Blue Lance InfoSec Blog

Bristol-Myers-Squibb Employee Charged for Stealing More Than 1300 Documents

The FBI has charged a former Bristol-Myers-Squibb employee with stealing trade secret and proprietary information.  Shalin Jhaveri faces up to 10 years in prison and a $250,000 fine if convicted.

Jhaveri, who was employed by Bristol-Myers-Squibb from November 2007 until his termination on February 2, 2010, allegedly downloaded more than 1300 documents containing confidential and proprietary information with the intent of starting a bio-pharmaceutical business in India.

Jhaveri is currently being held without bail pending a detention hearing.

Source:  Federal Bureau of Investigation

More information from Reuters

Google Eyes Insider Threat After Attack in China

According to eWeek Europe, Google is reportedly investigating whether or not some of its own staff were involved in the attack on Google China earlier this month.

And now it seems that the attacks, which have been described as "highly sophisticated", may have originated even closer to home after the news agency Reuters said that one or more of Google's employees in China may have helped facilitate the cyber-attack.

Sources who are familiar with the situation, told Reuters that the attack, which targeted people who have access to specific parts of Google networks, may have been facilitated by people working in Google China's office.

Connecticut AG Sues Healthcare Provider in First Case of State Enforcement Under HITECH

Connecticut Attorney General Richard Blumenthal sued Health Net of Connecticut, Inc. for HIPAA violations stemming from the loss of a portable hard drive containing the health and financial information of approximately 446,000 Connecticut enrollees in May of 2009, and the failure to notify authorities and consumers for at least 6 months.

Additionally, the AG seeks a court order preventing Health Net from continued HIPAA violations by requiring that protected health information stored on portable drives be encrypted.

A subsequent investigation found that the data, which included health records, social security numbers and bank account numbers in over 27 million scanned pages, was not encrypted or otherwise protected from unauthorized access and was viewable on commonly available software.

The case is the first action taken by a state under the HITECH Act, which enables states to enforce HIPAA violations.

Source:  Connecticut Attorney General's Office