Data breach at Kaiser Permanente affects 13.4M people

https://restoreprivacy.com/data-breach-at-kaiser-permanente-affects-13-4-million-people/

by kryster • 2 years ago

121 59 2 years ago

waihtis• 2 years ago

Genuinely think cyber has a massive overengineering problem - I havent worked with Kaiser but am under the impression they run quite a sophisticated op, with a lot of advanced modeling done for vulns & cyber risk in general. Yet they got pounded pretty hard here.

Creeping suspicion is too much focus on doing ”smart” things with data, AI and such and not enough on actually worrying about not getting breached.

thephyber• 2 years ago

Yet they got pounded here

Huh? Your passive tense suggests this happened to KP’s teams.

From what I’m reading, those are the teams who would have had to actively take action to import the tracking code on their pages.

My money is on “we imported a thing on the website because our advertising team needed to know when advertised users converted from any of many different advertising channels”. Usually it’s easier to import a script on a common layout, rather than just a single landing page.

Ad teams overrule the website / security teams because one is a profit center and the other is a cost center.

Then as engineers / product teams turn over, the new employees don’t know the original intention of the old imported code and are wary to remove it (and if they do, the process is long and drawn out).

GraffitiTim• 2 years ago

This is why we need Freshpaint (YC S19) for analytics and other services for healthcare companies. A primary focus on regulatory compliance, privacy, security.

agnokapathetic• 2 years ago

this is just from Share Embeds.

they now disclose these are used at login.

roywiggins• 2 years ago

[deleted]

throwaway815232• 2 years ago

Kaiser has had another privacy bug for many years, which is they give out phone numbers of individual doctors in the Kaiser system (of course it goes to voice mail). That sounds great but it's invasive: call a Kaiser oncologist, and your phone carrier sells the number you dialed to data brokers who profile you as a likely cancer patient. Call an AIDS specialist, gender transition therapist, abortion provider, etc.: same idea. Kaiser should instead have a single incoming phone number where you enter an extension of the doctor you are trying to reach. So everyone dials the same outgoing number. I griped to them about this around 10 years ago and they basically said hrmmph.

lotsofpulp2• 2 years ago

That’s a crazy solution to a legislative problem.

Also, source that call records are sold? I thought even the government (non federal security apparatus) needed a warrant to get access to that information?

01HNNWZ0MV43FF• 2 years ago

sounds like I need to start dialing some random businesses to fuck up my ads

kevingadd3• 2 years ago

hi-v-rocknroll5• 2 years ago

KP's phone carrier, the caller's carrier, or an intermediate phone network maybe selling metadata to data brokers. The current practice in America is that once data* about a person has been disclosed to a business by any means, the person loses all rights to it and it becomes the property of that business to do with and resell it however they want.

* There are limited carve-outs for medical records and such.

hi-v-rocknroll5• 2 years ago

Correlation between web, social media, brick and mortar retailers, banking, credit, and cell phone carriers has reached a level of ridiculous perversion. America needs a modern German-like privacy framework. Data brokers should be illegal and individuals should have final say over how uniquely identifying information about them is exchanged.

smolder2• 2 years ago

Yes. The data hoarding creates endless opportunity for abuse and only marginally improves the utility of things like advertising.

The case of insurance providers having a microscope into everyone's lives is simply dystopian. As with political campaigns, potential employers, law enforcement, and so on.

bee_rider• 2 years ago

Your cellphone could also report your location when you walk to these medical providers, right?

KeepFlying• 2 years ago

Yeah but you could theoretically turn off Location services and then the cell network may not be able to tell if you're at the doctors or at the McDonalds next door so it still offers some (limited) privacy.

nix0n• 2 years ago

So if I call some Sports Medicine doctors, then advertisers will think I'm a cool, active person.

kQq9oHeAz6wLLS2• 2 years ago

Then they see the rest of your browsing history

neilv• 2 years ago

The solution is FBI raids on the headquarters of the carriers, data brokers, and companies that buy/use/resell/share/etc. the data.

Plus the individuals found responsible thrown into prison, and personally bankrupted.

Plus a punitive hit to the stockholders, including clawbacks of past realized gains, to align incentives better with productive society, and not let a corporation be a shield for routine criminal conspiracy.

