Breach Preparedness , Data Breach , Encryption & Key Management

Several recent health data breaches point to the need to better mitigate the risks posed by email.

See Also: Live Webinar | Levers of Human Deception: The Science and Methodology Behind Social Engineering

Security gaps and user mishaps are the culprits in many of these breaches. But implementing the right technologies and best practices can help reduce the risks, security experts advise.

Phishing email attacks often lead to incidents involving ransomware and other malware infections - as well as other intrusions involving unauthorized access to patient and other sensitive data.

But mistakes by users sending email also are persistent culprits in major health data breaches.

Here's a recent example: A breach impacting 6,450 individuals reported by family medical practice Prairie Fields Family Medicine of Fremont, Nebraska, involved an email that exposed patient information. In a notification statement, Prairie Fields notes that an email from its office containing an unencrypted spreadsheet with patient information was inadvertently sent to an incorrect email address. The incident was discovered the same day.

"Prairie Fields has made several attempts to contact the recipient, by email, but has not received any response. Prairie Fields suspects, but cannot be certain, that the email address has been abandoned or is no longer in use," the statement says.

The medical practice says it has not received any indication that any patient's personal information has been accessed or used by the unintended recipient. The information contained in the spreadsheet included patient name, date of birth, age, sex, race, first language, telephone number and certain health insurance information, including provider's name and policy numbers.

The practice's statement notes that it's putting into place "additional safeguards" to prevent future incidents.

Unauthorized Access

In another recent email-related incident, University of Vermont Health Network - Elizabethtown Community Hospital reported a breach that affected 32,000 and exposed the Social Security numbers of 1,200.

A notification statement says the incident involved one employee's email account which "for a brief period of time" was remotely accessed by an unauthorized user. "We completed an initial 60-day investigation of the incident and have no evidence of any fraud or identity theft to any individual as a result of this incident," according to the notification.

"Upon learning of the incident ... we immediately took action, including changing passwords, implementing enhanced security features and engaging a leading forensic security firm to assist with the investigation."

Other potentially compromised information included names, dates of birth, addresses and limited medical information, such as medical record numbers, dates of service and a brief summary of services provided, the organization reports.

Ransomware and More

Hacker intrusions, including those that involve email-fueled ransomware attacks, can also result in the installation of other malicious programs.

Take the case of Mind and Motion Developmental Centers of Suwanee, Georgia, a multidisciplinary treatment center offering mental health, physical therapy and other health services, which recently reported a hacking incident impacting 16,000 individuals.

In its notification statement, the treatment center says it discovered that the company's server had been corrupted by ransomware. A forensic investigation by a third-party consulting firm found that "an inactive keylogger and spam emailer" also had been installed on the compromised server.

"These programs and the associated accounts were removed," Mind and Motion says. "Other minor malware was found and removed. It did not appear that any of the malware found had access to any of our scheduling, electronic billing or patient financial accounts."

Mind and Motion says it implemented several measures, including changing passwords for all accounts used in the office. "Passwords were required to be higher in complexity. A policy was put in place to force password changes on a more regular basis as well as when business events warrant them," the statement says.

In addition, all email accounts associated with the business domain will have "the latest spam protection to prevent common methods of phishing," the statement notes.

Protected health information potentially compromised by the incident includes name, address, birthday, medical history, Social Security number, medical diagnosis, insurance information and medical records, Mind and Motion says in its statement.

A Common Problem

Email-related breaches are far too common in healthcare. A Dec. 19 snapshot of the Department of Health and Human Services' HIPAA Breach Reporting Tool website shows a total of 344 major health data breaches impacting 12.7 million individuals have been added to the tally so far in 2018. Of those, 111 breaches impacting 3.4 million individuals were reported as involving email.

Commonly called the "wall of shame," the federal website lists reported HIPAA breaches impacting 500 or more individuals.

The largest email-related breach on the tally was a July hacking incident reported by Iowa Health System, which does business under the name UnityPoint Health.

That incident, which impacted 1.4 million individuals, involved a phishing campaign that exposed an assortment of personal and medical data stored in UnityPoint Health's email systems. But the information exposure appears to have been an unintentional byproduct of an attempt to divert corporate payments via what's known as business email compromise, the organization said.

