Blue Lance InfoSec Blog

ICO hands down first monetary penalties for data breaches

In the UK, the Information Commissioner's Office (ICO) handed down its first monetary penalties in two data breach cases for violations in the Data Protection Act.  

The first penalty, of £100,000, was issued to Hertfordshire County Council for two serious incidents where council employees faxed highly sensitive personal information to the wrong recipients. The first case, involving child sexual abuse, was before the courts, and the second involved details of care proceedings.

The second monetary penalty, of £60,000, was issued to employment services company A4e for the loss of an unencrypted laptop which contained personal information relating to 24,000 people who had used community legal advice centres in Hull and Leicester.

Read the full press release

Indiana AG sues WellPoint for delay in data breach notification

From the Indiana Attorney General's Office Press Release:

The Indiana Attorney General's office today filed a lawsuit against Indianapolis-based WellPoint, Inc. claiming the health insurance provider did not notify their customers or the Attorney General's office in a timely manner following a data breach earlier this year affecting more than 32,000 Hoosiers. Indiana law requires businesses to notify both the individuals potentially affected by a data breach, as well as the Attorney General's office without unreasonable delay. This notification requirement was supported by Attorney General Greg Zoeller and included in House Enrolled Act 1121, which took effect in July 2009.

Applications for insurance policies submitted to WellPoint containing social security numbers, financial information and health records were potentially available to the general public through an unsecured Internet web-site for a period of at least 137 days between October 2009 and March 2010. According to the state's complaint, WellPoint was notified on February 22, 2010 and again on March 8, 2010 that application records containing personal information were accessible through its public website.
WellPoint did not begin notifying customers of the security breach until June 18, 2010. Following news reports of the breach, the Attorney General's office submitted an inquiry to WellPoint and received a response on July 30, 2010. The delays in notice both to customers and to the Attorney General's office are considered unreasonable. The state is seeking $300,000 in civil penalties.

While most inadvertent security breaches do not result in fraud, notifying those affected in a timely manner significantly reduces the risk of identity theft. Situations involving the theft of personal information for the purposes of identity theft most often result in some form of fraud occurring within seven to 10 days. The Attorney General's office has not received any consumer complaints relating to identity theft as a result of the WellPoint data breach.

The Attorney General's Identity Theft Unit continues to investigate the WellPoint data breach and encourages those who may have been affected to perform a credit check and a security freeze to guard against identity theft. By law, security freezes are available for free to residents of Indiana. More information and instructions are available on the Attorney General's website here: http://www.in.gov/attorneygeneral/2411.htm 

Former University of California IT employee sentenced for identity theft

According to the San Francisco Division of the FBI, Cam Giang, a former employee at the University of California San Francisco Medical Center, was sentenced yesterday to one year and one day in prison for wire fraud and the illegal use of a Social Security number in the theft of several employees' identities.

Giang, an IT staffer, obtained the birthdates and Social Security numbers of other UC employees, using the information to create accounts at a web site to complete surveys in exchange for monetary vouchers.

Giang, who was an employee of the University of California (UC) San Francisco Medical Center at the time of the offense, obtained and used the personal information (i.e., birthdates and Social Security numbers) of other UC employees to create accounts on the StayWell Health Management, Inc. (StayWell) website and complete online health surveys on behalf of these individuals without their knowledge or consent. In this way, Giang fraudulently obtained online monetary vouchers to which he was not entitled. Giang completed approximately 382 online StayWell health surveys using the personal information of other UC employees. StayWell discovered Giang’s fraudulent scheme and informed the UC and FBI.

StayWell is a company based in St. Paul, Minn., engaged in the business of providing health management solutions. Since 2009, StayWell has been conducting online health surveys for University of California employees. Survey participants are required to create an account on StayWell’s website. When a survey is completed, the participant is awarded with a $100 online voucher.Giang, who was an employee of the University of California (UC) San Francisco Medical Center at the time of the offense, obtained and used the personal information (i.e., birthdates and Social Security numbers) of other UC employees to create accounts on the StayWell Health Management, Inc. (StayWell) website and complete online health surveys on behalf of these individuals without their knowledge or consent. In this way, Giang fraudulently obtained online monetary vouchers to which he was not entitled. Giang completed approximately 382 online StayWell health surveys using the personal information of other UC employees. StayWell discovered Giang’s fraudulent scheme and informed the UC and FBI.

StayWell is a company based in St. Paul, Minn., engaged in the business of providing health management solutions. Since 2009, StayWell has been conducting online health surveys for University of California employees. Survey participants are required to create an account on StayWell’s website. When a survey is completed, the participant is awarded with a $100 online voucher.

 

Read the full FBI Press Release

Johns Hopkins employee among five indicted in ID theft scheme using stolen patient information

A Johns Hopkins employee and four other individuals were indicted this week for their roles in a credit fraud scheme using patient data stolen from the hospital, resulting in more than $600,000 in fraudulently obtained credit.

