Blue Lance InfoSec Blog

Johns Hopkins employee among five indicted in ID theft scheme using stolen patient information

A Johns Hopkins employee and four other individuals were indicted this week for their roles in a credit fraud scheme using patient data stolen from the hospital, resulting in more than $600,000 in fraudulently obtained credit.

The indictment alleges that between August 2007 and March 2009, Jasmine Amber Smith allegedly provided names, social security numbers, dates of birth and addresses of patients and the parents and guardians of minor patients to the others.  The data was then used to apply for instant credit and make purchases before the credit cards were received by the victims.

The statement does not provide specific details on how many patient records were stolen, only saying "more than 50 business and individuals were affected".

The full press release from the Maryland U.S. Attorney's Office is below:

A federal grand jury has indicted the following five Maryland defendants on fraud and aggravated identity theft charges in connection with a scheme to use stolen hospital patient identity information to open fraudulent credit accounts and make purchases on “instant credit” at retail stores in Maryland: 

Michael Allen, age 34, of Baltimore, 
Jasmine Amber Smith, age 25, of Nottingham,
Tyrell Douglas McCormick, age 22, of Baltimore, 
Ayanna Devon Johnson, age 38, of Baltimore, and
Gloria Canada, age 54, of Baltimore. 

The superseding indictment was returned on September 15, 2010 and unsealed today upon the arrest of the final defendant, Gloria Canada. 

The indictment was announced by United States Attorney for the District of Maryland Rod J. Rosenstein; Special Agent in Charge Barbara Golden of the United States Secret Service – Baltimore Field Office; Postal Inspector in Charge Daniel S. Cortez of the U.S. Postal Inspection Service - Washington Division; and Chief James W. Johnson of the Baltimore County Police Department. 

According to the 39 count superseding indictment, while employed by Johns Hopkins Hospital from August 2007 to March 2009, Smith is alleged to have improperly accessed the records of the hospital’s patients to obtain the personal identity information of patients and the parents and guardians of minor patients, including names, social security numbers, dates of birth and addresses. Smith allegedly provided the stolen identity information to Johnson and Canada. From May 2008 to June 2009, Allen and McCormick allegedly used the stolen information to apply for instant credit at stores located in Maryland and make purchases on “instant credit” before the fraudulently-obtained credit cards were received by the victims. 

The indictment alleges that during the course of the scheme, the defendants fraudulently obtained over $600,000 in credit from over 50 institutional and individual victims. 

The defendants face a maximum sentence of 30 years in prison for conspiracy to commit bank fraud and two years in prison consecutive to any other sentence for aggravated identity theft. In addition, McCormick and Allen face a maximum sentence of 30 years in prison for bank fraud and 15 years in prison for access device fraud. Canada is scheduled to have her initial appearance in U.S. District Court in Baltimore today at 2:00 p.m. 

An indictment is not a finding of guilt. An individual charged by indictment is presumed innocent unless and until proven guilty at some later criminal proceedings. 

United States Attorney Rod J. Rosenstein commended the U.S. Secret Service – Baltimore Field Office, the U.S. Postal Inspection Service - Washington Division and the Baltimore County Police Department for their work in the investigation. Mr. Rosenstein thanked Assistant United States Attorneys Tamera Fine and James Warwick, who are prosecuting the case.

IT manager pleads guilty to snooping through patient records

ComputerWorld UK reports that Dale Trevor, a data quality manager at Hull Primary Care Trust in the UK has pleaded guilty to illegally accessing female patient's medical records on 431 occasions, 336 of which were the records of family members, friends and colleagues.

The incidents occurred during a nine month period beginning in October 2008.  Trevor pleaded guilty in court to seven charges of violating the Computer Misuse Act 1990 for accessing patient records without permission. He will be sentenced next month.

Read the entire article

 

Former Army employee arrested while attempting to smuggle confidential documents to China

According to the FBI Minneapolis field office,

A former civilian employee at the U.S. Army Training and Doctrine Command at Fort Sill, Oklahoma, was taken into custody yesterday afternoon at the Minneapolis-St. Paul International Airport while attempting to board a flight to China. At the time of his attempted one-way flight to China, Liangtian Yang, age 26, also known as Alfred Yang, of Lawton, Oklahoma, allegedly had in his possession multiple media storage devices, one of which contained a restricted Army field manual. The manual was not authorized to be in his possession, nor was it authorized to be transferred to a personal computer disk.

Yang had his secret clearance revoked last month as a result of security violations.  The field manual was discovered by Customs officials during a secondary screening while awaiting his flight.  Yang faces a maximum penalty of one year in prison.

