Nearly 200K Medical Records of US Military Veterans Leaked

https://securethoughts.com/us-military-veterans-medical-data-leakage/

by avibu • 5 years ago

145 76 5 years ago

avibu• 5 years ago

Nearly 200K of highly sensitive medical information belonging to US military veterans was exposed online and showed evidence of a ransomware attack

WrtCdEvrydy3• 5 years ago

And not a single fuck was given...

I think I should run for Congress with a single policy... you screw up data storage, your company is "executed" (nationalized)

disabled6• 5 years ago

It would happen pretty quickly, based on how these cyberattacks are going. Also, Russia would like it.

The tip of the iceberg has not even been identified with the recent US SolarWinds cyber attack.

Then again, nationalizing care would bring up the standard. Not like I trust the US government, however, the third leading cause of death is believed to be preventable medical errors. The level of care is particularly poor and inconsistent outside of the east and west coasts, with a few notable areas as exceptions geographically. As a chronically ill individual with 2 rare immune mediated neurological diseases affecting my peripheral nervous system, it's not like I trust the system. I basically fell through the cracks, over and over again.

refurb• 5 years ago

So if a companies finances get leaked you’d nationalize them?

ArkanExplorer2• 5 years ago

While you're there, can you also ban the exchange of crypto for fiat in the USA? This will have a huge positive effect on carbon emissions, chip shortages, and actually reducing ransomware.

lbriner3• 5 years ago

Why? because nationalized organisations never get hacked?

craftinator• 5 years ago

Ha, mine got exposed a couple years ago (local office let a contractor load thousands of them on a thumb drive and leave, ended up online). They signed me up for "ID.me" for 3 years to protect me from identity theft.

ID.me is basically a glorified coupon/advertisement delivery platform targeting veterans, which sells itself as identity protection with perks. Then, ID.me got hacked, and all of my info I'd given them to prove my identity got shared with the goat. I got this sweet apology letter though.

So moral? They don't give a fuck. No one is held responsible. The general feeling is that "this kinda stuff just happens" and it's not really their fault. I'd love to see large numbers of people go to jail over this...

disabled6• 5 years ago

I cannot wait for my US based medical record to be leaked at some point. There will probably be somebody who creates a torrent of these records to be downloaded at some point in time.

I have little faith in the US government or the various US healthcare providers keeping their databases properly secured from attack. I am saying this as somebody with 2 rare immune-mediated neurological diseases affecting my peripheral nervous system, plus type 1 diabetes (autoimmune and insulin-dependent).

I have far more faith in the European Union, even though it has issues. I live in Europe, and it is a breath of fresh air.

callamdelaney2• 5 years ago

The NHS is particularly incompetent in this respect.

edit:

Here are some sources to support my point:

NHS patient data breached at least 1,395 times in two years (https://www.bbc.co.uk/news/technology-44682369)

NHS data breach affects 150,000 patients in England (https://www.bbc.co.uk/news/technology-44682369)

Over 18K COVID-19 Patients’ Data Mistakenly Exposed by NHS Trust (https://www.tripwire.com/state-of-security/security-data-pro...)

disabled6• 5 years ago

Yeah, true. But, the EU is a regulatory stronghold. The EU does take action on this sort of stuff, and will create standards if necessary. We still have a long ways to go, but it is a "going to the moon" type of an issue rather than a "solving global warming" type issue.

In the US, our Congress is extremely technologically incompetent, with a few isolated exceptions with respect to individuals.

DanBC• 5 years ago

Two of your links are to the same story.

https://theferret.scot/nhs-patient-data-breached-1395-times-...

I_am_tiberius• 5 years ago

I live in Europe and I would like to decide myself whether my healthcare data is stored somewhere in the in the long term or not.

orwin• 5 years ago

It's on your hospital servers. Or in your hospital closets, depending on where you live. In my country you're supposed to have a small medical book with all relevant informations. Now, it doesn't work, so: your public healthcare is tied to an hospital, and your private healthcare... Who knows. What I can tell you is that a lot of effort is going towards data sharing between hospitals (in data vaults) in my country and that medical data is probably my most protected data.

antman• 5 years ago

Disclaimer: Related to projects regarding medical bills and insurance prediction.

