Centennial Man: 2011-01-02

Saturday, January 08, 2011

Unfortunately, 4 million is nowhere close to a record. But this surely make the “top ten most incomprehensible security failures” list...

http://www.databreaches.net/?p=16217

Mobile security outrage: private details accessible on net

January 8, 2011 by admin

Natalie O’Brien reports:

The personal details of millions of Vodafone customers, including their names, home addresses, driver’s licence numbers and credit card details, have been publicly available on the internet in what is being described as an ”unbelievable” lapse in security by the mobile phone giant.

The Sun-Herald is aware of criminal groups paying for the private information of some Vodafone customers to stand over them.

Other people have apparently obtained logins to check their spouses’ communications.

Personal details, accessible from any computer because they are kept on an internet site rather than on Vodafone’s internal system, include which numbers a person has dialled or texted, plus from where and when.

The full extent of the privacy breach is unknown but The Sun-Herald has learnt that possibly thousands of people have logins that can be passed around and used by anyone to gain full access to the accounts of about 4 million Vodafone customers.

Friday, January 07, 2011

Once upon a time, it was common for crooks to steal pantyhose to use as a mask. Now it appears worthwhile to purchase a retail business if it gives you access to lots of credit cards... I can only assume the economics still make sense.

http://www.databreaches.net/?p=16193

(update) EVG Quality Gas breach, Sierra Madre

January 6, 2011 by admin

A small update to the story by Adolfo Flores of the Pasadena Star News:

The Secret Service has been called in. As significantly, the police are still looking for the owner of the gas station who closed the business and left town during Christmas week – right before all of the fraud reports starting coming in.

“In this case we are looking for three individuals, one of them is the former owner (Evgeny) Yakimenko,” Police Chief Marilyn Diaz

At a 7 a.m. press conference authorities provided a photograph of a man withdrawing funds from a victim’s account in Montebello. They are also investigating a Valero gas station up the street from EVG for fraudulent transactions.

Diaz confirmed that a skimming device was used to gather victims’ information when they used their cards in an ATM or in-store transaction.

Another “bargain” that's too good to be true.

http://www.databreaches.net/?p=16196

Thousands of stolen iTunes accounts for sale in China

January 6, 2011 by admin

Tens of thousands of fraudulent iTunes accounts are for sale on a major Chinese website, it has been revealed.

Around 50,000 accounts linked to stolen credit cards are listed on auction site TaoBao, the country’s equivalent of eBay.

Buyers are promised temporary access to unlimited downloads from the service for as little as 1 yuan (10p) a time.

Apple, which recently stepped up iTunes’ security after a series of break-ins, declined to comment.

Thursday, January 06, 2011

Looking to 2011 – not a pretty picture.

http://www.phiprivacy.net/?p=5441

Experts Forecast Top Seven Trends in Healthcare Information Privacy for 2011

By Dissent, January 5, 2011

In today’s installment, we gaze into the crystal ball to see what 2011 might have in store for us:

What are the top security and privacy issues facing the healthcare industry in 2011? A panel of healthcare experts representing privacy, trends, technology, regulatory, data breach, and governance were asked to weigh in with their forecasts for 2011. These experts suggest that as health information exchanges take form, millions of patient records—soon to be available as digital files—will lead to potential unauthorized access, violation of new data breach laws and, more importantly, exposure to the threat of medical and financial identity theft.

These predictions are supported by the recent Ponemon Institute’s Benchmark Study on Patient Privacy and Data Security, published November 2010, which found that data breaches of patient information cost the healthcare industry $6 billion annually; protecting patient data is a low priority for hospitals; and the healthcare industry lags behind the recently enacted HITECH laws.

The top predictions for 2011 include:

Health information exchanges, many of which will be launched by inexperienced and understaffed organizations, will force more attention on security and privacy;
Increased fines and regulatory action by State Attorneys General and regulatory agencies;
Data breaches and associated costs will increase, as penalties for information security negligence are acted on;
Hospital governing-boards will exert their power to manage data breach risks in order to increase accountability and fiduciary responsibility;
A significant “data spill” is inevitable and will bring national attention to the issue;
Heightened patient awareness and concern over the security of their private medical data;
The finalization of data breach notification rules by the Department of Health and Human Services could remove the controversial “harm threshold” provision that determines whether notification is required when an incident occurs. If removed, this will create a risk of over notification and desensitization of patients. [Note from Dissent: it will create a risk of entities being embarrassed and patients leaving. I doubt if any patient would truly ignore a letter that provides sufficient details for them to determine whether they need to take action to protect their medical privacy.]

