Blue Lance InfoSec Blog

HSBC employee data theft said to affect 15,000 account holders

HSBC says in a statement that information stolen by a former IT employee affects 15,000 existing Swiss client accounts.   According to the statement:

It is now clear that the theft, which was perpetrated by a former IT employee about three years ago, involves approximately 15,000 existing clients who had accounts with the bank in Switzerland before October 2006. The stolen client information is limited to accounts in Switzerland, excluding ex-HSBC Guyerzeller accounts. There is no data compromised for any branches of the bank outside Switzerland, which operate on separate systems and security, or other entities within the HSBC Group,

Alexandre Zeller, CEO of HSBC Private Bank SA said "We deeply regret this situation and unreservedly apologise to our clients for this threat to their privacy. We are determined to protect our clients’ interests and are taking every necessary measure to do so, actively contacting all our clients with Swiss-based accounts."

The bank said that it has spent more than $93 million in system upgrades and security improvements.

The bank is cooperating with the Swiss authorities and continues its own investigations, and a criminal investigation led by the Swiss Federal Prosecutor is underway. The Swiss authorities confirmed to us that they will not support the use of the stolen data to answer requests from foreign authorities. The French authorities have informed the Swiss authorities that the data they hold will not be used inappropriately.

West Memphis Police Officer Terminated, Under Investigation for Accessing Employee Personal Info

WMC-TV in West Memphis reports that an FBI investigation is underway of a West Memphis police officer suspected of accessing the personal information of other officers.  The suspect, an unnamed detective in the police department, has been terminated.

From the report:

According to Paudert, files containing the names and social security numbers of police department employees were stored on the computer network, making the employees vulnerable to identity theft.

"It's very disturbing to us that someone, first of all, would do that, and secondly, what it would do to the employees that work here," Paudert said.

To date, it is unclear how the detective was able to access the files via a hack or a lapse in network security, and whether or not any other files were affected.  West Memphis Police Department employees have been notified and asked to monitor their credit reports for irregularities.

Connecticut AG Sues Healthcare Provider in First Case of State Enforcement Under HITECH

Connecticut Attorney General Richard Blumenthal sued Health Net of Connecticut, Inc. for HIPAA violations stemming from the loss of a portable hard drive containing the health and financial information of approximately 446,000 Connecticut enrollees in May of 2009, and the failure to notify authorities and consumers for at least 6 months.

Additionally, the AG seeks a court order preventing Health Net from continued HIPAA violations by requiring that protected health information stored on portable drives be encrypted.

A subsequent investigation found that the data, which included health records, social security numbers and bank account numbers in over 27 million scanned pages, was not encrypted or otherwise protected from unauthorized access and was viewable on commonly available software.

The case is the first action taken by a state under the HITECH Act, which enables states to enforce HIPAA violations.

Source:  Connecticut Attorney General's Office

Ex-UCLA Healthcare Employee Pleads Guilty to HIPAA Violations

Apparently, the management at the UCLA Healthcare System could not foresee a security risk with giving notice to employees of their intent to terminate them. 

From the Los Angeles office of the FBI:

 LOS ANGELES—A former UCLA Healthcare System employee pleaded guilty today to four counts of illegally reading private and confidential medical records, mostly from celebrities and other high-profile patients.

Huping Zhou, 48, of Los Angeles, pleaded guilty prior to a trial scheduled to begin next week to four misdemeanor counts of violating the federal privacy provisions of the Health Insurance Portability and Accountability Act (HIPAA). Appearing before United States Magistrate Judge Andrew J. Wistrich, Zhou specifically admitted to knowingly obtaining individually identifiable health information without a valid reason, medical or otherwise. Zhou becomes one of the first people in the nation to be convicted of violating the privacy provisions of HIPAA.

Zhou, who is a licensed cardiothoracic surgeon in China, was employed in 2003 at UCLA Healthcare System as a researcher with the UCLA School of Medicine. On October 29, 2003, Zhou received a notice of intent to dismiss him from UCLA Healthcare for job performance reasons unrelated to his illegal access of medical records. That night, Zhou, without any legal or medical reason, accessed and read his immediate supervisor’s medical records and those of other co-workers. For the next three weeks, Zhou’s continued his illegal accessing of patient records and expanded his illegal conduct to include confidential health records belonging to various celebrities. According to court documents, Zhou accessed the UCLA patient records system 323 times during the three-week period, with most of the accesses involving well recognized celebrities.