I can assure you the data is safe due to being a total mess. Antiquated systems, archived data in different formats, cross institutions joined data based on intuition. Might get something but everything is so disjoint you would need a magician not a hacker for something sizeable.

EU countries at least some western ones I have worked with are OK but their implementation mirrors each country's bureaucracy.

disabled6• 5 years ago

True. But, honestly, health insurance claims would be an excellent target.

If released via a torrent at the right period of time, it could be powerful, such as right before health reform, if it is the right legal bill to prey on. The same would apply if there is some huge financial crisis in the US.

In the US, I was receiving a blood product that cost my employer (not insurance--the employer was self-insured) USD $275,000+/year.

I require other expensive drugs too.

qwertox• 5 years ago

I can assure you the data is safe due to being a total mess.

Maybe this increases the probability of getting put into the bucket of false positives.

profile532• 5 years ago

I’d argue against that because of how much data is in a single database. I’ve been at 3 different hospital systems in various capacities and all three had a shared database/program (Epic, Cerner, Meditech) for 2-3 states worth of patients. I had read/write access to patient medical records for all hospitals and clinics across 2 different states at one site. More so, the systems may be antiquated (30 year old MRI machine) but the hospital has paid the lowest bidder a lot of money to upload the data to a shared imaging website that only works in IE10. It meets HIPAA requirements, but I guarantee security was barely on the priority list. Everything is interconnected and unsecured.

raverbashing• 5 years ago

In technological matters, the governments in the EU are very behind

The Irish health service is currently under a ransomware attack.

Also remember when the Berlin courts were 'hacked' because they were still using Windows 95? (It's been a couple of years already)

And in the end, securing systems will help, but this won't stop until the people doing this are held responsible.

lbriner3• 5 years ago

The EU might have good intention but with the current system (technical and bureaucratic), you still cannot know that data has not been hacked and misused - it only takes one screwup and with the people I have worked with over the years, there is no reason to think that a screw up is ever that far away.

I think the only saving grace at the moment is that the chance of any individual being taken advantage of is low simply because there are so many people.

I would be much more worried if I was important and more likely to be targetted.

specialist2• 5 years ago

It's inevitable.

Source: Worked in healthcare IT implementing electronic medical record exchanges.

profile532• 5 years ago

I work in a hospital and just rebooted a network connected computer running windows XP. Not isolated from the main hospital network as far as I can tell. Your lack of faith is warranted.

danmur• 5 years ago

Scummy contractor, incompetent as well as lying about it

uniqueid2• 5 years ago

There are clearly worldwide problems with the hardware, software and protocols we use today. For months now there has been a massive new catastrophe every week. We have an internet that has few mechanisms to identify bad actors and make them accountable, and hardware and software that allow careless or incompetent admins and users to leak sensitive data (perhaps an understatement, as it takes a gifted, motivated, experienced admin to stand any chance today). This industry should, but probably won't, rethink everything. Otherwise the world is in for an unimaginably bad problems as people begin to abuse the data from tens of thousands of these leaks and hacks.

nix233• 5 years ago

It's not the Hardware not the Software and NOT the Protocols, it's the Human Factor, neglected systems, and often not even a try to use "best practices".

The only way to change that is massive fines, there is no chance that a technical system can control human behavior...ATM at least, like Plane-crashes technically it's always human error.

EDIT: Corrected Plan-crashes and told Mozilla to pay a 1 Million $ fine, because the auto-correct software did not work correctly ;)

ajdegol• 5 years ago

like Plan-crashes technically it's always human error

That's a $1M fine for misspelling "Plane". ;)

Also, it's definitely the software. There's a wonderful talk by Alan Kay regarding this, but I cannot find it. It might be referenced in Jon Blow's talk: - https://www.youtube.com/watch?v=ZSRHeXYDLko

uniqueid2• 5 years ago

I agree it could help to look at legal changes, such as 'massive fines'. That's closer to the 'rethink' we need.

In regard to human error, I think we are approaching the point where it is useless to focus on individual hackers, companies, admins or users.