Full Press Release

Ex-General Motors employee charged in $40M theft of trade secrets

The FBI has released details of a federal indictment of a couple charged with conspiracy to possess trade secrets without authorization, unauthorized possession of trade secrets, and wire fraud.  Shannon Du and Yu Chin are charged with stealing thousands of GM documents regarding to the company's hybrid technology worth an estimated 40 million dollars. 

According to the press release,

According to the indictment, from December 2003 and continuing through May 2006, the defendants conspired to possess trade secret information of General Motors Company relating to hybrid vehicles, knowing that the information had been stolen, converted, or obtained without authorization. The indictment alleges that Du, while employed with GM, provided GM trade secret information relating to hybrid vehicles to her husband, Qin, for his benefit and for the benefit of a company, Millennium Technology International Inc. (MTI), that the defendants owned and operated. Approximately five days after Du was offered a severance agreement by GM in January 2005, she copied thousands of GM documents, including trade secret documents, to an external computer hard drive used for MTI business. A few months later, Qin moved forward on a new business venture to provide hybrid vehicle technology to Chery Automobile, a Chinese automotive manufacturer based in China and a competitor of GM. The indictment further alleges that in May 2006, the defendants possessed GM trade secret information without authorization on several computer and electronic devices located in their residence.

Full press release

Former GEXA Employee Sentenced to 1 Year for Damaging Computer Network

Steven Jinwoo Kim, a former database administrator for GEXA Energy in Houston, Texas,  was sentenced last week to 12 months in prison for hacking into his former employer's computer network and causing damage after he was terminated in 2008.  In addition, Kim was ordered to pay $100,000 in restitution to GEXA. 

According to a Justice Department press release:

According to court documents, on Feb. 5, 2008, GEXA Energy terminated Kim from his position as a senior database administrator and revoked all his administrative rights and access to the GEXA Energy computer network. In pleading guilty, Kim admitted that in the early hours of April 30, 2008, he used his home computer to connect to the GEXA Energy computer network and a database that contained information on approximately 150,000 GEXA Energy customers. While connected to the computer network, Kim recklessly caused damage to the computer network and the customer database by inputting various Oracle database commands. Kim also copied and saved to his home computer a database file containing personal information on the GEXA Energy customers, including names, billing addresses, social security numbers, dates of birth and drivers license numbers. According to court documents, Kim’s actions caused a $100,000 loss to GEXA Energy.

Read the press release

Sheriff's Deputy Convicted of Exceeding Authorized Computer Access

A former Harris County Sheriff deputy has been convicted of using his access to the National Crime Information Center (NCIC) to sell confidential data to an individual working as a confidential informant for the FBI.

From the Houston Office of the FBI:

The charges against Green are the result of an FBI undercover operation initiated after receiving information that Kurt Green, an employee of the HCSO assigned to the jail, sold information from the federal database known as NCIC. The NCIC database is maintained by the FBI. On Jan. 12, 2010, in a recorded telephone conversation, the informant provided deputy Green with the names of 10 persons—none of whom were under investigation—and requested criminal histories for the informant’s personal use. A week later, on Jan. 19, Green and the informant met in a parking lot in Houston. In an audio/video recording Green provided NCIC printouts for seven of the 10 persons to the informant, explained the printouts were from the NCIC database, and was paid $4900 by the informant for the information.

Green faces a maximum punishment of five years in prison, up to three years of supervised release, and a maximum fine of $250,000.

Read the press release

Employee snooping costs 5 California hospitals $675K in fines

The California Department of Public Health (CDPH) announced the assessment of fines and penalties of $675,000 to five California hospitals for failing to prevent unauthorized access to confidential patient information.

The following hospitals received penalties:

1. Community Hospital of San Bernardino, San Bernardino, San Bernardino County: The hospital was assessed a $250,000 fine after the facility failed to prevent unauthorized access of 204 patients’ medical information by one employee.
2. Community Hospital of San Bernardino, San Bernardino, San Bernardino County: The hospital was assessed a $75,000 fine after the facility failed to prevent unauthorized access of three patients’ medical information by one employee.
3. Enloe Medical Center, Chico, Butte County: The hospital was assessed a $130,000 fine after the facility failed to prevent unauthorized access of one patient’s medical information by seven employees.
4. Rideout Memorial Hospital, Marysville, Yuba County: The hospital was assessed a $100,000 fine after the facility failed to prevent unauthorized access of 33 patients’ medical information by 17 employees.
5. Ronald Reagan UCLA Medical Center, Los Angeles, Los Angeles County: The hospital was assessed a $95,000 fine after the facility failed to prevent unauthorized access of one patient’s medical information by four employees.
6. San Joaquin Community Hospital, Bakersfield, Kern County: The hospital was assessed a $25,000 fine after the facility failed to prevent unauthorized access of three patients’ medical information by two employees.

