Blue Lance InfoSec Blog

Former employee of Fannie Mae contractor convicted of attempting to destroy data

The Baltimore Office of the FBI announced yesterday that a former employee of a Fannie Mae contractor was found guilty of computer intrusion for attempting to plant a malicious script on a server after being terminated.

After being terminated by Fannie Mae, Rajendrasinh Babubhai Makwana added malicious code to a boot script to be executed at a later date.  The code, had it executed, would have destroyed all financial, securities and mortgage data on almost 5000 servers.

According to testimony and evidence presented at trial, Makwana was fired on October 24, 2008 and told to turn in all of his Fannie Mae equipment, including his laptop. On October 29, 2008, a Fannie Mae senior engineer discovered a malicious script embedded in a routine program. A subsequent analysis of the script, computer logs, Makwana’s laptop and other evidence, revealed that Makwana had transmitted the malicious code on October 24, 2008 which was intended to execute on January 31, 2009. The malicious code was designed to propagate throughout the Fannie Mae network of computers and destroy all data, including financial, securities and mortgage information.

Makwana faces up to 10 years in prison.  Sentencing is scheduled for December 9, 2010.

 

Source:  Baltimore Office of the FBI

 

Johns Hopkins employee among five indicted in ID theft scheme using stolen patient information

A Johns Hopkins employee and four other individuals were indicted this week for their roles in a credit fraud scheme using patient data stolen from the hospital, resulting in more than $600,000 in fraudulently obtained credit.

The indictment alleges that between August 2007 and March 2009, Jasmine Amber Smith allegedly provided names, social security numbers, dates of birth and addresses of patients and the parents and guardians of minor patients to the others.  The data was then used to apply for instant credit and make purchases before the credit cards were received by the victims.

The statement does not provide specific details on how many patient records were stolen, only saying "more than 50 business and individuals were affected".

The full press release from the Maryland U.S. Attorney's Office is below:

A federal grand jury has indicted the following five Maryland defendants on fraud and aggravated identity theft charges in connection with a scheme to use stolen hospital patient identity information to open fraudulent credit accounts and make purchases on “instant credit” at retail stores in Maryland: 

Michael Allen, age 34, of Baltimore, 
Jasmine Amber Smith, age 25, of Nottingham,
Tyrell Douglas McCormick, age 22, of Baltimore, 
Ayanna Devon Johnson, age 38, of Baltimore, and
Gloria Canada, age 54, of Baltimore. 

The superseding indictment was returned on September 15, 2010 and unsealed today upon the arrest of the final defendant, Gloria Canada. 

The indictment was announced by United States Attorney for the District of Maryland Rod J. Rosenstein; Special Agent in Charge Barbara Golden of the United States Secret Service – Baltimore Field Office; Postal Inspector in Charge Daniel S. Cortez of the U.S. Postal Inspection Service - Washington Division; and Chief James W. Johnson of the Baltimore County Police Department. 

According to the 39 count superseding indictment, while employed by Johns Hopkins Hospital from August 2007 to March 2009, Smith is alleged to have improperly accessed the records of the hospital’s patients to obtain the personal identity information of patients and the parents and guardians of minor patients, including names, social security numbers, dates of birth and addresses. Smith allegedly provided the stolen identity information to Johnson and Canada. From May 2008 to June 2009, Allen and McCormick allegedly used the stolen information to apply for instant credit at stores located in Maryland and make purchases on “instant credit” before the fraudulently-obtained credit cards were received by the victims. 

The indictment alleges that during the course of the scheme, the defendants fraudulently obtained over $600,000 in credit from over 50 institutional and individual victims. 

The defendants face a maximum sentence of 30 years in prison for conspiracy to commit bank fraud and two years in prison consecutive to any other sentence for aggravated identity theft. In addition, McCormick and Allen face a maximum sentence of 30 years in prison for bank fraud and 15 years in prison for access device fraud. Canada is scheduled to have her initial appearance in U.S. District Court in Baltimore today at 2:00 p.m. 

An indictment is not a finding of guilt. An individual charged by indictment is presumed innocent unless and until proven guilty at some later criminal proceedings. 

United States Attorney Rod J. Rosenstein commended the U.S. Secret Service – Baltimore Field Office, the U.S. Postal Inspection Service - Washington Division and the Baltimore County Police Department for their work in the investigation. Mr. Rosenstein thanked Assistant United States Attorneys Tamera Fine and James Warwick, who are prosecuting the case.