In a plea agreement filed today, Zhou admitted that he obtained and read private patient health and medical information on four specific occasions after he was formally terminated from the UCLA Healthcare System. Zhou acknowledged that at the time he viewed these patients’ medical information, he had no legitimate reason, medical or otherwise, for obtaining the personal information.

“There is a persistent problem with improper and illegal viewing of medical records by individuals who abuse the access they have as a result of their employment,” Acting United States Attorney George S. Cardona said. “HIPAA’s criminal privacy provisions protect not only celebrities, but all of us from curious neighbors, disgruntled co-workers, and other snoopers.”

Zhou is scheduled to appear in federal court on March 22 to be sentenced by Judge Wistrich. At sentencing, Zhou faces a maximum statutory penalty of four years in federal prison.

“The FBI is committed to investigating violations of HIPAA laws, the compromise of which can cause major financial or emotional distress,” said Steven M. Martinez, Assistant Director in Charge of the FBI in Los Angeles. “These laws exist to protect the privacy that must be afforded to all patients, despite how intriguing that information might be to some with unworthy intentions.”

The UCLA Healthcare System, the UCLA School of Medicine and the UCLA Medical Group fully cooperated in the investigation, which was conducted by the Federal Bureau of Investigation.

Former Executive at Japanese Matchmaking Firm Accused of Stealing Client Data

A former board member of Web, a Japanese matchmaking service, allegedly stole the personal information of about 16,000 members and attempted to sell the data to competing matchmaking firms.  

The executive stole the information in August 2006, just prior to his resignation from the firm.  After a failed attempt to sell the data back to Web, he began offering the data to Web's competitors in a series of emails.

Although the police have been contacted, an arrest has not been made.  However, Web has said it plans to lodge a criminal complaint for the theft.

Source:  AsiaOne News

Contract Worker at the Center of TSA Employee Identity Thefts

As if the Transportation Security Administration (TSA) needed more headlines containing the phrase "security breach", details are coming to light in the investigation of the theft of employee information at Boston's Logan International Airport. 

In December, Tina White and Michael Washington were arrested and charged with identity theft and larceny after a search revealed the pair in possession of a list with TSA employee names.  The information was provided by Washington's niece, a TSA contract employee working in human resources.

The employee identities were sold for $40 each and used to obtain wireless and other utility services.

Full Story

16 Employees Fired for Alleged HIPAA Violations

An article by ABC13 in Houston reports that the Harris County Hospital District terminated 16 employees for HIPAA violations after they accessed the medical records of a fellow employee, Dr. Stephanie Wuest, who had been shot during an attempted robbery.

Read the entire story

T-Mobile Employee Sells Account Details of Thousands of Subscribers

The Information Commissioner's Office (ICO) announced details of an incident involving a mobile telephone company where one or more employees allegedly sold customer details including expiration dates of their contracts to competitors.  Although the ICO did not mention the company by name, the Guardian identified the provider as T-Mobile:

An employee of the phone operator T-Mobile sold the personal records of customers, which included details of when their mobile phone contracts expired. The millions of items of information were then sold on for "substantial sums", the Information Commissioner's Office (ICO) said. Rival networks and mobile phone retailers were then able to use it to try to lure away T-Mobile customers by "cold calling" them.

In the course of it's investigation, the ICO "obtained several search warrants attended a number of premises, and is now preparing a prosecution file".

Sources:

The Information Commissioner's Office

The Guardian

Personal Data of 16,000 Exposed on Stolen USB Drive

InternetNews.com reports that a USB drive left overnight in an unlocked car was stolen, exposing the personal data of 16,000 Roane State Community College students and employees.

The college has sent letters to anyone who may be affected by this theft and has notified major the major credit-monitor and reporting agencies.

"While we have no reason to believe that the data was stolen for identity-theft purposes, we urge those affected to closely monitor their financial accounts for irregularities," Danny Gibbs, Roane State's vice president of business and finance said in a statement. "Roane State deeply regrets the exposure of this data.

Read the entire article here.

One Step Closer to Federal Data Breach Notification Requirements

Yesterday, the U.S. Senate Judiciary Commitee passed two bills which set guidelines for data breach notifications at the federal level.

S.139, known as the Data Breach Notification Act, establishes guidelines for data breach notifications for government agencies and business entities as well as enforcement actions.

S.1490 is known as the Personal Data Privacy and Security Act of 2009 and establishes standards for developing and implementing safeguards to protect the security of sensitive personal information.  It also imposes civil penalties for violations of such standards.

The next stop for both bills is a full Senate vote.