Blue Lance InfoSec Blog

Former IT employee gets 18 month prison sentence for computer intrusion

According to a press release from the FBI's Tampa office, Patricia Marie Fowler, a former IT technician, received 18 months in prison and ordered to pay $17,243.01 in restitution.  Fowler, was employed at the Suncoast Community Health Centers (SCHC) in Ruskin, Florida, was found guilty in September of computer intrusions resulting in over $5,000 in damages to SCHC.

According to trial testimony, Fowler had been fired by SCHC on March 13, 2009, for insubordination and failing to follow the orders of her supervisors. On March 17, SCHC employees discovered that a computer intrusion had occurred and that damage had been done to the SCHC computer system. From March 17, 2009 through April 1, 2009 numerous unauthorized intrusions were made into the SCHC computer system which resulted in the deletion and movement of files from the computers of SCHC executives, changing of administrative account names and passwords, removing access to infrastructure systems, changing pay and accrued leave rates on the employee payroll system, and the compromise and lockout of the firewall used to secure the SCHC network.

In addition, Fowler will be placed on supervised release for 3 years after serving her sentence.

Read the full press release

Former employee pleads guilty to computer intrusion, deletion of files

The El Paso branch of the FBI last week announced the guilty plea of Ismael Alvarez, a former employee of Gray Wireline to charges of computer fraud for illegally accessing a company database and deleting several files.

...Alvarez admitted that on September 1, 2010, he illegally gained access to the computer system of Gray Wireline, Inc., and deleted approximately 68 files, including analysis reports on oil and natural gas wells in Odessa, Levelland, Denver City, and Andrews, Texas. As a result, Gray Wireline estimates that it had to spend approximately $16,000 to correct and remedy the damage caused by Alvarez.

Alvarez faces up to 10 years in federal prison.

Read the full press release

ICO hands down first monetary penalties for data breaches

In the UK, the Information Commissioner's Office (ICO) handed down its first monetary penalties in two data breach cases for violations in the Data Protection Act.  

The first penalty, of £100,000, was issued to Hertfordshire County Council for two serious incidents where council employees faxed highly sensitive personal information to the wrong recipients. The first case, involving child sexual abuse, was before the courts, and the second involved details of care proceedings.

The second monetary penalty, of £60,000, was issued to employment services company A4e for the loss of an unencrypted laptop which contained personal information relating to 24,000 people who had used community legal advice centres in Hull and Leicester.

Read the full press release

Indiana AG sues WellPoint for delay in data breach notification

From the Indiana Attorney General's Office Press Release:

The Indiana Attorney General's office today filed a lawsuit against Indianapolis-based WellPoint, Inc. claiming the health insurance provider did not notify their customers or the Attorney General's office in a timely manner following a data breach earlier this year affecting more than 32,000 Hoosiers. Indiana law requires businesses to notify both the individuals potentially affected by a data breach, as well as the Attorney General's office without unreasonable delay. This notification requirement was supported by Attorney General Greg Zoeller and included in House Enrolled Act 1121, which took effect in July 2009.

Applications for insurance policies submitted to WellPoint containing social security numbers, financial information and health records were potentially available to the general public through an unsecured Internet web-site for a period of at least 137 days between October 2009 and March 2010. According to the state's complaint, WellPoint was notified on February 22, 2010 and again on March 8, 2010 that application records containing personal information were accessible through its public website.
WellPoint did not begin notifying customers of the security breach until June 18, 2010. Following news reports of the breach, the Attorney General's office submitted an inquiry to WellPoint and received a response on July 30, 2010. The delays in notice both to customers and to the Attorney General's office are considered unreasonable. The state is seeking $300,000 in civil penalties.

While most inadvertent security breaches do not result in fraud, notifying those affected in a timely manner significantly reduces the risk of identity theft. Situations involving the theft of personal information for the purposes of identity theft most often result in some form of fraud occurring within seven to 10 days. The Attorney General's office has not received any consumer complaints relating to identity theft as a result of the WellPoint data breach.