Each of the hospitals are required to submit a plan of correction within 10 working days.

Read the press release.

Former J.P. Morgan Chase Employee Admits Stealing Customer Information

Christine Fahmy, a former bank teller at J.P. Morgan Chase from Sciota, Pennsylvania pleaded guilty in U.S. District Court for her role in the theft of over $60,000 from customer's.  

According to press release issued by the FBI's Pennsylvania office:

Pfannenschmidt stated that Christine Fahmy, age 22, of Sciota, Pennsylvania, admitted to committing the offense in 2008 and early 2009. Fahmy admitted that when she was a teller at J.P. Morgan Chase and Company in Hackettstown, New Jersey, she accessed 12 customer account profiles and sold them to two individuals in Monroe County. As part of the scheme, Fahmy’s two confederates, Lavan Blair and Jonnell Gantt, used the customer profile information to have false identification documents made and used to access the accounts to obtain the money.

Blair and Gantt have already pleaded guilty to charges that include bank fraud and attempted bank fraud as aiders and abettors.  

For her role, Fahmy faces up to 10 years in prison and a $250,000 fine.

Read the full press release

Ex-UCLA Healthcare Employee receives first prison sentence for HIPAA violations

Huping Zhou, a former UCLA Healthcare employee who pleaded guilty to illegally accessing private patient data, was sentenced yesterday to four months in federal prison, becoming the first individual in the nation to receive a prison sentence for violating HIPAA privacy provisions.

From the FBI Press Release:

Zhou, who is a licensed cardiothoracic surgeon in China, was employed in 2003 at UCLA Healthcare System as a researcher with the UCLA School of Medicine. On October 29, 2003, Zhou received a notice of intent to dismiss him from UCLA Healthcare for job performance reasons unrelated to his illegal access of medical records. That night, Zhou, without any legal or medical reason, accessed and read his immediate supervisor’s medical records and those of other co-workers. For the next three weeks, Zhou's continued his illegal accessing of patient records and expanded his illegal conduct to include confidential health records belonging to various celebrities. According to court documents, Zhou accessed the UCLA patient records system 323 times during the three-week period, with most of the accesses involving well recognized celebrities.

In his plea agreement, Zhou admitted that he obtained and read private patient health and medical information on four specific occasions after he was formally terminated from the UCLA Healthcare System. Zhou acknowledged that at the time he viewed these patients’ medical information, he had no legitimate reason, medical or otherwise, for obtaining the personal information.

Read the full press release

Former Societe Generale employee charged with stealing trading source code

On Monday, the New York Field Division of the FBI announced the arrest of Samarth Agrawal, charged with theft of trade secrets for allegedly stealing proprietary computer code used in the high-frequency trading system of Societe Generale, his former employer.

Agrawal began working at Societe Generale in March 2007 as a quantitative analyst.  Shortly after being promoted to a trader position in April 2009, he obtained access to the code. 

In April 2009, AGRAWAL was promoted to the position of trader within the Company's High-Frequency Trading Group. On Friday, June 12, 2009, AGRAWAL obtained access to a unit of the Code ("Unit A") relating to the type of trading activity in which he was involved. However, AGRAWAL also was able to obtain access to a unit of the Code ("Unit B") with which he was not otherwise involved, and did not have permission to review.

After copying portions of the code into Microsoft Word documents, Agrawal printed hundreds of pages over a period from August to September 2009.  On at least one occasion, surveillance cameras captured Agrawal placing the documents into a backpack.

Likewise, on August 31, 2009, September 2, 2009, and September 11, 2009, AGRAWAL similarly printed out multiple portions of Unit B Code, also from Microsoft Word documents, which did not relate to the trading activity in which he was involved.

On November 12, 2009, his last day in the office, AGRAWAL deleted a folder on his personal network drive that contained the Code in its original format as well as the Code that had been gathered together in Microsoft Word documents. Starting on the next day, AGRAWAL took four sick days and was absent from the Company's New York offices. Subsequently, on November 17, 2009, AGRAWAL submitted a letter of resignation to his supervisor at the Company.

After AGRAWAL submitted his resignation, one of his supervisors spoke to him in an effort to convince him to stay at the Company. Among other things, the supervisor reminded AGRAWAL of his promotion to trader and told him that if he stayed his 2010 bonus would be "many multiples" of his 2009 bonus, which had been $130,000. AGRAWAL, in declining the offer, told the supervisor, among other things, that he eventually wished to return to his native country of India to set up his own high-frequency trading firm. AGRAWAL was later contacted by an FBI agent, who was acting in an undercover capacity, and advised the agent that he had been interviewing with "most of the big names" among New York financial firms.

Read the Press Release