The indictment alleges that between August 2007 and March 2009, Jasmine Amber Smith allegedly provided names, social security numbers, dates of birth and addresses of patients and the parents and guardians of minor patients to the others.  The data was then used to apply for instant credit and make purchases before the credit cards were received by the victims.

The statement does not provide specific details on how many patient records were stolen, only saying "more than 50 business and individuals were affected".

The full press release from the Maryland U.S. Attorney's Office is below:

A federal grand jury has indicted the following five Maryland defendants on fraud and aggravated identity theft charges in connection with a scheme to use stolen hospital patient identity information to open fraudulent credit accounts and make purchases on “instant credit” at retail stores in Maryland: 

Michael Allen, age 34, of Baltimore, 
Jasmine Amber Smith, age 25, of Nottingham,
Tyrell Douglas McCormick, age 22, of Baltimore, 
Ayanna Devon Johnson, age 38, of Baltimore, and
Gloria Canada, age 54, of Baltimore. 

The superseding indictment was returned on September 15, 2010 and unsealed today upon the arrest of the final defendant, Gloria Canada. 

The indictment was announced by United States Attorney for the District of Maryland Rod J. Rosenstein; Special Agent in Charge Barbara Golden of the United States Secret Service – Baltimore Field Office; Postal Inspector in Charge Daniel S. Cortez of the U.S. Postal Inspection Service - Washington Division; and Chief James W. Johnson of the Baltimore County Police Department. 

According to the 39 count superseding indictment, while employed by Johns Hopkins Hospital from August 2007 to March 2009, Smith is alleged to have improperly accessed the records of the hospital’s patients to obtain the personal identity information of patients and the parents and guardians of minor patients, including names, social security numbers, dates of birth and addresses. Smith allegedly provided the stolen identity information to Johnson and Canada. From May 2008 to June 2009, Allen and McCormick allegedly used the stolen information to apply for instant credit at stores located in Maryland and make purchases on “instant credit” before the fraudulently-obtained credit cards were received by the victims. 

The indictment alleges that during the course of the scheme, the defendants fraudulently obtained over $600,000 in credit from over 50 institutional and individual victims. 

The defendants face a maximum sentence of 30 years in prison for conspiracy to commit bank fraud and two years in prison consecutive to any other sentence for aggravated identity theft. In addition, McCormick and Allen face a maximum sentence of 30 years in prison for bank fraud and 15 years in prison for access device fraud. Canada is scheduled to have her initial appearance in U.S. District Court in Baltimore today at 2:00 p.m. 

An indictment is not a finding of guilt. An individual charged by indictment is presumed innocent unless and until proven guilty at some later criminal proceedings. 

United States Attorney Rod J. Rosenstein commended the U.S. Secret Service – Baltimore Field Office, the U.S. Postal Inspection Service - Washington Division and the Baltimore County Police Department for their work in the investigation. Mr. Rosenstein thanked Assistant United States Attorneys Tamera Fine and James Warwick, who are prosecuting the case.

IT manager pleads guilty to snooping through patient records

ComputerWorld UK reports that Dale Trevor, a data quality manager at Hull Primary Care Trust in the UK has pleaded guilty to illegally accessing female patient's medical records on 431 occasions, 336 of which were the records of family members, friends and colleagues.

The incidents occurred during a nine month period beginning in October 2008.  Trevor pleaded guilty in court to seven charges of violating the Computer Misuse Act 1990 for accessing patient records without permission. He will be sentenced next month.

Read the entire article

 

Former GEXA Employee Sentenced to 1 Year for Damaging Computer Network

Steven Jinwoo Kim, a former database administrator for GEXA Energy in Houston, Texas,  was sentenced last week to 12 months in prison for hacking into his former employer's computer network and causing damage after he was terminated in 2008.  In addition, Kim was ordered to pay $100,000 in restitution to GEXA. 

According to a Justice Department press release:

According to court documents, on Feb. 5, 2008, GEXA Energy terminated Kim from his position as a senior database administrator and revoked all his administrative rights and access to the GEXA Energy computer network. In pleading guilty, Kim admitted that in the early hours of April 30, 2008, he used his home computer to connect to the GEXA Energy computer network and a database that contained information on approximately 150,000 GEXA Energy customers. While connected to the computer network, Kim recklessly caused damage to the computer network and the customer database by inputting various Oracle database commands. Kim also copied and saved to his home computer a database file containing personal information on the GEXA Energy customers, including names, billing addresses, social security numbers, dates of birth and drivers license numbers. According to court documents, Kim’s actions caused a $100,000 loss to GEXA Energy.

Read the press release

Sheriff's Deputy Convicted of Exceeding Authorized Computer Access

A former Harris County Sheriff deputy has been convicted of using his access to the National Crime Information Center (NCIC) to sell confidential data to an individual working as a confidential informant for the FBI.

