State of Utah outlines mistakes made allowing theft of 780K records

Filed Under: Data loss, Featured, Privacy, Vulnerability

SSN Thief photo courtesy of ShutterstockA little over a month ago the State of Utah discovered one of its servers was under attack, reportedly by Eastern European hackers.

That's almost one year to the day of a similar data loss incident suffered by the State of Texas of eerily similar circumstances.

The attackers gained access to a server used by the state to receive Medicare, Medicaid and children's health service claims.

Unfortunately it is a reasonably common practice for health care providers to submit information on other patients as well, simply to determine if they may qualify for coverage.

This means that the victims aren't limited to those receiving subsidized health services from the state.

On March 30 the attackers began siphoning the names, addresses, birth dates and other personal information of 500,000 Utah residents. The attackers were also able to exfiltrate that data and the social security numbers of 280,000 additional residents.

How did the attackers gain access to this highly sensitive information? The state's new CIO, Mark VanOrden, spoke with the Deseret News and stated:

"Ninety-nine percent of the state's data is behind two firewalls, this information was not. It was not encrypted and it did not have hardened passwords."

The server had been originally installed by a third-party contractor and security audit procedures were not followed. In this case every mistake that could be made when handling personally identifiable information was made.

  • The data was not encrypted.

  • The data was preserved for longer than necessary, exposing more information when compromised.

  • Default passwords for service accounts were not changed/disabled.

  • Regular penetration tests and audits were not being performed to discover the mistake.

The state is offering one year of credit monitoring to victims of the theft, for more information and advice from the state please visit http://www.health.utah.gov/databreach/.

ID Theft protection padlock courtesy of ShutterstockOf course one year is not really much protection considering your social security number is with you for life, and most of us don't change addresses all that often. Utah Department of Health Director Dr. David Patton apparently doesn't understand that social security numbers are a far more critical thing to lose than credit card numbers.

Dr Patton suggested that one year was enough, because after one year the information "goes stale".

It is this kind of attitude that might contribute to bureaucrats making half-baked attempts at protecting the data to begin with, not considering that these incidents may haunt victims their whole lives.

Now that we have seen nearly identical incidents in two US states, let's hope this puts the other 48 on notice and triggers a response to ensure their residents are better protected.

Having processes and procedures is a start, but you must actually adhere to them to have a fighting chance against modern internet thieves.

Thief holding a Social Security Card photo and ID theft protection padlock courtesy of Shutterstock.

, , , , , ,

You might like

5 Responses to State of Utah outlines mistakes made allowing theft of 780K records

  1. qwefqwef · 833 days ago

    THis will not change until Governors are fired when shit like this happens.

  2. kj · 832 days ago

    Thank you so much for covering this! You are so right about only getting one year of monitoring, because we will worry about having our information stolen for the rest of our lives! Thank you again, sincerely, Kathy

  3. raymond · 832 days ago

    I suppose these things can happen if you pick the company offering the cheapest price. It peobably pays to check the people or companies that set up and install your servers.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Chester Wisniewski is a Senior Security Advisor at Sophos Canada. He provides advice and insight into the latest threats for security and IT professionals with the goal of providing clear guidance on complex topics. You can follow Chester on Twitter as @chetwisniewski, on App.net as Chester, Chester Wisniewski on Google Plus or send him an email at chesterw@sophos.com.