Industry-Wide Experts Share Their Opinions and Insight

Dr. Larry Ponemon, chairman and founder, Ponemon Institute; research experts in privacy, information security policy and information management

“Endemic failure to keep pace with best practices and advancing technology has resulted in antiquated data security, governance, policy plaguing in the healthcare industry. Millions of patients are at risk for medical and financial identity fraud due to inadequate information security. Information security in the healthcare industry is at the fulcrum of economic, technological, and regulatory influence and, to date, it has not demonstrated an ability to adapt to meet the resulting challenges—but it must. The reputation and well-being of those organizations upon which we rely to practice the healing arts depends on it.”

Dr. Deborah Peel, M.D., practicing physician and founder of Patient Privacy Rights; the nation’s health privacy watchdog

“2011 will be the year that Americans recognize they can’t control personal health information in health IT systems and data exchanges. Will 2011 be the year that data security and privacy are the top of the nation’s agenda? I hope so. The right to privacy is the essential right of individuals in vibrant Democracies. If we don’t do it right in healthcare, we won’t have any privacy in the Digital Age.”

Cliff Baker, managing partner for Meditology, a healthcare IT risk management and deployment services firm

“In 2011, we can expect that the Department of Health and Human Services Office for Civil Rights will be gearing up its proactive audits. Where does this leave OCR audits in 2011? They’re probably directed at those organizations that have breaches attributable to known and published high-risk areas. Look for those organizations to be dealing with OCR auditors camped out at their facilities in 2011.”

Ernie Hood, vice president and CIO, Group Health Cooperative; one of the nation’s largest consumer-governed health care systems

“The healthcare industry is on the verge of a major shift. Organizations are venturing into the electronic world for the first time as practices implementing electronic health records and states are launching health information exchanges. A surge of new data will be brought online by a lot of inexperienced organizations fueled by monetary government incentives. Mistakes are a certainty. Combine this with sophisticated approaches to identity theft by organized crime, and breaches will happen. When a breach occurs, the way the organization handles it publicly will be critical.”

Rick Kam, president and co-founder, ID Experts; comprehensive data breach solutions

“Health information exchanges will raise the awareness of security and privacy. I am seeing organizations shift their focus from implementation of electronic health records to a focus on the next phase of “meaningful use,” specifically how they are going to share patient records though health information exchanges. There will also be more concern over accountability if PHI is breached. How will a patient know who is responsible when a health information exchange has a data breach? Who will they hold accountable to fix the problem and for the financial, reputational, and other damage they experience? I think a lot of work needs to be done in this area and it will come into focus as a ‘must do’ initiative in 2011.”

Sandeep Tiwari, CEO, Zafesoft, Inc.; provider of information security and control software

“As healthcare information becomes more mobile, issues with security will only become increasingly complex. Healthcare is a mammoth space that changes and moves slowly, but when it does, it moves en masse. In the case of PHI/PII the laws were ahead of the technology. To date, there have been no secure audit trails, which impacts the effectiveness of the laws. If we can’t track how and when private and personal information is accessed, we will never secure it.”

Larry Walker, president of The Walker Company; governance consultant to health care organizations

“Patient health information data breaches are one of the most significant legal and public trust risks facing hospital governing boards, which are legally and ethically accountable for the results of a breach. The board of trustees has a fundamental fiduciary responsibility to ensure that patients’ health information is safe and secure at all times. To do this, boards must establish the prevention of data breaches as a critical organizational priority, ensure that financial resources sufficient to achieve the objective are made available, and require periodic updates from senior management on data breach risks and methods being utilized to close potential breach gaps. This should be one of the critical agenda items for hospital and health system boards in 2011.”

For more information, visit http://www.idexpertscorp.com/.

