Blue Lance InfoSec Blog

VA launches criminal investigation into employee for downloading patient data

Nextgov reports that the inspector general at the Veterans Affairs Department has launched an investigation into a physician assistant, who allegedly downloaded patient data.

The assistant allegedly recorded two sets of patient data on to a personal laptop for research purposes. One set included three years' worth of patient data and another held 18 years of medical information, according to a source familiar with the incident and who asked not to identified.

There are conflicting reports on how the data was obtained:

Roger Baker, VA's chief information officer, commented on an item about the incident that was posted Monday evening on a Nextgov blog that the physician assistant's laptop was never connected to the VA network and any data she recorded on her laptop was "hand entered."

But the source told Nextgov the VA inspector general is investigating whether the assistant used two thumb drives to transfer the data to the laptop.

No word on how many patients were involved or whether or not they would be contacted.  Hopefully, the VA's IT department has an detailed user audit trail to work with to shed some light on this incident. 

Sources: Nextgov, Open Security Foundation (OSF)

Employee indicted for attempting to corrupt TSA database

The FBI announced this week the indictment of Douglas James Duchak, former employee at the  TSA's Colorado Springs Operations Center (CSOC) on charges of attempting to intentionally damage a protected computer.  Duchak allegedly attempted to damage the TSA CSOC database which receives its screening data from the government's Terrorist Screening Database and the U.S. Marshal's Service Warrant Information Network. 

According to the indictment, Duchak was employed as a data analyst at the TSA CSOC from at least August 2004 through October 23, 2009, where he handled data updates from the federal government's Terrorist Screening Database and the United States Marshal's Service Warrant Information Network. Duchak received notice on October 15, 2009 that his employment at CSOC would be terminated on October 30, 2009.  

On October 22, 2009, Duchak allegedly attempted to install malicious code in an effort to damage the CSOC database.

Count one of the indictment alleges that on October 22, 2009, Duchak attempted intentionally to cause damage without authorization to a protected computer, namely, he knowingly transmitted code into the CSOC server containing data from the U.S. Marshal’s Service Warrant Information Network, and thereby intentionally attempted to cause damage to the CSOC computer and database.

Count two of the indictment alleges that on October 23, 2009, Duchak attempted intentionally to cause damage without authorization to a protected computer, namely, he knowingly transmitted code into the CSOC server that contained the Terrorist Screening Database, and thereby attempted intentionally to cause damage to the CSOC computer and database.

The indictment alleges that the defendant attempted intentionally to cause damage without authorization to the CSOC computers, which caused loss aggregating at least $5,000 or more during a one-year period and if completed would have caused damage affecting a computer used by the United States government in furtherance of national security.

Duchak faces up to 10 years in federal prison and $250,000 in fines.

Source:  Denver Branch of the FBI

HSBC employee data theft said to affect 15,000 account holders

HSBC says in a statement that information stolen by a former IT employee affects 15,000 existing Swiss client accounts.   According to the statement:

It is now clear that the theft, which was perpetrated by a former IT employee about three years ago, involves approximately 15,000 existing clients who had accounts with the bank in Switzerland before October 2006. The stolen client information is limited to accounts in Switzerland, excluding ex-HSBC Guyerzeller accounts. There is no data compromised for any branches of the bank outside Switzerland, which operate on separate systems and security, or other entities within the HSBC Group,

Alexandre Zeller, CEO of HSBC Private Bank SA said "We deeply regret this situation and unreservedly apologise to our clients for this threat to their privacy. We are determined to protect our clients’ interests and are taking every necessary measure to do so, actively contacting all our clients with Swiss-based accounts."

The bank said that it has spent more than $93 million in system upgrades and security improvements.

The bank is cooperating with the Swiss authorities and continues its own investigations, and a criminal investigation led by the Swiss Federal Prosecutor is underway. The Swiss authorities confirmed to us that they will not support the use of the stolen data to answer requests from foreign authorities. The French authorities have informed the Swiss authorities that the data they hold will not be used inappropriately.

Connecticut AG Sues Healthcare Provider in First Case of State Enforcement Under HITECH

Connecticut Attorney General Richard Blumenthal sued Health Net of Connecticut, Inc. for HIPAA violations stemming from the loss of a portable hard drive containing the health and financial information of approximately 446,000 Connecticut enrollees in May of 2009, and the failure to notify authorities and consumers for at least 6 months.

Additionally, the AG seeks a court order preventing Health Net from continued HIPAA violations by requiring that protected health information stored on portable drives be encrypted.

A subsequent investigation found that the data, which included health records, social security numbers and bank account numbers in over 27 million scanned pages, was not encrypted or otherwise protected from unauthorized access and was viewable on commonly available software.

The case is the first action taken by a state under the HITECH Act, which enables states to enforce HIPAA violations.

Source:  Connecticut Attorney General's Office

T-Mobile Employee Sells Account Details of Thousands of Subscribers

The Information Commissioner's Office (ICO) announced details of an incident involving a mobile telephone company where one or more employees allegedly sold customer details including expiration dates of their contracts to competitors.  Although the ICO did not mention the company by name, the Guardian identified the provider as T-Mobile:

An employee of the phone operator T-Mobile sold the personal records of customers, which included details of when their mobile phone contracts expired. The millions of items of information were then sold on for "substantial sums", the Information Commissioner's Office (ICO) said. Rival networks and mobile phone retailers were then able to use it to try to lure away T-Mobile customers by "cold calling" them.