The Attorney General's Identity Theft Unit continues to investigate the WellPoint data breach and encourages those who may have been affected to perform a credit check and a security freeze to guard against identity theft. By law, security freezes are available for free to residents of Indiana. More information and instructions are available on the Attorney General's website here: http://www.in.gov/attorneygeneral/2411.htm 

Former employee of Fannie Mae contractor convicted of attempting to destroy data

The Baltimore Office of the FBI announced yesterday that a former employee of a Fannie Mae contractor was found guilty of computer intrusion for attempting to plant a malicious script on a server after being terminated.

After being terminated by Fannie Mae, Rajendrasinh Babubhai Makwana added malicious code to a boot script to be executed at a later date.  The code, had it executed, would have destroyed all financial, securities and mortgage data on almost 5000 servers.

According to testimony and evidence presented at trial, Makwana was fired on October 24, 2008 and told to turn in all of his Fannie Mae equipment, including his laptop. On October 29, 2008, a Fannie Mae senior engineer discovered a malicious script embedded in a routine program. A subsequent analysis of the script, computer logs, Makwana’s laptop and other evidence, revealed that Makwana had transmitted the malicious code on October 24, 2008 which was intended to execute on January 31, 2009. The malicious code was designed to propagate throughout the Fannie Mae network of computers and destroy all data, including financial, securities and mortgage information.

Makwana faces up to 10 years in prison.  Sentencing is scheduled for December 9, 2010.

 

Source:  Baltimore Office of the FBI

 

Former GEXA Employee Sentenced to 1 Year for Damaging Computer Network

Steven Jinwoo Kim, a former database administrator for GEXA Energy in Houston, Texas,  was sentenced last week to 12 months in prison for hacking into his former employer's computer network and causing damage after he was terminated in 2008.  In addition, Kim was ordered to pay $100,000 in restitution to GEXA. 

According to a Justice Department press release:

According to court documents, on Feb. 5, 2008, GEXA Energy terminated Kim from his position as a senior database administrator and revoked all his administrative rights and access to the GEXA Energy computer network. In pleading guilty, Kim admitted that in the early hours of April 30, 2008, he used his home computer to connect to the GEXA Energy computer network and a database that contained information on approximately 150,000 GEXA Energy customers. While connected to the computer network, Kim recklessly caused damage to the computer network and the customer database by inputting various Oracle database commands. Kim also copied and saved to his home computer a database file containing personal information on the GEXA Energy customers, including names, billing addresses, social security numbers, dates of birth and drivers license numbers. According to court documents, Kim’s actions caused a $100,000 loss to GEXA Energy.

Read the press release

Ex-UCLA Healthcare Employee receives first prison sentence for HIPAA violations

Huping Zhou, a former UCLA Healthcare employee who pleaded guilty to illegally accessing private patient data, was sentenced yesterday to four months in federal prison, becoming the first individual in the nation to receive a prison sentence for violating HIPAA privacy provisions.

From the FBI Press Release:

Zhou, who is a licensed cardiothoracic surgeon in China, was employed in 2003 at UCLA Healthcare System as a researcher with the UCLA School of Medicine. On October 29, 2003, Zhou received a notice of intent to dismiss him from UCLA Healthcare for job performance reasons unrelated to his illegal access of medical records. That night, Zhou, without any legal or medical reason, accessed and read his immediate supervisor’s medical records and those of other co-workers. For the next three weeks, Zhou's continued his illegal accessing of patient records and expanded his illegal conduct to include confidential health records belonging to various celebrities. According to court documents, Zhou accessed the UCLA patient records system 323 times during the three-week period, with most of the accesses involving well recognized celebrities.

In his plea agreement, Zhou admitted that he obtained and read private patient health and medical information on four specific occasions after he was formally terminated from the UCLA Healthcare System. Zhou acknowledged that at the time he viewed these patients’ medical information, he had no legitimate reason, medical or otherwise, for obtaining the personal information.

Read the full press release

Former NSA executive charged for theft and disclosure of classified information

The U.S. Department of Justice announced a 10-count indictment charging Thomas Drake, a former National Security Agency senior executive with willfully retaining classified information, obstruction of justice and making false statements.

Drake, who was employed at the NSA from 2001 to 2008, allegedly served as the confidential source of newspaper reporter for a series of articles published between February 2006 and November 2007.  During this time, Drake allegedly researched stories for the reporter, providing both classified and unclassified documents from the NSA's classified network, and reviewed and helped edit drafts of the reporter's articles.