Ongoing Challenge

Incidents involving email - whether instigated by hackers or caused by user mistakes - are an ongoing challenge for many healthcare sector organizations.

"We can wrap technical protections around our systems and networks, but ultimately people are the weak link, as we see with successful phishing attacks," says Kate Borten, president of security and privacy consultancy The Marblehead Group.

"Organizations should be giving their employees examples of successful phishing attacks to demonstrate and remind them of how easily we can fall for those emails. And organizations should routinely test their employees with simulated attacks."

But other email-related breaches, such as those involving unsecured patient information being sent via email, can be tricky to stop, Borten says.

"Unfortunately, email encryption is not simple. The recipient needs to go through several steps to open encrypted messages, and some solutions are awkward to use and limited," she notes. "This fact deters use of secure email between unrelated parties except in highly regulated industries, such as finance. Simple, transparent email encryption between different users and systems should be a global priority to achieve."

In healthcare provider organizations, encryption is often voluntary, relying on the sender to decide whether to encrypt and take extra steps to encrypt the message, Borten says. "This is a flawed approach and leads to mistakes," she adds.

Taking Action

Rebecca Herold, president of Simbus, a privacy and cloud security services, says healthcare organizations should consider implementing various technologies that can help to reduce the risk of email-related breaches.

Besides encryption, those include logging and message blocking that can be "automatically and transparently apply these controls to all the email accounts, or at a minimum, the email accounts that deal with personal and sensitive data," she notes.

"Using encryption plug-ins for the corporate email addresses the organization users' side issues, but not the outside recipients' risks," she says. "But it is still a good option to implement. "

To address internal and external exchanges, "using email encryption cloud services that keep the emails encrypted so that the cloud service itself never can get access to the messages is a great way to exchange such confidential communications," she adds.

Training, followed up with frequent security and privacy reminders, can help cut down on mistakes by staff members, Herold notes.

Cybercrime , Cyberwarfare / Nation-state attacks , Fraud

For the past three years, hackers have been intercepting sensitive diplomatic cables sent between EU member states after stealing passwords for accessing the EU network via a phishing attack against diplomats in Cyprus, The New York Times reported late Tuesday.

See Also: Cybercrime 2.0: A New Era for the Identity and Authentication Challenge

The attack was discovered by Area 1, an anti-phishing firm based in Redwood City, California, that was founded in 2013 by three former National Security Agency officials. Area 1 researchers said that after hackers copied the cables off of a secure EU network, they had been posting them onto an open internet site, which was where the researchers found them. The company has shared more than 1,100 of the stolen EU cables with The New York Times.

Area 1 didn't immediately respond to a request for comment on the Times report, which says the same group of hackers also appears to have penetrated more than 100 other institutions and organizations, including the United Nations, the American Federation of Labor and Congress of Industrial Organizations - better known as the AFL-CIO - as well as "ministries of foreign affairs and finance worldwide," in some cases for years.

But Oren Falkowitz, CEO of Area 1, told the Times that the hacking group gained access to the EU network, called COREU, via a phishing attack against government systems in Cyprus - one of the 28 EU member states - on which they found passwords that allowed them to access COREU.

"People talk about sophisticated hackers, but there was nothing really sophisticated about this," Falkowitz said.

Britain's signals intelligence agency, GCHQ, didn't immediately respond to a request for comment on the theft of EU diplomatic cables.

"Hackers will always seek out the weakest spot: the easiest way in," Alan Woodward, a professor of computer science at the University of Surrey, tells Information Security Media Group. "I suspect they found Cypriot government systems slightly less prepared for their attacks than others in the EU. But, of course, it allowed them into the parts of the systems that then meant they could read messages intended for many countries as well as Cyprus."

Revealed: Diplomacy, Negotiation Strategies

The New York Times reports that the cable theft shows hackers attempting to glean information on every possible aspect of EU diplomacy and negotiation. The cables include details of European foreign policy, as well as strategies for working with - and around - U.S. President Donald Trump, including emphasizing the EU's own interests in everything from trade to Brexit and working directly to Congress whenever possible, according to the Times' review of the cables.