From the Houston Office of the FBI:

The charges against Green are the result of an FBI undercover operation initiated after receiving information that Kurt Green, an employee of the HCSO assigned to the jail, sold information from the federal database known as NCIC. The NCIC database is maintained by the FBI. On Jan. 12, 2010, in a recorded telephone conversation, the informant provided deputy Green with the names of 10 persons—none of whom were under investigation—and requested criminal histories for the informant’s personal use. A week later, on Jan. 19, Green and the informant met in a parking lot in Houston. In an audio/video recording Green provided NCIC printouts for seven of the 10 persons to the informant, explained the printouts were from the NCIC database, and was paid $4900 by the informant for the information.

Green faces a maximum punishment of five years in prison, up to three years of supervised release, and a maximum fine of $250,000.

Read the press release

Employee snooping costs 5 California hospitals $675K in fines

The California Department of Public Health (CDPH) announced the assessment of fines and penalties of $675,000 to five California hospitals for failing to prevent unauthorized access to confidential patient information.

The following hospitals received penalties:

1. Community Hospital of San Bernardino, San Bernardino, San Bernardino County: The hospital was assessed a $250,000 fine after the facility failed to prevent unauthorized access of 204 patients’ medical information by one employee.
2. Community Hospital of San Bernardino, San Bernardino, San Bernardino County: The hospital was assessed a $75,000 fine after the facility failed to prevent unauthorized access of three patients’ medical information by one employee.
3. Enloe Medical Center, Chico, Butte County: The hospital was assessed a $130,000 fine after the facility failed to prevent unauthorized access of one patient’s medical information by seven employees.
4. Rideout Memorial Hospital, Marysville, Yuba County: The hospital was assessed a $100,000 fine after the facility failed to prevent unauthorized access of 33 patients’ medical information by 17 employees.
5. Ronald Reagan UCLA Medical Center, Los Angeles, Los Angeles County: The hospital was assessed a $95,000 fine after the facility failed to prevent unauthorized access of one patient’s medical information by four employees.
6. San Joaquin Community Hospital, Bakersfield, Kern County: The hospital was assessed a $25,000 fine after the facility failed to prevent unauthorized access of three patients’ medical information by two employees.

Each of the hospitals are required to submit a plan of correction within 10 working days.

Read the press release.

Ex-UCLA Healthcare Employee receives first prison sentence for HIPAA violations

Huping Zhou, a former UCLA Healthcare employee who pleaded guilty to illegally accessing private patient data, was sentenced yesterday to four months in federal prison, becoming the first individual in the nation to receive a prison sentence for violating HIPAA privacy provisions.

From the FBI Press Release:

Zhou, who is a licensed cardiothoracic surgeon in China, was employed in 2003 at UCLA Healthcare System as a researcher with the UCLA School of Medicine. On October 29, 2003, Zhou received a notice of intent to dismiss him from UCLA Healthcare for job performance reasons unrelated to his illegal access of medical records. That night, Zhou, without any legal or medical reason, accessed and read his immediate supervisor’s medical records and those of other co-workers. For the next three weeks, Zhou's continued his illegal accessing of patient records and expanded his illegal conduct to include confidential health records belonging to various celebrities. According to court documents, Zhou accessed the UCLA patient records system 323 times during the three-week period, with most of the accesses involving well recognized celebrities.

In his plea agreement, Zhou admitted that he obtained and read private patient health and medical information on four specific occasions after he was formally terminated from the UCLA Healthcare System. Zhou acknowledged that at the time he viewed these patients’ medical information, he had no legitimate reason, medical or otherwise, for obtaining the personal information.

Read the full press release

Judge Removes J.C. Penney Shield From Breach

Wired Magazine reports that J.C. Penney has lost its fight to remain anonymous keep details of a breach to its payment card network sealed.  

The intrusions, by TJX hacker Albert Gonzalez and his overseas accomplices, occurred beginning in October 2007. J.C. Penney admits it was “wholly unaware” of the breach until the Secret Service told the company about it in May 2008, but now says with certitude that no identity or bank-card data was stolen in the breach it failed to detect.

J.C. Penney had argued it was entitled to protections under the 2004 Victims' Rights Act.  According to spokeswoman Darcie Brossart:

“Because there was no reason to think that the hackers were successful, there was no need to alarm J.C. Penney customers,” says Brossart, “We believed we had a legitimate interest in not being linked to criminal activity that resulted in major thefts from other companies.”

So in court filings, J.C. Penney argued that it was entitled to anonymity under the 2004 Crime Victims’ Rights Act, a law intended to protect the “dignity and privacy” of victims. A federal judge on Friday ordered the company’s identity unsealed anyway, as well as that of a second breached company, clothing retailer Wet Seal.

Read the story at Wired