According to the press release:

The indictment also alleges that Drake took a series of steps to facilitate the provision of this information to the reporter, including:

• exchanging hundreds of e-mails with and meeting with the reporter;
• researching stories for the reporter to write in the future by e-mailing unwitting NSA employees and accessing classified and unclassified documents on classified NSA networks;
• copying and pasting classified and unclassified information from NSA documents into untitled word processing documents which, when printed, had the classification markings removed;
• printing both classified and unclassified documents, bringing them to his home, and retaining them there without authority;
• scanning and emailing electronic copies of classified and unclassified documents to the reporter from his home computer; and
• reviewing, commenting on, and editing drafts of the reporter’s articles.

Drake is charged with five counts of willfully retaining documents that relate to the national defense, obstruction of justice, and four counts of making false statements to the FBI.  He faces a maximum penalty of 90 years in prison and $2.5 million in fines.

Read the full press release

Judge Removes J.C. Penney Shield From Breach

Wired Magazine reports that J.C. Penney has lost its fight to remain anonymous keep details of a breach to its payment card network sealed.  

The intrusions, by TJX hacker Albert Gonzalez and his overseas accomplices, occurred beginning in October 2007. J.C. Penney admits it was “wholly unaware” of the breach until the Secret Service told the company about it in May 2008, but now says with certitude that no identity or bank-card data was stolen in the breach it failed to detect.

J.C. Penney had argued it was entitled to protections under the 2004 Victims' Rights Act.  According to spokeswoman Darcie Brossart:

“Because there was no reason to think that the hackers were successful, there was no need to alarm J.C. Penney customers,” says Brossart, “We believed we had a legitimate interest in not being linked to criminal activity that resulted in major thefts from other companies.”

So in court filings, J.C. Penney argued that it was entitled to anonymity under the 2004 Crime Victims’ Rights Act, a law intended to protect the “dignity and privacy” of victims. A federal judge on Friday ordered the company’s identity unsealed anyway, as well as that of a second breached company, clothing retailer Wet Seal.

Read the story at Wired

Florida couple indicted for theft of patient data

The FBI and the U.S. Attorney for the Southern District of Florida announced the indictment of Ruben Rodriguez and Maria Victoria Suarez, a Coral Gables couple, for the theft of personal data from patients to be sold to personal injury lawyers and clinics.  The information would then be used to solicit those patients for lawsuits.

According to the indictment, defendant Rodriguez solicited the assistance of a co-conspirator, who at the time was employed by AMR, an ambulance service provider that offered emergency and non-emergency medical transport services in Miami-Dade County. Defendant Rodriguez reached an agreement with the co-conspirator that required the co-conspirator to illegally gain access to certain personal information of individuals transported by AMR and to turn over that information to Rodriguez, in exchange for payments from Rodriguez.

The indictment further alleges that defendant Rodriguez would, in turn, sell the personal identification information he received from the co-conspirator to either of the following: (1) personal injury attorneys, who would use the personal identification information to improperly solicit individuals transported by AMR with hopes of representing them in future legal proceedings; and/or (2) personal injury clinics, who would use the personal identification information to improperly solicit individuals transported by AMR to offer medical services. The payments defendant Rodriguez received from the attorneys and clinics were determined, in part, by any resulting lawsuits, settlements, payments, and/or reimbursements.

The indictment additionally alleges that in the midst of this conspiracy, defendant Rodriguez introduced the co-conspirator to defendant Suarez, his wife, who thereafter, along with defendant Rodriguez, purchased the illegally obtained information from the co-conspirator for subsequent resale to others, as described above.

According to CBS4 in South Florida, this is not the first time the pair has bagged for this type of activity:

The couple was charged with conspiracy to steal patient records from Jackson Memorial Hospital last year. Rodriguez and Suarez allegedly used the same technique to get the information and get rich off of it. 

According to investigators Rodriguez paid JMH ultrasound technician Rebecca Garcia $1000 a month for patient records between December 2006 and February 2009. 

An unnamed personal-injury lawyer reportedly wrote checks worth more than $85,000 to a shell company between 2006 and 2009. The false account allegedly provided Rodriguez and Suarez kickback money.

That case has not yet gone to trial.  Let's hope the courts have the good sense to hold them without bail this time.