EyeCare of Bartlesville in Oklahoma reported a breach to HHS on March 13 that appeared on HHS’s public breach tool on March 19. There was no notice on their web site that I could find at that time. Nor could I locate any public notices via a Google search. The incident was coded on HHS’s breach tool as a…
Category: U.S.
NJ: Court dismisses breach lawsuit against Horizon Blue Cross Blue Shield
In December, 2013, Horizon Blue Cross Blue Shield of New Jersey notified almost 840,000 members that their protected health information was on laptops stolen from the insurer’s Newark headquarters on November 1, 2013. At the time, Horizon BCBS reported that the laptops were password-protected, but the data were unencrypted, and After a detailed review with…
OH: Former ProMedica hospital employee indicted on criminal HIPAA and CFAA charges
It appears we have another criminal prosecution under HIPAA. In May 2014, ProMedica disclosed that almost 600 Bay Park Hospital patients were to be notified of an insider breach. In June, police announced that no criminal charges would be filed because their investigation found that no patient information such as social security numbers or financial…
Wellesley College data dumped; server vulnerable to SQLi
So yesterday, TeaMp0isoN’s timeline looked like this (click on image to enlarge): Then this happened: Creds to @_TeaMp0isoN_ For Vulnerability Alert. Login Drop. [url redacted by DataBreaches.net] — Chief (@Puttied) April 5, 2015 The data dump was prefaced with this message: DB Drop BY Chief(@Puttied). Site : http://mobius.wellesley.edu/ This is their latest Login DB as…
Tewskbury Police Pay Ransom After CryptoLocker Lockup
Jayne W. Miller reports that when Tewksbury Police discovered that the department’s network had been locked up by CryptoLocker last December, the town decided to pay the $500 bitcoin ransom. Of course, that’s exactly what experts recommend folks NOT do, as it only encourages more attacks on others, but hey, this is the same town that just…
Change.org springs a leak, exposes private e-mail addresses [updated]
Earlier this week, Dan Goodin reported: Online petitions service Change.org has a website bug that’s disclosing e-mail addresses that presumably belong to current or former subscribers. Search results suggest the number could be thousands, but a Change.org official said it was about 100. The disclosure bug was active at the time this post was being…