The cables also reveal European diplomats' potentially contentious take on global affairs. For example, a July 20 cable from the European External Action Service - the EU diplomatic service and foreign and defense ministry - written by the EU delegation in Russia includes an analysis of the Helsinki summit held that month between Trump and Russian President Vladimir Putin, concluding that it was "successful (at least for Putin)."

"Moscow now waits for the calming of emotions in Washington," the cable reads (see: How Trump Talks About Russian Hacking).

European Council Probes Alleged Leak

The General Secretariat of the Council, which is the body of staff responsible for assisting the European Council, tells ISMG in a statement that it "is aware of allegations regarding a potential leak of sensitive information and is actively investigating the issue."

But it declined to comment further on any specifics. "The Council Secretariat does not comment on allegations nor on matters relating to operational security," it says in its statement. "The Council Secretariat takes the security of its facilities, including its IT systems, extremely seriously."

Woodward says the duration of the attack and apparent failure of the EU to spot it are cause for alarm. "The fact that this went on for three years is troubling. It shows that you can have very strong partners in an alliance like the EU - I like to think the U.K. has excellent skills and is good at protecting its government systems - but as a member of such an alliance you are reliant on everyone else being as strong," he says. "Sadly, that's not always the case."

Signs of Chinese Hacking

Researchers at Area 1 say the hack attacks appear to have been carried out using tactics that have been regularly employed by the Strategic Support Force of the People's Liberation Army, which is a group that formerly belonged to the Chinese signals intelligence agency, known as 3PLA.

"After over a decade of experience countering Chinese cyber operations and extensive technical analysis, there is no doubt this campaign is connected to the Chinese government," Area 1 researcher Blake Darche told the Times.

The Chinese Embassy in Washington didn't immediately respond to a request for comment on those allegations.

In terms of the potential identity of the hackers, Woodward says China would not be the only government attempting to mount this type of operation. "Intelligence agencies all over the world will be trying this type of operation," he says.

European officials told the Times that they're in the process of replacing COREU with a more secure system called EC3IS, and that all confidential, secret and "tres secret" material is already handled via a different and more secure system.

The EU's compartmentalized approach to its diplomatic communications - including using more secure systems for even more sensitive information - suggests that officials are aware of the risk posed by any system that allows access to so many individuals in so many different nations. But even non-classified material, including official communications, "can be a treasure trove for intelligence agencies," Woodward says.

Life After WikiLeaks

This isn't the first time that sensitive diplomatic or political communications have been intercepted or revealed en masse.

In 2010, WikiLeaks released tens of thousands of U.S. diplomatic cables and military documents from the Iraq and Afghanistan conflicts, which had been leaked to the site by Chelsea Manning, the U.S. Army intelligence analyst formerly known as Bradley Manning (see: Obama Commutes Sentence of WikiLeaks Leaker Manning).

The State Department cables, written in sometimes frank and unguarded language by diplomats, embarrassed the U.S. government, and the military documents raised serious concerns over civilian casualties.

More recently, emails stolen from the Democratic Congressional Campaign Committee, the Democratic National Committee and the 2016 presidential campaign of Hillary Clinton were leaked by Guccifer 2.0. In July, the U.S. Department of Justice unsealed an indictment against 12 Russian intelligence officers that accused Russia's GRU military intelligence service of having hacked the targets and released the documents as part of Moscow's attempt to influence U.S. elections, including using Guccifer 2.0 as a front (see: 10 Takeaways: Russian Election Interference Indictment).

In comparison to those two campaigns, however, experts tell the Times that the EU diplomatic cables never appear to have been purposefully leaked, and that this operation appeared to be a pure espionage play.

Compliance , General Data Protection Regulation (GDPR) , Governance

Privacy watchdogs in Europe say they are continuing to see an increase in data breach reports as well as privacy complaints.

See Also: Third-Party Cyber Risk Management - A Data-Driven Approach

That should be no surprise, because the EU on May 25 began enforcing its General Data Protection Regulation. Among its provisions, GDPR requires organizations that suffer a breach that may have exposed Europeans' personal information to notify relevant authorities (see: Europe Catches GDPR Breach Notification Fever).