IT manager pleads guilty to snooping through patient records

ComputerWorld UK reports that Dale Trevor, a data quality manager at Hull Primary Care Trust in the UK has pleaded guilty to illegally accessing female patient's medical records on 431 occasions, 336 of which were the records of family members, friends and colleagues.

The incidents occurred during a nine month period beginning in October 2008.  Trevor pleaded guilty in court to seven charges of violating the Computer Misuse Act 1990 for accessing patient records without permission. He will be sentenced next month.

Read the entire article

 

Former Army employee arrested while attempting to smuggle confidential documents to China

According to the FBI Minneapolis field office,

A former civilian employee at the U.S. Army Training and Doctrine Command at Fort Sill, Oklahoma, was taken into custody yesterday afternoon at the Minneapolis-St. Paul International Airport while attempting to board a flight to China. At the time of his attempted one-way flight to China, Liangtian Yang, age 26, also known as Alfred Yang, of Lawton, Oklahoma, allegedly had in his possession multiple media storage devices, one of which contained a restricted Army field manual. The manual was not authorized to be in his possession, nor was it authorized to be transferred to a personal computer disk.

Yang had his secret clearance revoked last month as a result of security violations.  The field manual was discovered by Customs officials during a secondary screening while awaiting his flight.  Yang faces a maximum penalty of one year in prison.

Full Press Release

Ex-General Motors employee charged in $40M theft of trade secrets

The FBI has released details of a federal indictment of a couple charged with conspiracy to possess trade secrets without authorization, unauthorized possession of trade secrets, and wire fraud.  Shannon Du and Yu Chin are charged with stealing thousands of GM documents regarding to the company's hybrid technology worth an estimated 40 million dollars. 

According to the press release,

According to the indictment, from December 2003 and continuing through May 2006, the defendants conspired to possess trade secret information of General Motors Company relating to hybrid vehicles, knowing that the information had been stolen, converted, or obtained without authorization. The indictment alleges that Du, while employed with GM, provided GM trade secret information relating to hybrid vehicles to her husband, Qin, for his benefit and for the benefit of a company, Millennium Technology International Inc. (MTI), that the defendants owned and operated. Approximately five days after Du was offered a severance agreement by GM in January 2005, she copied thousands of GM documents, including trade secret documents, to an external computer hard drive used for MTI business. A few months later, Qin moved forward on a new business venture to provide hybrid vehicle technology to Chery Automobile, a Chinese automotive manufacturer based in China and a competitor of GM. The indictment further alleges that in May 2006, the defendants possessed GM trade secret information without authorization on several computer and electronic devices located in their residence.

Full press release

Former GEXA Employee Sentenced to 1 Year for Damaging Computer Network

Steven Jinwoo Kim, a former database administrator for GEXA Energy in Houston, Texas,  was sentenced last week to 12 months in prison for hacking into his former employer's computer network and causing damage after he was terminated in 2008.  In addition, Kim was ordered to pay $100,000 in restitution to GEXA. 

According to a Justice Department press release:

According to court documents, on Feb. 5, 2008, GEXA Energy terminated Kim from his position as a senior database administrator and revoked all his administrative rights and access to the GEXA Energy computer network. In pleading guilty, Kim admitted that in the early hours of April 30, 2008, he used his home computer to connect to the GEXA Energy computer network and a database that contained information on approximately 150,000 GEXA Energy customers. While connected to the computer network, Kim recklessly caused damage to the computer network and the customer database by inputting various Oracle database commands. Kim also copied and saved to his home computer a database file containing personal information on the GEXA Energy customers, including names, billing addresses, social security numbers, dates of birth and drivers license numbers. According to court documents, Kim’s actions caused a $100,000 loss to GEXA Energy.

Read the press release

Sheriff's Deputy Convicted of Exceeding Authorized Computer Access

A former Harris County Sheriff deputy has been convicted of using his access to the National Crime Information Center (NCIC) to sell confidential data to an individual working as a confidential informant for the FBI.