To pick the most famous example of something we should rethink (not that it would address the hack in this news story): users on the web mainly read text, yet our browsers enable Javascript by default.

To me it seems the ways we store and share data in IT are starting to fail. It's at the point where every interaction a regular person engages in (with banking, shopping, healthcare, social life, work, education, etc) has a real chance of becoming public. That's not sustainable.

lbriner3• 5 years ago

The hardware, software and protocols are written by humans so they are definitely part of the problem!

Massive fines sounds like an easy win but it doesn't work in practice in the sae way that massive fines don't stop corporate polluters, don't stop medical negligence and don't stop crime in general. Are they useful? Only where it is clear where the responsbility lays.

Take the VW emmissions scandal as an equivalent issue imho. Who gets a fine? VW? That isn't really fair if the decision was taken by an employee. The employees? They can't afford to pay a fine. All this would do is make it harder for disruptive startups who can't afford the potential fines.

Sadly, I think like most things, it will take a whole raft of things including educating people, punishing people and companies, regulating who is allowed to produce and sign-off systems, have mandatory MOTs for software so they can't be left to languish and even potentially creating seprate WWWs for those who follow the rules and the general public can trust vs those who believe in complete liberty to do whatever they want and who cannot be exposed to the general public who won't understand the risks they are exposing themselves to.

danielheath• 5 years ago

It's reasonably well established that humans systematically underestimate low-probability, high-cost outcomes. Getting hacked is already pretty high-cost for most organizations.

Given that, I think there's more to be gained by looking at the "low probability" side of things.

Some historic examples of attacking the "low probability" side include building codes and speeding fines - both have pretty strong evidence for their efficacy.

A comparable initiative for software might fine those found keeping data after they do not need it (like GDPR), or mandate that sensitive data is stored behind appropriate access controls (like PCI does).

belatw• 5 years ago

Massive fines to whom?

In this case the taxpayers will bear the brunt of those fines. In other cases, the consumers.

sul_tasto2• 5 years ago

I think we need the equivalent of building codes and inspections.

2OEH8eoCRo0• 5 years ago

It's both but the humans have an excuse- they're human. We should know by now that given enough time humans fuck everything up. We should build things with this in mind.

If we keep assuming humans are suddenly going to stop making mistakes then these things will never go away.

I almost never blame the user or human, I blame the software.

bsder• 5 years ago

There are clearly worldwide problems with the hardware, software and protocols we use today.

You can have the best protocol in the world, but it's useless if nobody uses it.

These breaches aren't some amazing hacker. These breaches are outsourced, lowest bidder doing dumbshit stuff.

qwerty4561273• 5 years ago

The problem is we have everything recorded digitally, managed with software and hardware of needlessly inflated complexity, mostly running on the least reliable OS ever (Windows), always connected to the Internet.

I would never allow any of my medical data to be digitized, but I have never been asked. I would never use an Internet-connected Windows PC to manage any critical machinery. I don't want my printer to order inks for itself. I would rather avoid modern libraries which add dozens megabytes of complexity to make trivial things look fancy.

Oftentimes the optimal solution is not to add something (like another layer of encryption and automation) but to remove and make things simpler.

est31• 5 years ago

Even if it's not connected to the internet but runs on a completely and perfectly airgapped network, when your sensitive data fit on a single USB stick, it's extremely hard to protect them, simply because of logistics. In the pre-digital age you could maybe steal individual records, but stealing large mountains of papers would have alerted the security guards. Nowadays you can carry truckloads of data in your pocket.

AnIdiotOnTheNet• 5 years ago

I object to your characterization of Windows as "the least reliable OS ever". What Windows is, is popular, and that's for a lot of reasons but one of them is that it is actually quite good at being a desktop PC OS, unlike some other operating systems I could mention. The same things that make it a good desktop (like say, not having to recompile software every two years to get it to run on the latest version) also make it slightly easier to trick users into running things they shouldn't, and of course allows less advanced users to have more control in the first place, which combined with its popularity lead to a large number of infections.

