Dissent’s Articles at DataBreaches.net

Dissent

Lawsuit claims Kansas official exposed private voter data

Posted by Dissent at 1:40 pm Exposure, Government Sector, U.S.

Jun 192018

Roxana Hegeman reports:

A civil rights group filed a federal lawsuit Tuesday against Kansas Secretary of State Kris Kobach challenging a multi-state voter registration database it claims exposed sensitive information including partial Social Security numbers from nearly a thousand state voters.

The complaint by the American Civil Liberties Union of Kansas alleges “reckless maintenance” of the Interstate Voter Registration Crosscheck Program, which compares voter registration lists among participating states to look for duplicates.

Five massive data breaches affecting South Africans

Posted by Dissent at 8:47 am Business Sector, Commentaries and Analyses, Non-U.S.

Jun 192018

How many of these didn’t you know about already? Tehillah Niselow reports on five big breaches affecting South Africans:

Liberty (ZA) email hack
ViewFines Driver License Details
Facebook Scandal
Master Deed’s data breach “biggest” digital security threat in SA
Ster-Kinekor’s database compromised

Don’t recognize some of them? Read the article on FIN24 to start to get caught up.

Information Update 19 June 2018 on PageUp Incident

Posted by Dissent at 8:33 am Business Sector, Hack, Non-U.S.

Jun 192018

The Australian Cyber Security Centre (ACSC), the Office of the Australian Information Commissioner (OAIC) and IDCARE have released a joint statement:

18 June 2018

On Friday 1 June 2018 PageUp Limited, an online recruitment services organisation, notified their customers about a data incident in relation to the integrity of their systems – proactively informing of a possible breach.

PageUp self-identified suspicious activity on its network and undertook immediate actions to investigate and contain the incident. PageUp notified their corporate customers and the Australian Cyber Security Centre (ACSC) of the issue, enabling the ACSC to quickly assess the incident and support PageUp in their response. In line with the new Notifiable Data Breaches (NDB) scheme, PageUp also notified the Office of the Australian Information Commissioner (OAIC). PageUp is in contact with its corporate clients to facilitate notification to individuals.

Although investigations are ongoing, PageUp believes that certain information pertaining to staff members, applicants and referees was accessed by an unauthorised third party. Further information about the types of information affected can be found at PageUp’s website. PageUp has advised that no employment contracts, applicant resumes, Australian tax file numbers, credit card information or bank account information were affected.

While recognising that investigations are ongoing and that the situation may therefore change, the ACSC emphasises that there is a significant distinction between information being accessed (which means there has been a systems breach) and information being exfiltrated by the offender. In other words, no Australian information may actually have been stolen.

IDCARE is Australia’s expert community identity and cyber support service and has been working with impacted organisations and members of the community in relation to this incident.

Dave Lacey, Managing Director, IDCARE says:

‘Whilst it is important to acknowledge that breached personal information impacts people in different ways, based on investigations undertaken to date by PageUp, at this point IDCARE assesses that the direct risk of identity theft is unlikely. Identity thieves typically require other forms of personal information to successfully manipulate this type of data, such as driver licence, passport, and account details, in order to obtain credit in a person’s name or related acts of impersonation.

IDCARE assesses that there are other risks that are likely to be more relevant to impacted individuals, including the possibility of phishing emails, telephone scam calls, and specific risks to individuals concerned about their contact information, physical address, and employment details (and applications) becoming known to third parties.’

PageUp has provided public updates, and has held multiple corporate customer information sessions facilitated through the ACSC to help keep affected organisations informed.

Alastair MacGibbon, Head of the Australian Cyber Security Centre and National Cyber Security Adviser says:

‘PageUp has committed to advising impacted organisations and individuals if there are any new findings to arise as they complete their investigations. PageUp has demonstrated a commendable level of transparency in how they’ve communicated about, and responded to, this incident: they came forward quickly and engaged openly with affected organisations.’

In this era of widespread cyber security threats, organisations must be prepared to prevent, detect and respond to incidents, to engage with relevant authorities and to provide timely and open communications to those affected.

Consistent with previous advice, the OAIC, ACSC and IDCARE jointly recommend that individuals who believe their information may be held by one or more of the organisations impacted consider the following measures:

Immediately change passwords that may be the same as the one used during the recruitment process undertaken with impacted organisations.

Regularly change passwords and make them hard to guess.