The number of data breach reports filed since GDPR went into effect has hit about 3,500 in Ireland, over 4,600 in Germany, 6,000 in France and 8,000 in the U.K.

GDPR also gives Europeans the ability to file class-action lawsuits against breached organizations, and some law firms have already been exploring these types of actions.

And under article 77 of GDPR - "Right to complain to a supervisory authority" - Europeans can also file complaints with regulators about organizations' data protection practices, as they were also able to do before enactment of the new regulation. Regulators say these complaints have also been increasing.

Numerous national data protection authorities say they have seen an increase in both complaints as well as breach reports. But as information security expert Brian Honan has told Information Security Media Group, the increase in data breach reports does not mean there has been a surge in data breaches (see: Europe Catches GDPR Breach Notification Fever).

"What we are seeing is an increase in the reporting of the breaches that are happening," according to Honan, who heads Dublin-based cybersecurity firm BH Consulting. "So there is not necessarily an increase in the number of breaches since May 25, but rather we now have better visibility on data breaches."

Here's a sample of what European privacy watchdogs have been seeing.

Ireland: DPC

Ireland's DPA, the Data Protection Commission, tells ISMG that as of Monday, it's received 2,476 complaints and 3,495 breach reports, although they involve both pre-GDPR and post-GDPR cases. "We have received complaints and breach notifications that relate to issues that occurred both post and pre-GDPR, and the pre-GDPR [before May 25] cases are therefore dealt with under the old legislation," says Graham Doyle, the head of communications.

Complaints:

Breach reports:

In 2017, the DPC received an average of 230 data breach reports and 220 complaints per month. Since GDPR came into effect, however, it's seen a monthly average of 500 breach reports and 354 complaints.

"As you can see, there has been a significant increase in the volumes of both breaches and complaints to the DPC since May 25," Doyle says.

Germany: BfDI

Germany's DPA, the Federal Commissioner for Data Protection and Freedom of Information, or BfDI, tells ISMG that as of Oct. 31, it received:

In some cases, breach reports and complaints may be filed with any of the DPAs in Germany's 16 federal states. As of Sept. 5, BfDI says the total numbers seen across all federal and state DPAs included:

France: CNIL

France's DPA, the Commission nationale de l'information et des libertés, aka CNIL, tells ISMG that since GDPR enforcement began on May 25, through Nov. 23, it has received:

In the first two months following GDPR going into effect, CNIL received an average of 27 data protection complaints per day, but since then, the average has risen to 36 per day (see: GDPR Effect: Data Protection Complaints Spike).

United Kingdom: ICO

Earlier this month, the U.K.'s DPA, the Information Commissioner's Office, said that it's now seeing about 41 data breach reports get filed per day.

U.K. Information Commissioner Elizabeth Denham told a privacy conference in Wellington, New Zealand, on Dec. 5 that the ICO has seen the total number of data security complaints increase from 9,000 in the six months before GDPR took effect to 19,000 in the six months after.

Since May 25, the ICO also received more than 8,000 data breach reports, she said.

The ICO says the increase in complaints was expected because of the number of high-profile organizations that have been breached in recent months, including Currys, Marriott and Superdrug.

One-Stop Shop

While each of the 28 EU member nations has its own DPA, expect to hear much more from Ireland's Data Protection Commissioner. That's because it will be taking the lead on numerous high-profile privacy investigations since many U.S. technology giants - including Facebook, Microsoft, Twitter, and soon Google - having chosen the country as the sight of their European headquarters (see: Ireland's Privacy Watchdog Probes Facebook Data Breaches).

Under GDPR, non-EU organizations that have headquarters established in Europe can take advantage of a "one-stop shop" mechanism. This enables organizations that have a presence across different EU member nations to be subject to regulatory oversight by just one supervisory authority, rather than being subject to regulation by the supervisory authorities of each nation in which they have a business presence. The supervisory authority in the nation of the organization's "main establishment" takes on the role of lead supervisory authority.

For any organization that doesn't qualify for the one-stop-shop mechanism, but is the subject of a privacy complaint under GDPR, the data protection authority in whichever country where the complaint gets raised takes the lead if it determines that an investigation would be warranted.

