Blue Lance InfoSec Blog

HSBC employee data theft said to affect 15,000 account holders

HSBC says in a statement that information stolen by a former IT employee affects 15,000 existing Swiss client accounts.   According to the statement:

It is now clear that the theft, which was perpetrated by a former IT employee about three years ago, involves approximately 15,000 existing clients who had accounts with the bank in Switzerland before October 2006. The stolen client information is limited to accounts in Switzerland, excluding ex-HSBC Guyerzeller accounts. There is no data compromised for any branches of the bank outside Switzerland, which operate on separate systems and security, or other entities within the HSBC Group,

Alexandre Zeller, CEO of HSBC Private Bank SA said "We deeply regret this situation and unreservedly apologise to our clients for this threat to their privacy. We are determined to protect our clients’ interests and are taking every necessary measure to do so, actively contacting all our clients with Swiss-based accounts."

The bank said that it has spent more than $93 million in system upgrades and security improvements.

The bank is cooperating with the Swiss authorities and continues its own investigations, and a criminal investigation led by the Swiss Federal Prosecutor is underway. The Swiss authorities confirmed to us that they will not support the use of the stolen data to answer requests from foreign authorities. The French authorities have informed the Swiss authorities that the data they hold will not be used inappropriately.

Connecticut AG Sues Healthcare Provider in First Case of State Enforcement Under HITECH

Connecticut Attorney General Richard Blumenthal sued Health Net of Connecticut, Inc. for HIPAA violations stemming from the loss of a portable hard drive containing the health and financial information of approximately 446,000 Connecticut enrollees in May of 2009, and the failure to notify authorities and consumers for at least 6 months.

Additionally, the AG seeks a court order preventing Health Net from continued HIPAA violations by requiring that protected health information stored on portable drives be encrypted.

A subsequent investigation found that the data, which included health records, social security numbers and bank account numbers in over 27 million scanned pages, was not encrypted or otherwise protected from unauthorized access and was viewable on commonly available software.

The case is the first action taken by a state under the HITECH Act, which enables states to enforce HIPAA violations.

Source:  Connecticut Attorney General's Office

T-Mobile Employee Sells Account Details of Thousands of Subscribers

The Information Commissioner's Office (ICO) announced details of an incident involving a mobile telephone company where one or more employees allegedly sold customer details including expiration dates of their contracts to competitors.  Although the ICO did not mention the company by name, the Guardian identified the provider as T-Mobile:

An employee of the phone operator T-Mobile sold the personal records of customers, which included details of when their mobile phone contracts expired. The millions of items of information were then sold on for "substantial sums", the Information Commissioner's Office (ICO) said. Rival networks and mobile phone retailers were then able to use it to try to lure away T-Mobile customers by "cold calling" them.

In the course of it's investigation, the ICO "obtained several search warrants attended a number of premises, and is now preparing a prosecution file".

Sources:

The Information Commissioner's Office

The Guardian

Personal Data of 16,000 Exposed on Stolen USB Drive

InternetNews.com reports that a USB drive left overnight in an unlocked car was stolen, exposing the personal data of 16,000 Roane State Community College students and employees.

The college has sent letters to anyone who may be affected by this theft and has notified major the major credit-monitor and reporting agencies.

"While we have no reason to believe that the data was stolen for identity-theft purposes, we urge those affected to closely monitor their financial accounts for irregularities," Danny Gibbs, Roane State's vice president of business and finance said in a statement. "Roane State deeply regrets the exposure of this data.

Read the entire article here.

One Step Closer to Federal Data Breach Notification Requirements

Yesterday, the U.S. Senate Judiciary Commitee passed two bills which set guidelines for data breach notifications at the federal level.

S.139, known as the Data Breach Notification Act, establishes guidelines for data breach notifications for government agencies and business entities as well as enforcement actions.

S.1490 is known as the Personal Data Privacy and Security Act of 2009 and establishes standards for developing and implementing safeguards to protect the security of sensitive personal information.  It also imposes civil penalties for violations of such standards.

The next stop for both bills is a full Senate vote.

Data Breach Notifications Encounter "Harm Threshold" Controversy

Network World reports:

The House Committee on Energy and Commerce is voicing concern over a controversial provision in a recently passed health care breach notification bill that gives health care companies considerable discretion on whether to disclose a data breach.

The so-called "harm threshold" provision was included in an interim final rule published late last month by the U.S. Department of Health and Human Services (HHS) in a bill requiring breach notification for unsecured health information. Under the provision, health-care entities would have to publicly disclose data compromises only if they think the breach will cause financial harm to those whose data was compromised or hurt their reputation.

