, documents show
Dean Beeby reports: Canada Revenue Agency workers continue to snoop on the confidential tax files of businesses, acquaintances and others, despite at least $10.5 million spent so far to try to stop them. CBC News has uncovered nine significant cases reported since Jan. 1 in which tax workers improperly poked around the government’s electronic records to…
Data Breach Plaintiffs’ Allegations Sufficient for Standing in Employee’s Suit Against CareCentrix
Ted Karch writes: On Monday, the court in Hapka v. CareCentrix, Inc. ruled that employees of CareCentrix whose personal information was compromised have alleged enough harm for standing under Spokeo, Inc. v. Robins. In early 2016, a phishing attack compromised defendant CareCentrix’s systems, revealing personal information of up to two thousand employees. CareCentrix notified the plaintiff of…