From the Houston Office of the FBI:

The charges against Green are the result of an FBI undercover operation initiated after receiving information that Kurt Green, an employee of the HCSO assigned to the jail, sold information from the federal database known as NCIC. The NCIC database is maintained by the FBI. On Jan. 12, 2010, in a recorded telephone conversation, the informant provided deputy Green with the names of 10 persons—none of whom were under investigation—and requested criminal histories for the informant’s personal use. A week later, on Jan. 19, Green and the informant met in a parking lot in Houston. In an audio/video recording Green provided NCIC printouts for seven of the 10 persons to the informant, explained the printouts were from the NCIC database, and was paid $4900 by the informant for the information.

Green faces a maximum punishment of five years in prison, up to three years of supervised release, and a maximum fine of $250,000.

Read the press release

Employee snooping costs 5 California hospitals $675K in fines

The California Department of Public Health (CDPH) announced the assessment of fines and penalties of $675,000 to five California hospitals for failing to prevent unauthorized access to confidential patient information.

The following hospitals received penalties:

1. Community Hospital of San Bernardino, San Bernardino, San Bernardino County: The hospital was assessed a $250,000 fine after the facility failed to prevent unauthorized access of 204 patients’ medical information by one employee.
2. Community Hospital of San Bernardino, San Bernardino, San Bernardino County: The hospital was assessed a $75,000 fine after the facility failed to prevent unauthorized access of three patients’ medical information by one employee.
3. Enloe Medical Center, Chico, Butte County: The hospital was assessed a $130,000 fine after the facility failed to prevent unauthorized access of one patient’s medical information by seven employees.
4. Rideout Memorial Hospital, Marysville, Yuba County: The hospital was assessed a $100,000 fine after the facility failed to prevent unauthorized access of 33 patients’ medical information by 17 employees.
5. Ronald Reagan UCLA Medical Center, Los Angeles, Los Angeles County: The hospital was assessed a $95,000 fine after the facility failed to prevent unauthorized access of one patient’s medical information by four employees.
6. San Joaquin Community Hospital, Bakersfield, Kern County: The hospital was assessed a $25,000 fine after the facility failed to prevent unauthorized access of three patients’ medical information by two employees.

Each of the hospitals are required to submit a plan of correction within 10 working days.

Read the press release.

Former J.P. Morgan Chase Employee Admits Stealing Customer Information

Christine Fahmy, a former bank teller at J.P. Morgan Chase from Sciota, Pennsylvania pleaded guilty in U.S. District Court for her role in the theft of over $60,000 from customer's.  

According to press release issued by the FBI's Pennsylvania office:

Pfannenschmidt stated that Christine Fahmy, age 22, of Sciota, Pennsylvania, admitted to committing the offense in 2008 and early 2009. Fahmy admitted that when she was a teller at J.P. Morgan Chase and Company in Hackettstown, New Jersey, she accessed 12 customer account profiles and sold them to two individuals in Monroe County. As part of the scheme, Fahmy’s two confederates, Lavan Blair and Jonnell Gantt, used the customer profile information to have false identification documents made and used to access the accounts to obtain the money.

Blair and Gantt have already pleaded guilty to charges that include bank fraud and attempted bank fraud as aiders and abettors.  

For her role, Fahmy faces up to 10 years in prison and a $250,000 fine.

Read the full press release

Ex-UCLA Healthcare Employee receives first prison sentence for HIPAA violations

Huping Zhou, a former UCLA Healthcare employee who pleaded guilty to illegally accessing private patient data, was sentenced yesterday to four months in federal prison, becoming the first individual in the nation to receive a prison sentence for violating HIPAA privacy provisions.

From the FBI Press Release:

Zhou, who is a licensed cardiothoracic surgeon in China, was employed in 2003 at UCLA Healthcare System as a researcher with the UCLA School of Medicine. On October 29, 2003, Zhou received a notice of intent to dismiss him from UCLA Healthcare for job performance reasons unrelated to his illegal access of medical records. That night, Zhou, without any legal or medical reason, accessed and read his immediate supervisor’s medical records and those of other co-workers. For the next three weeks, Zhou's continued his illegal accessing of patient records and expanded his illegal conduct to include confidential health records belonging to various celebrities. According to court documents, Zhou accessed the UCLA patient records system 323 times during the three-week period, with most of the accesses involving well recognized celebrities.

In his plea agreement, Zhou admitted that he obtained and read private patient health and medical information on four specific occasions after he was formally terminated from the UCLA Healthcare System. Zhou acknowledged that at the time he viewed these patients’ medical information, he had no legitimate reason, medical or otherwise, for obtaining the personal information.

Read the full press release