Looking back at 2010, hard to see what happened...

http://www.databreaches.net/?p=16165

Massachusetts Attorney General Reviews 2010 Data Breach and Data Security Regulations Compliance

January 5, 2011 by admin

Ellen M. Giblin writes:

With the first anniversary of the Massachusetts Data Security Regulations, 201 CMR 17 (pdf)(“Regulations”), coming in March, the International Association of Privacy Professionals (IAPP) recently hosted a panel discussion providing direct access to the Massachusetts Attorney General’s Office and the Office of Consumer Affairs and Business Regulation to discuss their investigations to date and their current approach to enforcement.

[...]

Scott Shafer opened with an overview of the enforcement actions to date and the daily reviews his office conducts. Shafer noted at the outset, the Attorney General’s (AG) current enforcement approach is not audit based due to insufficient resources. However, the AG is receiving a daily average of three to four data breach notifications pursuant to Massachusetts General Laws Ch. 93H (the “Notice Law”), and each breach report is closely reviewed.

Wednesday, January 05, 2011

Worth looking at their “guide”

http://www.pogowasright.org/?p=18901

DuckDuckGo Challenges Google On Privacy With DontTrack.us

January 4, 2011 by Dissent

Matt McGee writes:

DuckDuckGo, a small search engine that’s largely flown under the public radar, has started the new year by taking a public shot at Google on the issue of search privacy. The company has launched DontTrack.us, an illustrated guide showing how Google tracks its users … and how DuckDuckGo doesn’t.

The site:

shows how a search for “herpes” shows up in Google Analytics as a search referral with information about the user’s location, browser, and other data
shows how the “herpes” search can lead to targeted ads being associated with a user profile and how that profile can “potentially show up in unwanted places like insurance, credit & background checks”

Tuesday, January 04, 2011

Towards mandatory breach reporting?

http://www.databreaches.net/?p=16106

ITRC 2010 Breach Report

January 3, 2011 by admin

The Identity Theft Resource Center has issued its end of year press release. It includes some of the organization’s key findings and stresses the need for more information and mandated disclosures. Breach reports by sector can be found on their site as well as their chronology of the breaches they recorded for 2010:

The Identity Theft Resource Center recorded 662 breaches on its 2010 ITRC Breach List. It is apparent, with few exceptions, that there is no transparency when it comes to reporting breaches. Other than breaches reported by the media and a few progressive state websites, there is little or no information available on many data breach events. It is clear that without a mandatory national reporting requirement, that many data breaches will continue to be unreported, or under-reported.

Mandatory reporting has had a positive impact on the reported number of medical data breaches. First published this year, the Department of Health and Human Services (HHS) Breach List has identified 214 breaches to-date. Unfortunately, the HHS database provides insufficient information for the public to know what types of records were placed at risk. The HHS breach report does not detail whether names, x-rays or Social Security Numbers (SSN) were included in the exposed data. The public has no way of knowing just how minor or serious the data exposure was for any given incident. Media has helped by reporting more details for some breach events.

In addition, state mandated reporting of all breaches – by several state Attorneys Generals – increased public reporting, but only applies if an individual in that state might be affected. In 2010, New Hampshire listed 96 breaches and Maryland reported 160. Wisconsin and Vermont have small lists of reported breach events.

Approximately 200 breaches, 29% of the 662 total reported by the ITRC, were credited to information provided by these “mandatory reporting” states. This is a clear argument for mandatory reporting to achieve transparency for the public.

Highlights of the ITRC Breach List analysis include:

Paper breaches account for nearly 20% (1/5th) of known breaches and typically go unnoticed until a consumer reports the problem to local media. There is generally no mandatory reporting requirement for paper breaches.
Malicious attacks still account for more breaches than human error, with hacking at 17.1% and insider theft at 15.4%.
38.5% (255) of listed breaches did not identify the manner in which the information was exposed. This indicates a clear lack of transparency and full reporting to the public.
51% of publicly reported breaches indicated the number of records exposed, totaling 16.1 million records. Note: records can mean credit cards, bank accounts or other information. It is not representative of the number of people involved.
However, nearly half of all breaches (49%) did not list number of potentially exposed records. This ingrained inaccuracy in reporting is another argument for mandatory reporting.
412 breaches (62%) reported exposure of Social Security Numbers, representing 76% of known records.
170 breaches (26%) involved credit or debit cards, representing about 29% of known records.