Working backwards from the desired state, what legislation do we need?

drstewart• 2 years ago

Working backwards from the desired state, what legislation do we need?

Not much for the jackboot police state you look to create

SAI_Peregrinus• 2 years ago

This is not unique to Kaiser. Anyone not on an HMO plan has separate providers for separate specialties.

Dalewyn• 2 years ago

I griped to them about this around 10 years ago and they basically said hrmmph.

To be fair to Kaiser, that really isn't their problem.

You should be griping to the telco (yes, I know it's a waste of time) and your politicians (marginally more useful than the former), because that is their problem.

ComputerGuru2• 2 years ago

Do you think they still have my records from 30 years ago? Not really kidding, actually curious if that data was ever properly migrated from system to system.

kevingadd3• 2 years ago

My historical records were never digitized by KP, they're on paper in a storage bin somewhere.

ComputerGuru2• 2 years ago

Curious how you know and how far back you are referring to? Did you stick with them throughout — if so, I would imagine they would have had extra incentive to import just yours, at the very least (and others like you, obviously).

Glad to know they’re a forest fire away from being lost. If you haven’t used your medical records or had them forwarded to another provider in over three decades, I think it’s ok if they go bye-bye.

el_benhameen• 2 years ago

My visit information wasn’t digitized as far as I know, but my vaccine records and possibly other records from the 1980s are in my kp account.

phone8675309• 2 years ago

It should be illegal for any private company to hold that much personal information

hi-v-rocknroll5• 2 years ago

Every American voter could call and/or write physical letters to their representatives to express their displeasure about the lack of purchase, web, and financial data and telco metadata privacy rights.

https://www.commoncause.org/find-your-representative/

hi-v-rocknroll5• 2 years ago

Ouch. Perhaps they still have records of doctor incompetence when they nearly killed me at birth at their demolished Santa Clara location. KP is a good deal when or if you are healthy but not so great if you aren't.

nikolay2• 2 years ago

It's always the SOC 2 and HIPAA-compliant companies that get breached, but, of course, mostly compliant companies are lucrative targets.

bearjaws• 2 years ago

It's because HIPAA is a joke and SOC2 is basically the bare minimum at this point.

Too many little ways to manipulate your artifacts to pass SOC2 and no accountability when it goes wrong.

gopher_space2• 2 years ago

Sat in a hospital room with a relative for two weeks and saw staff repeatedly violate compliance directives in order to provide timely care. They clearly weren't being provided the resources needed to do so.

Also, for the entrepreneurs out there, they seem to really need some kind of tubing that won't collect air bubbles. Something with a hydrophobic interior? I don't know. There's a related area regarding flushing IV systems that could use attention as well.

nikolay2• 2 years ago

Just the fact that SOC 2 auditors are CPAs speaks enough. I remember working at a large e-commerce company, and the InfoSec offers told me that we didn't care about PCI compliance as we could only get fined, but we could get into orange jumpsuits for mishandling PII. And that was over a decade ago, talking only about names, addresses, emails, and phone numbers. With HIPAA leaks, it's tons more than just that, and I'm not sure what the consequences are, but back then, we didn't want to sell prescription eyewear only due to the HIPAA burden.

xyst• 2 years ago

Anyone that has worked in a sector where technology is often a second tier citizen or after thought knows these types of breaches are inevitable.

Hospitals. Banks. Airline industry.

The shit I have seen in just these industries made me think twice about having my private information held here.

Of course, the “IT” is often outsourced or “in sourced” (often juniors fresh out of college). Thus simple shit such as network segmenting production and development environments; and limiting access to production databases/assets is nonexistent.

I remember working in an airline where the backend systems were still running on outdated mainframe systems. Nobody had a clue how the existing mainframe systems worked. No documentation. Only poorly maintained support docs on how to keep it running. I ended up silent quitting after 3 months because management kept shutting down all of my initiatives to improve ops and quality. This company later had a massive meltdown. I wasn’t surprised and just glad I wasn’t subpoenaed.

cnj• 2 years ago

The data exposure was discovered following an internal investigation conducted voluntarily by Kaiser Permanente. The company discovered that online trackers used on its websites and mobile applications were transmitting certain types of personal data when users interacted with its services.

