Log inRegister

Fraud News

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing inforisktoday.com, you agree to our use of cookies.

) • July 11, 2019     15 Minutes   

The relationship between American Medical Collection Agency and its clients affected by the company's data breach will be closely examined as breach-related lawsuits progress, says attorney Paul Hales, a HIPAA specialist. That's because plaintiffs will attempt to win settlements from AMCA's deep-pocket laboratory company clients, he says.

AMCA's parent company - Retrieval-Masters Credit Bureau - filed a petition for bankruptcy protection in a New York federal court in June just weeks after the public disclosure of the data breach, which affected the protected health information of more than 20 million individuals. Those victims included millions of patients of AMCA's largest clients, including medical testing laboratories Quest Diagnostics and LabCorp.

In its bankruptcy court filing, AMCA says it faced "a cascade of events that ultimately has resulted in the [company's] need to seek relief under Chapter 11." That includes Quest Diagnostics, LabCorp and other clients ending their business relationships with AMCA in the aftermath of the breach.

But those factors, and AMCA's bankruptcy filing, will not necessarily get Quest Diagnostics, LabCorp and other AMCA clients off the hook in the many class action lawsuits filed against AMCA and the labs in the aftermath of the breach, says Hales, who is not involved in the case.

Key Legal Issue

"A key legal issue is whether AMCA acted as an 'agent' under federal common law. ... That's incorporated in the HIPAA enforcement [regulations]," Hales explains in an interview with Information Security Media Group.

To determine whether a business associate acted as an "agent" of a HIPAA covered entity, federal regulators look at "the level of control over a business associate that a covered entity is able to have, as established under a contract, such as a business associate agreement, and whether that control is used or not," he says.

"Lawyers like to use boilerplate language that gives maximum control to their clients. And that's usually good, except in a HIPAA situation it can have a very bad outcome" if there is a data breach involving a business associate, he says.

AMCA is a HIPAA business associate, and court filings suggest it may have committed HIPAA violations, such as failure to conduct a risk analysis, review system activity and detect malicious software, Hales says. Although patients cannot sue based solely on HIPAA violations, failure to comply with HIPAA can be used as a standard in other types of lawsuits alleging negligence caused harm, he contends.

Attorneys representing individuals impacted by the AMCA breach will look at the level of control Quest Diagnostics, LabCorp and other clients had over AMCA's data security and other practices that potentially established the collection agency as an "agent," Hales says.

Plaintiffs' attorneys will want to go after the labs served by AMCA because of their financial resources, the attorney says. "AMCA is really the small fish. The deep pockets are with the laboratory companies and their parents."

In this in-depth interview (see audio link below photo), Hales also discusses:

What to expect next in the many class action lawsuit petitions that have been filed in federal courts across the country against AMCA and its large medical testing laboratory clients; Why AMCA's compliance with federal regulations other than HIPAA also potentially will be a key issue; The growing risks of medical identity theft and fraud following a health data breach.

Hales is a private practice health information security and privacy attorney. He's also an attorney and principal health information consultant with ET&C Group LLC, an international HIPAA compliance consulting practice based in St. Louis.

In the wake of digital transformation, there remain some organizations that - for security reasons - resist the temptation to move to the cloud. What are their objections? Zscaler's Bil Harmer addresses these, as well as the critical questions security leaders should ask of cloud service providers.

Harmer, CISO of the Americas for Zscaler, says the cloud is a game-changer in terms of making security leaders shift their focus from thinking about security as an exercise in protecting solely what they have on-premise.

"Security leaders really need to take that mental step back and say 'how do I adapt to the new environment and avoid the idea of I'm going to make the vendor work within my confine,' because that's just a recipe for disaster," Harmer says.

In an interview about cloud security, Harmer discusses:

Why some security leaders still hold out against the cloud; Critical steps to initiate the transition; Essential questions to ask of cloud service providers.

Harmer has been in the IT industry for 30 years. He has been at the forefront of the Internet since 1995 and his work in security began in 1998. He has led security for startups, Government and well established financial institutions. In 2007 he pioneered the use of the SAS70 coupled with ISO to create a trusted security audit methodology used by the SaaS industry until the introduction of the SOC2. He has presented on security and privacy in Canada, Europe and the US at conferences such as RSA, ISSA, GrrCon and the Cloud Security Alliance. His vision and technical abilities have been used on advisory boards for Adallom, Trust Science, ShieldX, Resolve and Integris. He has served as Chief Security Officer for GoodData, VP Security & Global Privacy Officer for the Cloud Division of SAP and now serves as the Americas CISO for Zscaler.

Brazilians are increasingly aware of the importance of cybersecurity but most adults report a lack of knowledge of how to protect their lives online, according to a new report.

According to the study, human behavior as it relates to cybersecurity carried out by YouGov on behalf of Palo Alto Networks, 69 percent of respondents believe that not being sure about how to protect their data makes them feel anxious.

However, some 82 percent of the Brazilian adults surveyed feel they are doing everything they can to prevent the loss of their information.