Otherwise I agree with what you're saying, software (and hardware to a certain extent) is far more bloated and complicated than it needs to be.

ghaff• 5 years ago

The problem is that the alternative to medical records being digitized is lots of paper files and faxes and the general difficulty of switching records to a new doctor. So in fact there is a big push to digitize things in standard formats which has its own set of problems but the paper-based methods don't really work.

chrischapman• 5 years ago

Oftentimes the optimal solution is not to add something (like another layer of encryption and automation) but to remove and make things simpler.

I like that. It sounds so much like the de Saint Exupery quote: "perfection is attained, not when there is nothing left to add, but when there is nothing left to take away".

We need a lot more of that.

belorn• 5 years ago

few mechanisms to identify bad actors and make them accountable

We have plenty of mechanism to track and identify actors, but the legal framework to make that work is not there. The major obstacle to get those in place is the billions evaluated industries built on the exist frameworks, and the enormous political power they have on the political system. Getting laws in place so we can have a safe internet that does not get exploited for commercial gain will be a bigger challenge then people had fighting tobacco companies on health issues.

hardware and software that allow careless or incompetent admins and users to leak sensitive data

We have hardware and software that take responsibility for sensitive data, but that responsibility cost money. There does not exist any feedback loop or incentives for contract negotiators to manage data leaks to the point where leaks will not occur. There is however direct incentives to reduce costs, so hardware and software that can keep the initial costs down by putting the responsibility onto the user get a competitive advantage during contract negotiation. The industry can not fix this unless someone find a new profit center in preventing leaks. Laws and regulations could fix it, but then established commercial actors who currently has a competitive advantage by providing cheap hardware and software will fight those laws and regulators.

As such, the challenge seems to be to either fight nail and tooth against money and power in order to get laws that solves the issue (like gdpr if it actually got enforced), or someone has to invent a profit center that happen to align with eliminating leaks and hacks.

Maybe after nations has tried the concept of a citizen score, had a few internal wars, genocides, and media storms to really demonstrate the harm of the current system we might end up with enough international pressure worldwide to both have all the tracking and recording needing to correctly identify bad actors, but also the laws and regulations that prevents harm to innocents and enabling the commercial exploration of fellow human beings.

raxxorrax3• 5 years ago

I don't think you can blame the net infrastructure. The problem is with utility IT. Probably also not the IT directly, as it is probably understaffed or underfunded or both.

There is only one way to keep utilities safe on a public network and that would be extreme simplicity and a fitting network configuration.

We have an internet that has few mechanisms to identify bad actors and make them accountable

That isn't the problem here and the advantage from this far outweighs the risks.

abuse the data from tens of thousands of these leaks and hacks.

The data people share voluntarily also far outweighs stolen info.

The reality is that nobody wants to spend anything on IT and that will bite you in the ass at a later time. It is not a technical problem alone.

sitkack• 5 years ago

Not that I encourage violating peoples privacy, but this might be a great option for citizen scientists to do some data analysis that wouldn't otherwise be done.

raxxorrax3• 5 years ago

No. You can still commit privacy violations even if it is easy.

867-5309• 5 years ago

.. so what happened with the ransomware finding? do we presume the ransom was paid, honoured and then remained publicly available? or that it was an automated empty threat which went unnoticed by both parties? kind of glossed over in my view the most important part of the story

WarOnPrivacy• 5 years ago

I wish someone would leak my father's military psychiatric records. We could use some answers.

brettermeier• 5 years ago

Well, what about sanctions for US-american hackers (as NSA and stuff)?

Deep in americas arse as always...

mLuby• 5 years ago

Adversarial red team bug bounty hunters to the rescue?

What if there were a law that any responsibly disclosed security vulnerability must be rewarded with a bounty based on the damage the vulnerability would have caused? Combined with immunity from hacking charges for companies that have a license to operate this way (and strict monitoring on those companies).

It's self-funding, self-enforcing, and as a bonus, trains more "cyberwarfighters" nationally. Maybe the market can solve this problem.

specialist2• 5 years ago

All data at rest must be encrypted. At the field and record level.

Just like properly hashed password files.

Lacking that, it's all kabuki.

olliej• 5 years ago

Is this 200k HIPPA violations?

Nearly 200K Medical Records of US Military Veterans Leaked

Related Stories