In the course of it's investigation, the ICO "obtained several search warrants attended a number of premises, and is now preparing a prosecution file".

Sources:

The Information Commissioner's Office

The Guardian

Personal Data of 16,000 Exposed on Stolen USB Drive

InternetNews.com reports that a USB drive left overnight in an unlocked car was stolen, exposing the personal data of 16,000 Roane State Community College students and employees.

The college has sent letters to anyone who may be affected by this theft and has notified major the major credit-monitor and reporting agencies.

"While we have no reason to believe that the data was stolen for identity-theft purposes, we urge those affected to closely monitor their financial accounts for irregularities," Danny Gibbs, Roane State's vice president of business and finance said in a statement. "Roane State deeply regrets the exposure of this data.

Read the entire article here.

One Step Closer to Federal Data Breach Notification Requirements

Yesterday, the U.S. Senate Judiciary Commitee passed two bills which set guidelines for data breach notifications at the federal level.

S.139, known as the Data Breach Notification Act, establishes guidelines for data breach notifications for government agencies and business entities as well as enforcement actions.

S.1490 is known as the Personal Data Privacy and Security Act of 2009 and establishes standards for developing and implementing safeguards to protect the security of sensitive personal information.  It also imposes civil penalties for violations of such standards.

The next stop for both bills is a full Senate vote.

Data Breach Notifications Encounter "Harm Threshold" Controversy

Network World reports:

The House Committee on Energy and Commerce is voicing concern over a controversial provision in a recently passed health care breach notification bill that gives health care companies considerable discretion on whether to disclose a data breach.

The so-called "harm threshold" provision was included in an interim final rule published late last month by the U.S. Department of Health and Human Services (HHS) in a bill requiring breach notification for unsecured health information. Under the provision, health-care entities would have to publicly disclose data compromises only if they think the breach will cause financial harm to those whose data was compromised or hurt their reputation.

Read the full article here.

Study Shows Cost of Canadian Data Breaches Skyrocketing

From a TELUS press release:

According to the study which surveyed more than 600 IT security professionals across the country:

• IT security breaches cost the average Canadian organization an estimated $834,000 in 2009 – a 97 percent increase from the $423,000 reported by the study last year.
• Similarly, the average number of reported IT security breaches also increased 276 per cent to 11.3 per organization in 2009 – compared with an average of three in 2008.

While every type of organization incurred an increase in breach costs during 2009, the increases were different across sectors:

• Government organizations more than tripled their average annual cost of breaches to $1,000,000 in 2009, up from $321,000 in 2008.
• Private companies more than doubled their cost of breaches to $807,000 up from $294,000 in 2008.
• Publicly traded companies reported a moderate increase of only six per cent year-over-year.

 “The significant increase in reported breaches is sobering, however there are several reasons for this activity and some of them are actually positive,” said Dr. Walid Hejazi, Professor of Business Economics, Rotman School of Management. “Our research indicates that one of the contributing factors behind the surge in IT security-related losses is compliance regulations. Although this factor does not explain all instances of breach increases, it is important to note that because compliance has become a much stronger driver for private companies and government organizations in 2009, capabilities to detect and respond to security compromises have greatly improved. The result is that organizations are now detecting more security threats than ever before and consequently need to allocate more budget to address them appropriately.”

“Canadian organizations are finding it difficult to improve their security posture within the current economic climate. However, we found several organizations that performed well despite the adversity. Those organizations tended to review whether or not they were focusing on the right threats and conducted regular assessments of their capabilities to prevent, detect and respond to security concerns,” said Alan Lefort, managing director, TELUS Security Labs. “Too often organizations take a checklist approach to managing security. Without a threat-based view to security management that measures end-to-end capabilities, they are often unprepared when a new type of attack or vulnerability rises to prominence.”

The study also uncovered a rise in employee-related security breaches specifically related to intellectual property. IT security breaches by employees doubled over the past 12 months, with 36 per cent of all IT security incidents in Canada resulting from insider activity. When compared to results from last year's Rotman-TELUS study, the results from 2009 revealed:

• Unauthorized access to information by employees increased by 112 per cent.
• Theft of proprietary information increased 75 per cent.
• Laptop or mobile hardware device theft increased by 56 per cent.

The 2009 Rotman-TELUS Joint Study on Canadian IT Security Practices study also uncovered
insights in several additional areas including:

• Canadian IT security budgets.
• Top security concerns.
• IT security professional salaries and compensation.
• Security governance.
• Security outsourcing.
• Cloud computing concerns.
• Security technology investments.

For more information, or to request a copy of the study, visit www.telus.com/securitystudy.

Risky Data Disposal Procedures at the Department of Defense

Proper procedures are found not to be in place at the Department of Defense regarding data disposal.  J. Nicholas Hoover for Information Week writes:

”In an evaluation of DoD internal controls and processes, the inspector general found that several military departments didn't properly delete data and fully account for unclassified equipment before releasing it to other federal agencies, schools, and non-profit organizations.”

The lack of proper procedures in place has left a lot of personally identifiable information at risk.  Read the full article on Information Week.