Be wary of phishing emails by reviewing the sender of the email and be cautious of links and attachments – if in doubt, make your own enquiries with the organisation and individual concerned using other means.

Avoid telephone scammers – good organisations don’t call you and then ask for your details – if in doubt, finish the call and do your own research by finding an alternative contact point and checking to see if the real organisation did call.

For further information on how to protect your identity and respond to identity concerns please visit the OAIC’s data breach guidance for individuals and IDCARE’s Learning Centre.

For general easy-to-use information for the public and small to medium businesses, visit the Australian Cyber Security Centre’s Stay Smart Online website.

To report a cyber security incident visit the Australian Cyber Security Centre’s website.

To notify the Office of the Australian Information Commissioner of an eligible data breach involving personal information, organisations should use the the OAIC’s Notifiable Data Breach form.

Alastair MacGibbon
Head of the Australian Cyber Security Centre and National Cyber Security Adviser

Angelene Falk
Acting Australian Information Commissioner and acting Australian Privacy Commissioner

Dave Lacey
Managing Director, IDCARE

Judge rules in favor of OCR and requires a Texas cancer center to pay $4.3 million in penalties for HIPAA violations

Posted by Dissent at 8:12 am Commentaries and Analyses, Health Data, Of Note, U.S.

Jun 192018

A U.S. Department of Health and Human Services Administrative Law Judge (ALJ) has ruled that The University of Texas MD Anderson Cancer Center (MD Anderson) violated the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules and granted summary judgment to the Office for Civil Rights (OCR) on all issues, requiring MD Anderson to pay $4,348,000 in civil money penalties to OCR. This is the second summary judgment victory in OCR’s history of HIPAA enforcement and the $4.3 million is the fourth largest amount ever awarded to OCR by an ALJ or secured in a settlement for HIPAA violations.

MD Anderson is both a degree-granting academic institution and a comprehensive cancer treatment and research center located at the Texas Medical Center in Houston. OCR investigated MD Anderson following three separate data breach reports in 2012 and 2013 involving the theft of an unencrypted laptop from the residence of an MD Anderson employee and the loss of two unencrypted universal serial bus (USB) thumb drives containing the unencrypted electronic protected health information (ePHI) of over 33,500 individuals. OCR’s investigation found that MD Anderson had written encryption policies going as far back as 2006 and that MD Anderson’s own risk analyses had found that the lack of device-level encryption posed a high risk to the security of ePHI. Despite the encryption policies and high risk findings, MD Anderson did not begin to adopt an enterprise-wide solution to implement encryption of ePHI until 2011 , and even then it failed to encrypt its inventory of electronic devices containing ePHI between March 24, 2011 and January 25, 2013. The ALJ agreed with OCR’s arguments and findings and upheld OCR’s penalties for each day of MD Anderson’s non-compliance with HIPAA and for each record of individuals breached.

“OCR is serious about protecting health information privacy and will pursue litigation, if necessary, to hold entities responsible for HIPAA violations,” said OCR Director Roger Severino. “We are pleased that the judge upheld our imposition of penalties because it underscores the risks entities take if they fail to implement effective safeguards, such as data encryption, when required to protect sensitive patient information.”

MD Anderson claimed that it was not obligated to encrypt its devices, and asserted that the ePHI at issue was for “research,” and thus was not subject to HIPAA’s nondisclosure requirements. MD Anderson further argued that HIPAA’s penalties were unreasonable. The ALJ rejected each of these arguments and stated that MD Anderson’s “dilatory conduct is shocking given the high risk to its patients resulting from the unauthorized disclosure of ePHI,” a risk that MD Anderson “not only recognized, but that it restated many times.”

The Notice of Proposed Determination and the ALJ’s opinion may be found on the OCR website at https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/mdanderson/index.html

SOURCE: HHS

Previous coverage of the incidents referenced in this case can be found on DataBreaches.net here.

New Charges in Huge C.I.A. Breach Known as Vault 7

Posted by Dissent at 8:47 pm Government Sector, Of Note, U.S.

Jun 182018

There’s a huge update in a significant case noted last month on this blog. Adam Goldman reports:

Federal prosecutors have charged a former software engineer at the center of a huge C.I.A. breach with stealing classified information, theft of government property and lying to the F.B.I.

The engineer, Joshua A. Schulte, 29, of New York, had been the main suspect in one of the worst losses of classified documents in the spy agency’s history.