I have respect for the individuals that started this investigation, and the ones that made sure this is publicly disclosed. This could have easily been swept under the carpet.

Actually, that they uncovered this on their own and publicly disclosed it sounds like they have an above-average privacy culture in place.

I know the odds that the person(s) who kicked off this investigation are reading this comment are very low, but if so: Kudos, well done!

shreezus• 2 years ago

None of this surprises me one bit. I have worked in the health space for several years, and I have personally seen the inner workings of several insurers and the manmade horrors within.

It blows my mind that these multibillion dollar institutions are so poorly managed on the technology/IT front. I think most people will have their health data likely leaked at some point.

peteradio• 2 years ago

I think most people will have their health data likely leaked at some point.

Just don't go to the hospital or in any other way involve your system with the InsuroServo complex. Problem solved!

mleonhard• 2 years ago

I reported this to Kaiser on 2021-11-22, in support case number 53710772. Below is the content of the ticket I filed. I didn't follow-through on disclosure. Now I wish I had, since they could have fixed this problem faster instead of taking 2.5 years.

I am still a satisfied Kaiser customer.

----

Hi KP.org Team,

Just now, I logged into KP.org. Something was loading slowly, so I viewed the network requests the website was making. I was surprised to see requests to Google, Adobe, Bing, Qualtrics, BTTag.com, and Unpkg.com. A request to Google includes info intended to de-anonymize my computer: time, IP addr, device type, display size, browser window size, timezone, and others. These requests occur even while reading messages with my doctor!

The page loads JavaScript from Adobe, Bing, Google, and Qualtrics. People who control those companies' servers can read my confidential messages. Adobe has a track record of incompetence in IT security.

Please review your decision to make KP.org load external code and trackers. If you do not respond by 2022-01-14 (90 days), I will disclose this information to privacy-oriented media organizations and HHS.gov. I saved screenshots for this purpose.

Sincerely, Michael

ewhanley• 2 years ago

That's pretty gross. Why would a hospital/healthcare system even need all that tracking? They don't make enough from their primary business that they also need to sell patient data for advertising? I would guess some dev just slapped on a bunch of boilerplate that so many other projects use and called it a day.

mistrial9• 2 years ago

someone wanted ad revenue and it leads to this..

source: personal exposure to "ad markets in hospitals" here in the SF Bay Area

adolph• 2 years ago

URL (gets redirected): https://healthy.kaiserpermanente.org/consumer-sign-on

If one had a list of patient portals[0], what would be the simplest way to check each for 3rd party trackers? Use Selenium?

  0. curl -s "https://www.mychart.org/LoginSignup" | grep 'JSON.par' | sed -e 's;^.*JSON.parse('\'';;' -e 's;'\'').*$;;' | jq '.Customers[].LoginUrl' | tr -d '"'

zdragnar• 2 years ago

Google will sign a BAA for pretty much anything other than analytics. There's a decent market for HIPAA compliant analytics services, especially for analyzing marketing funnels, conversions, etc.

I haven't a clue if either of those companies do, though it wouldn't surprise me if they did.

amluto• 2 years ago

IMO part of the solution should be obvious: if a company loads JavaScript from a third party, and they have not vetted that third party for HIPAA compliance, then the company including the JavaScript should be deemed to have violated patient probably even if no patient data was transmitted.

jmholla• 2 years ago

Is this a HIPPA violation?

wahoo324• 2 years ago

I wonder if they had CSP and intentionally bypassed or they didn't have CSP at all.

nextworddev• 2 years ago

So much for hipaa

slater• 2 years ago

There's something seriously wrong with the KP web department. Their current site is a slow, buggy mess that regularly locks up for no discernible reason on my system (M2 Air, latest Firefox and macOS). Just the other day I had to nuke all the cookies to log in again, because the site got itself in a login loop ("the website isn't redirecting properly").

_akhe• 2 years ago

Literally 1 month ago: Kaiser lays off IT workers for a second time in 4 months

Maybe they kept the wrong ones haha

Data breach at Kaiser Permanente affects 13.4M people

Related Stories