Individual responsibility for cybersecurity was another theme highlighted by the survey, with 55 percent of users citing that they believe should be accountable for their own personal data security.

Moreover, 54 percent feel that knowing more about what they can do to protect themselves and their families in the online environment make them feel more secure.

When it comes to using technologies to support personal data protection online, more than half (52 percent) of the 1,006 Brazilians polled prefer cybersecurity to be managed by artificial intelligence rather than a human.

Additionally, 62 percent of adults surveyed in the country said they spend less time worrying about their data security due to cybersecurity technology.

Some 55 percent of Brazilians interviewed also think that security checks such as Re-Captcha, a system intended to establish that a computer user is human, have a positive impact on the digital experience.

A patient having anaesthetic administered to them Image copyright Getty Images Image caption The problem affects anaesthetic machines used in many hospitals around the world

A type of anaesthetic machine that has been used in NHS hospitals can be hacked and controlled from afar if left accessible on a hospital computer network, a cyber-security company says.

A successful attacker would be able to change the amount of anaesthetic delivered to a patient, CyberMDX said.

Alarms designed to alert anaesthetists to any danger could also be silenced.

GE Healthcare, which makes the machines, said there was no "direct patient risk".

But CyberMDX's research suggested the Aespire and Aestiva 7100 and 7900 devices could be targeted by hackers if left accessible on hospital computer networks.

And analysis by BBC News found multiple references online to the Aespire and Aestiva machines being used in NHS Hospitals.

Nottingham University Hospitals (NUH) NHS Trust confirmed to the BBC that "a small number" of the devices were currently in use at its facilities, but were being phased out.

"None of the anaesthetic machines are connected to the internet or the NUH network so there is very little risk around these machines within NUH," a spokesman told the BBC.

Security warning over hospital syringe pumps Computer virus alters cancer scan images

NHS Digital said it could not confirm the extent to which the machines were still in use across the NHS.

"We are currently assessing the volume of these particular anaesthetic machines in use across England and we will be sharing any subsequent advice with trusts in the coming days," a spokeswoman said.

Elad Luz, head of research at CyberMDX, said he was aware of hospitals in the US and Asia that also used the devices.

GE Healthcare said it was satisfied a cyber-attack would "not introduce clinical hazard or patient risk".

It said this was because anaesthetic devices were "attended" by anaesthetists and would be monitored for any errors.

The company told BBC News it did not plan to release any security updates for the anaesthetic machines but hospitals should use secure network protocols to protect them from would-be hackers.

Cyber-security expert Ken Munro agreed that medical devices should be isolated within computer networks but added: "It's not, frankly, the case in many hospital networks."

And he said GE Healthcare should bear some responsibility for the issue.

"GE absolutely have a part to play in this and they absolutely should be building devices with strong security," Mr Munro added.

Image copyright Getty Images Image caption GE Healthcare has responded to the reports of a problem with its machines

A malicious hacker may try to gain access to a hospital's network, locate one of the machines and then adjust its settings, said Prof Harold Thimbleby, an expert in medical device cyber-security, at Swansea University.

And he gave the example of WannaCry, a ransomware outbreak that spread through NHS computer networks in 2017, to illustrate how an attack could unfold.

"As with WannaCry, a phishing attack can gain access and then an attacker can do what they like," he told BBC News.

"Given the worldwide profile of WannaCry, it is amazing vulnerabilities like this are still around."

The likelihood of harm being caused to a patient through any hacking of the devices was "incredibly small" said Dr Helgi Johannsson, consultant anaesthetist and Royal College of Anaesthetists Council Member.

"Patients should be reassured that their anaesthetist will be monitoring them constantly, and will have received many years of training to rectify immediately the situation of a device failure."

A spokeswoman for the UK's Medicines and Healthcare products Regulatory Agency said reports of the cyber-security vulnerability were now part of an "ongoing area of investigation".

"Patient safety is our highest priority and where necessary we will take action to protect public health," she added.

The US Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) has published an advisory notice about the vulnerability.

Facing the unique challenges of a ransomware attack Lester Godsey, chief information security officer in Mesa, AZ, discusses how ransomware attacks have changed in the past few years and how to adapt to those changes.

A newly discovered form of ransomware is targeting network storage devices by brute-forcing weak credentials and exploiting known vulnerabilities in their systems.

Dubbed eCh0raix after a string of code, the new form of file-locking malware emerged in June and has been detailed by cybersecurity researchers at Anomali. The ransomware specifically targets QNAP network attached storage (NAS) devices produced by Taiwanese firm QNAP systems, which has offices in 16 countries and customers around the world.

Several vulnerabilities have been discovered in QNAP NAS devices in recent years, although the company has patched them after they've been discovered and disclosed. However, many organisations struggle to apply patches in a timely manner.

SEE: A winning strategy for cybersecurity (ZDNet special report) | Download the report as a PDF (TechRepublic)  

The attacks are opportunistic, with the initial infection coming via unsecured, internet-facing ports and the use of brute-force attacks to bypass weak login credentials. NAS devices make appealing targets for cybercriminals dealing in ransomware, because they're used to store critical data and backups – but despite this, the devices don't tend to be equipped with security software.

