Jan 222018

Pedes Orange County, Inc. in California shares their medical facility with another medical group that  conducts surgical procedures. To coordinate, it seems that they share a scheduling tool with other medical professionals in their building.

Somehow – and it’s not yet clear to me how this happened in terms of access controls – a physician from another medical group accessed Pedes’ EMR records database “without permission and disclosed the database materials to their attorney.”

According to their data breach notification, the incident was discovered on November 14 (and they do not explain how they discovered it or when it unauthorized access first began), they we have been working with the unauthorized individual to destroy all patient medical information that was accessed without permission, which for some patients, may have included name, medical diagnosis, medical treatments, dates of medical service, and other treatment related information.

The notification does not indicate how many patients had their information improperly accessed.

DataBreaches.net sent Pedes a few questions through their on-site contact form, but has received no response as yet. This post may be updated as more information becomes available.


Update: This was reported to HHS as impacting 917 patients, but this site still has a number of questions about this incident and hopes Pedes responds.


Jan 222018

Kirsty Weakley writes:

Age UK lost the personal details for current and former staff in two separate data breaches at the end of last year and has reported itself to the Information Commissioner’s Office.

The charity has written to current and former employees to tell them that there were two incidents at the end of last year which mean people’s names, addresses, date of birth and national insurance number have been lost.

Age UK said that no bank details or passwords were lost and it is “not aware of any actual or attempted misuse of any personal data”. No customer or supporter data has been compromised.

Read more at CivilSociety.

Jan 192018

Fionn Hargreaves reports:

A schoolboy hacker impersonated a CIA director to gain access to top secret military reports, a court heard yesterday.

Kane Gamble was just 15 when he posed as CIA chief John Brennan from his Leicestershire home, even taking control of his wife’s iPad.

The teenager gained access to passwords, personal information, security details, contacts lists and sensitive documents about operations in Afghanistan and Iraq.

Gamble, who founded the pro-Palestinian group ‘Crackas With Attitude’, taunted the security service on Twitter about his successes.

Read more on Daily Mail.  See also The Telegraph for additional details about many of the targets/victims.  Gamble had pleaded guilty in October, but this was the first time some of the details came out publicly.

Jan 192018

More entities are falling prey to SamSam ransomware. Hannah Grover reports:

The city of Farmington is returning to normal after a variant of the ransomware known as SamSam shut down the computer systems.

The virus encrypts files on a computer network or locks down the entire system. When people attempt to log on, they receive a message informing them that the files have been hijacked and they will have to pay to get them back.

City Manager Rob Mayes said via text message that the FBI advised the city not to pay the 3 bitcoin — worth more than $35,000 — ransom that was demanded. Mayes said the city was able to recover the encrypted information without paying ransom.

Many of the business operations computers were encrypted on Jan. 3 by a variance of the SamSam ransomware.

Read more on Daily Times, who were able to obtain a copy of the ransom message, reproduced below:

Ransom message received by City of Farmington, NM

The city’s press release of January 17, informed the community, but does not seem to disclose how the malware got into the system. Was this another phishing situation? They may not have been able to answer that question yet:

Farmington, NM: The City of Farmington continues to work with the FBI and other outside services to investigate the cause and originating location of the ransom ware that encrypted many business operations computers on January 3, 2018.  Information Technology (IT) personnel have been able to confirm that the City was attacked by a variance of the SAMSAM ransom ware.

The City apologizes for the temporary inconvenience our customers may have experienced during this time.  Nearly all business systems related to customer service operations have been restored.

While the FBI has confirmed that attacks like this are happening all over the world on a daily basis, the City would like to emphasize:

  • No City customer or employee personal information was extracted
  • The City’s public administration system was not affected
  • There was no breach of any electric utility operations systems
  • There was no interruption of any public safety services
  • City email systems were not affected and are safe

The City of Farmington invests significant resources in the latest technology in virus defense, including specific ransom ware software and multiple levels of virus protection. The City has enlisted additional outside resources to review security protocols and make recommendations regarding any improvements that may be implemented.

via @CampusCodi, who provides additional details on the profit the criminals seem to be reaping since December.

Update:  The Allscripts incident has also now been confirmed to have involved SamSam, and as also covered previously on this blog, we know that the Hancock Regional Hospital and Adams Memorial Hospital incidents also involved SamSam.

Jan 182018

Olga Kharif reports:

In less than a decade, hackers have stolen $1.2 billion worth of Bitcoin and rival currency Ether, according to Lex Sokolin, global director of fintech strategy at Autonomous Research LLP. Given the currencies’ explosive surge at the end of 2017, the cost in today’s money is much higher.

“It looks like crypto hacking is a $200 million annual revenue industry,” Sokolin said. Hackers have compromised more than 14 percent of the Bitcoin and Ether supply, he said.

Read more on Bloomberg.