First GDPR Fines Still to Come

Beyond bringing mandatory notifications for many types of breach to Europe, GDPR is also a big deal because of the potential penalties that regulators can impose on organizations that fail to take privacy seriously.

Organizations that violate GDPR face fines of up to 4 percent of their annual global revenue or €20 million ($22.7 million) - whichever is greater - as well as other potential sanctions, including losing their ability to process personal data.

Separately, organizations that fail to comply with GDPR's reporting requirements also face fines of up to €10 million ($11.3 million) or 2 percent of annual global revenue.

Many regulators have been clear that they don't plan to use the threat of massive GDPR fines punitively. But at the same time, organizations that fail to take Europeans' privacy rights seriously, or worse, engage in criminal behavior and attempt to cover it up, may find themselves at the receiving end of a serious European privacy enforcement smackdown.

So far, regulators have yet to bring GDPR fines to bear on an organization that was breached since May 25. In general, DPAs' investigations into major breaches tend to take about a year. So it's a safe bet that any major GDPR penalties won't be seen until mid-2019, at the earliest (see: Marriott Mega-Breach: Will GDPR Apply?).

Breach Response , Data Breach , Governance

A large health insurer in Western Australia inadvertently shared the home addresses of some psychologists to a web-based appointment booking service, the West Australian reported Wednesday.

See Also: Third-Party Cyber Risk Management - A Data-Driven Approach

The health insurer, HBF, passed names and addresses for psychologists to Whitecoat, a company that develops an online booking and patient review mobile application and website. The details have since been removed. The same details for dentists, dieticians and remedial massage therapists were also passed onto Whitecoat.

The West Australian writes that HBF has notified 7,000 psychologists. Some of the psychologists work from home and did not have a separate location for their practice. The breach came to light after a psychologist saw their personal address on Whitecoat.

Efforts to reach HBF on Wednesday were not immediately successful.

Exec: Data Should Have Been Scrubbed

HBF CEO John Van Der Wielen tells the Western Australian: "We should have scrubbed the data or sent it in a different manner to avoid this, and while we think it might have only affected a small number of psychologists for a short period of time, we have to be squeaky clean. I'm treating it with the utmost severity but in reality we haven't published bank account details or family details."

Voter registration rolls in Australia contain names and addresses. But medical professionals are among those who can be granted silent elector status - in which only their name appears on the roll. That status is granted on a case-by-case basis and approved by a divisional returning officer, according to the Australian Electoral Commission.

Another One For The Tally

The incident has been reported to the Office of the Australian Information Commissioner, which oversees the country's data protection regulations.

In February, an amendment to Australia's Privacy Act went into effect that for the first time put in place a mandatory notification requirement for certain types of organizations for certain classes of data breaches. The law applies to companies and governmental organizations that are covered by the Privacy Act 1988 (see: Australia Enacts Mandatory Breach Notification Law).

Businesses that have less than 3 million Australian dollars ($2.2 million) in annual revenue are excluded from the reporting requirement. The fines for violations range from AU$360,000 for individuals to AU$1.8 million for organizations.

Before the law, many organizations had followed the best practice advice from the OAIC, which recommended that breaches be voluntarily reported. The threshold for reporting was a leak or theft of information that's likely to result in "serious harm."

The OAIC offered guidance to organizations on how that determination is to be made: "Whether a data breach is likely to result in serious harm requires an objective assessment, determined from the viewpoint of a reasonable person in the entity's position."

A factor that can contribute to whether a breach could cause serious harm is whether several piece of information have been leaked at the same time. Another consideration is whether the leak involves data often used for identity fraud, such as a driver's license number, passport details, Medicare card or financial details, the OAIC says.

The OAIC has received a steady drip of reports, which it summarizes in quarterly updates. While some breaches prior to the law taking effect did become public, the OAIC's reports have shed a light on frequency of data mishaps and malicious incidents.

The third quarterly report for the year, released on Oct. 30, showed the OAIC received 245 notifications between July and September. A little over a third of those incidents resulted from human error, with more than half the result of malicious or criminal activity.