"Publicly exposed systems and devices expand overall attack surfaces and increase the potential for vulnerabilities to be exposed and exploited," Joakim Kennedy, threat intelligence manager in the Anomali threat research team, told ZDNet.

"Ransomware attacks are going to continue as a way for threat actors to attempt to monetize their efforts and to disrupt operations for other objectives."

Written in the Go programming language and described as very simple – the source code is fewer than 400 lines - eCh0raix checks to see if the files are already encrypted, before reaching out to a command-and-control server to begin the encryption process and create an AES-256 encryption key to lock the files with a .encrypt extension.

Users are presented with a ransom note informing than that all their data has been locked and directing them to a Tor website to make the ransom payment in bitcoin – users are also warned not to tamper with the encrypted data.

Researchers suggest spelling errors in the ransom note indicate that those behind the ransomware aren't native English speakers.

In order to protect NAS devices against ransomware attacks, it's recommended that users restrict external access to them so that they can't be found from the outside internet. It's also recommended that security patches are applied and strong credentials are employed to protect systems from brute-force attacks.

MORE ON CYBERCRIME

Cybercrime , Fraud Management & Cybercrime , Governance

Incident Investigation Triggers Alert, Which Calls for Precautions(@Ferguson_Writes) • July 9, 2019    US Coast Guard Warns of Maritime Malware Attacks(Image: U.S. Coast Guard)

The U.S. Coast Guard has issued an alert about an increase in malware attacks targeting the networks of commercial vessels. It's warning ship owners to take more cybersecurity precautions.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

In May, the Coast Guard noted in another alert that attackers were attempting to use phishing techniques to steal data and other information about vessels and their voyages.

The latest alert stems from an incident in February, when Coast Guard investigators were called to examine reports of a cybersecurity incident aboard an international deep draft vessel bound for the Port of New York and New Jersey, according to the document. In that case, malware infected the vessel's network and some computer systems, but it did not cause any significant damage, according to the Coast Guard.

"The team concluded that although the malware significantly degraded the functionality of the onboard computer system, essential vessel control systems had not been impacted," according to the Coast Guard alert issued Monday. "Nevertheless, the interagency response found that the vessel was operating without effective cybersecurity measures in place, exposing critical vessel control systems to significant vulnerabilities."

The Coast Guard notes that it's still investigating the cybersecurity incident. It's not yet clear how the malware infected that vessel's network, especially because the crew did not extensively use the ship's network for personal business, such as online banking and email, the report notes.

The ship's network was mainly used for official business, including updating electronic charts, managing cargo data and communicating with shore-side facilities, pilots, agents and the Coast Guard, according to the report.

Malware on the High Seas

Although it's mainly known for its coastal defense and maritime law enforcement roles, the Coast Guard is also involved in investigating certain cybersecurity incidents.

In 2018, for instance, the Coast Guard, along with the FBI and the U.S. Department of Homeland Security, investigated a ransomware attack that affected the Port of San Diego, disrupting the commercial shipping industry (see: Ransomware Crypto-Locks Port of San Diego IT Systems).

The shipping industry, which is relying more on internet-connected networks and devices, is growing more susceptible to malware and other cybersecurity disruptions.

In June 2017, the NotPetya ransomware attack affected Danish shipping giant A.P. Møller - Maersk, the world's biggest shipping firm. The company was then forced to reroute ships and was unable to dock or unload cargo ships in dozens of ports (see: Maersk Previews NotPetya Impact: Up to $300 Million).

Maersk estimated that it would lose about $300 million because of the ransomware outbreak.

The Coast Guard notes in this week's alert: "With engines that are controlled by mouse clicks, and growing reliance on electronic charting and navigation systems, protecting these systems with proper cybersecurity measures is as essential as controlling physical access to the ship or performing routine maintenance on traditional machinery. It is imperative that the maritime community adapt to changing technologies and the changing threat landscape by recognizing the need for and implementing basic cyber hygiene measures."

In its May 24 Marine Safety Information Bulletin, the Coast Guard noted that attackers were attempting to gain information and data, such as a vessel's "notice of arrival," by sending phishing emails using addresses similar to those of official Port State Control authorities.

Taking Precautions

This week's alert also offers risk mitigation advice, including:

Create segmented networks to make it more difficult for attackers to gain access to all of a vessel's systems and equipment; Enforce better password management and create user profiles for the ship's crew as well as limit administration accounts; Discourage crew members from using external media, such as USB drives; Update security software and patch systems as alerts are posted.

"Maintaining effective cybersecurity is not just an IT issue, but is rather a fundamental operational imperative in the 21st century maritime environment," the alert states. "The Coast Guard therefore strongly encourages all vessel and facility owners and operators to conduct cybersecurity assessments to better understand the extent of their cyber vulnerabilities."

  1. Overcoming Vulnerability Overload
  2. Moving From Vulnerability Management to Vulnerability Response
  3. Best Practices for Device Security
  4. Live Webinar: How to Achieve Continuous Compliance in Cloud Native DevOps

Page 219 of 354