The nation needs a centralized, publicly available, data breach reporting site. It should be comprehensive enough to allow readers to find out what happened, what information was compromised, and why the breach happened. This would also allow law enforcement to better address this type of crime.

Breaches happen. Consumers, government and the business community need to stop acting like ostriches with their heads in the sand. Second, the concept of “risk of harm” is not acceptable for determining notification. This is true especially if the company involved is allowed to define “risk of harm.” Only a federal IT forensic specialist should have that authority. Breached information has been used months after the original exposure.

Are breached entities going to like the future? ITRC hopes they will embrace the change as productive and valuable. Mandatory reporting is on the horizon. It will be demanded either by consumer lobbying or legislation.

For the reports and statistics used for this release, go to www.idtheftcenter.org

About the ITRC

The Identity Theft Resource Center(r) (ITRC) is a nationally recognized non-profit organization established to support victims of identity theft in resolving their cases, and to broaden public education and awareness in the understanding of identity theft. Visit www.idtheftcenter.org.

Victims may contact the ITRC at 888-400-5530.

“You can fool all of the people some of the time...”

http://www.networkworld.com/community/blog/espionage-spoofed-white-house-ecard

Espionage Via Spoofed White House eCard

When many people were caught up in the warm fuzzy feeling of peace on earth and goodwill toward man, it may have felt rewarding to receive a Christmas eCard from The White House. The bad news is that the spoofed whitehouse.gov seasons greetings contained malware aimed at espionage and sucked up several gigabytes of sensitive government documents. Some of the victims worked on cybersecurity as government employees and contractors.

… Regarding this Zeus banking Trojan variant, security blogger Mila Parkour wrote, it "appears to be designed for stealing documents as opposed to stealing passwords and banking information. This places this particular trojan in the category of malware designed for data theft and political/corporate espionage."

Any recipient who clicked on the links and opened the card.zip file were then infected with a Zeus Trojan variant that snatched documents and passwords and then uploaded the stolen data to a server in Belarus.

No need for concern. Everything is under control. These are not the droids you are looking for... I would imagine there are some Hotmail users who actually depend on this service. Perhaps now they will consider 'e-mail redundancy.'

http://www.theregister.co.uk/2011/01/04/microsoft_apologizes_empty_hotmail/

Microsoft 'sorry' as Hotmail bug hits 17,000

Microsoft has apologized, but not explained why nearly 20,000 Hotmail accounts were mysteriously emptied of their contents during the Christmas holiday.

Corporate vice president for Windows Live Chris Jones blogged on Monday that 17,355 Windows Live Hotmail accounts had lost all their email messages during the course of what he called "mailbox load balancing between servers."

Inboxes and folders starting emptying on December 30, with accounts appearing to be new and people receiving a "Welcome to Hotmail" email from Microsoft. Some affected accounts went back 10 years.

Users took to Hotmail forums pleading for Microsoft to restore their cherished accounts while other took to Facebook, launching a group to share their anguish and frustration with world+dog.

Jones responded on Monday to say that Microsoft had identified the problem by the evening of January 2 and that it had restored accounts – two days after messages went AWOL. He continued that Microsoft was sorry for the inconvenience to customers and partners.

… Further, Microsoft has been PR-ing people hard, trying to convince us that Hotmail is just one of a suite of services that the company can competently and reliably deliver in – where else? – the cloud.

In California you can probably be arrested for “failure to appreciate Avocados”

http://www.pogowasright.org/?p=18885

California Supreme Court: Court: No right to data privacy if you’re arrested

January 3, 2011 by Dissent

A significant ruling by the California Supreme Court is reported in the Central Valley Business Times today. The news story begins:

If you’re arrested in California, even for a traffic stop, police can rifle through the old text messages, photos, video and voice mail on your cell phone without a warrant, the state Supreme Court says.

It contends that a U.S. Supreme Court decision can be interpreted that there’s no violation of the Fourth Amendment if police comb through text messages without a warrant, if they’ve lawfully arrested you.

Centennial Man

Saturday, January 08, 2011

Friday, January 07, 2011

Thursday, January 06, 2011

Wednesday, January 05, 2011

Tuesday, January 04, 2011

Search This Blog

Followers

Blog Archive

Links

About Me