Read the full article here.

Study Shows Cost of Canadian Data Breaches Skyrocketing

From a TELUS press release:

According to the study which surveyed more than 600 IT security professionals across the country:

• IT security breaches cost the average Canadian organization an estimated $834,000 in 2009 – a 97 percent increase from the $423,000 reported by the study last year.
• Similarly, the average number of reported IT security breaches also increased 276 per cent to 11.3 per organization in 2009 – compared with an average of three in 2008.

While every type of organization incurred an increase in breach costs during 2009, the increases were different across sectors:

• Government organizations more than tripled their average annual cost of breaches to $1,000,000 in 2009, up from $321,000 in 2008.
• Private companies more than doubled their cost of breaches to $807,000 up from $294,000 in 2008.
• Publicly traded companies reported a moderate increase of only six per cent year-over-year.

 “The significant increase in reported breaches is sobering, however there are several reasons for this activity and some of them are actually positive,” said Dr. Walid Hejazi, Professor of Business Economics, Rotman School of Management. “Our research indicates that one of the contributing factors behind the surge in IT security-related losses is compliance regulations. Although this factor does not explain all instances of breach increases, it is important to note that because compliance has become a much stronger driver for private companies and government organizations in 2009, capabilities to detect and respond to security compromises have greatly improved. The result is that organizations are now detecting more security threats than ever before and consequently need to allocate more budget to address them appropriately.”

“Canadian organizations are finding it difficult to improve their security posture within the current economic climate. However, we found several organizations that performed well despite the adversity. Those organizations tended to review whether or not they were focusing on the right threats and conducted regular assessments of their capabilities to prevent, detect and respond to security concerns,” said Alan Lefort, managing director, TELUS Security Labs. “Too often organizations take a checklist approach to managing security. Without a threat-based view to security management that measures end-to-end capabilities, they are often unprepared when a new type of attack or vulnerability rises to prominence.”

The study also uncovered a rise in employee-related security breaches specifically related to intellectual property. IT security breaches by employees doubled over the past 12 months, with 36 per cent of all IT security incidents in Canada resulting from insider activity. When compared to results from last year's Rotman-TELUS study, the results from 2009 revealed:

• Unauthorized access to information by employees increased by 112 per cent.
• Theft of proprietary information increased 75 per cent.
• Laptop or mobile hardware device theft increased by 56 per cent.

The 2009 Rotman-TELUS Joint Study on Canadian IT Security Practices study also uncovered
insights in several additional areas including:

• Canadian IT security budgets.
• Top security concerns.
• IT security professional salaries and compensation.
• Security governance.
• Security outsourcing.
• Cloud computing concerns.
• Security technology investments.

For more information, or to request a copy of the study, visit www.telus.com/securitystudy.

Risky Data Disposal Procedures at the Department of Defense

Proper procedures are found not to be in place at the Department of Defense regarding data disposal.  J. Nicholas Hoover for Information Week writes:

”In an evaluation of DoD internal controls and processes, the inspector general found that several military departments didn't properly delete data and fully account for unclassified equipment before releasing it to other federal agencies, schools, and non-profit organizations.”

The lack of proper procedures in place has left a lot of personally identifiable information at risk.  Read the full article on Information Week.

The Rising Risk of Insider Threat, Two Ways

Rick Caccia writes for Computerworld on how to address two types of insider threats:

“‘I read about fraud all the time -- hackers, online gangs, angry employees, etc. It seems like it's on the rise. Why is this so hard to detect and how can we prevent fraud in our organization?’
It is true that fraud is increasing, and it does seem that we read about incidents on an almost daily basis. This is a factor of the rise in the amount of sensitive information that is now online, an increased number of online applications that access this information, and the growing number of users who use online services for financial services. The result is more opportunity for fraud, with less effort, so it's no surprise criminals have moved their activities online and that insider-led fraud is on the rise.”

Read the full article here.

New Study Finds Insider Incidents Primarily Accidental - But Still Costly

A new study of 400 organizations by IDC and RSA finds that more than half (52%) of organizations characterized insider incidents and predominantly accidental.  However, the annual loss from insider incidents is approaching $800,000 per organization in the United States alone.

Among the types of internal threats measured, the report finds that organizations experience nearly one incident per month from each type of threat.

Some of the other highlights include:

• Inappropriate, out of date privileges and access rights have the largest financial impact to organizations.
• 40% of surveyed organizations list contractors and temporary employees as the highest risk.
• Technical staff and IT administrators are seen a potential threats due to their access to multiple sensitive systems.

For more information, download the study.