Peter A Clarke

Cnet in Hack of hospital chain leads to theft of up to 4.5M users’ data reports on a very significant breach of security affecting a Health group operating 206 hospitals.  The largest breach of hospital patient information since 2009, when the Government started tracking breaches.  The reported concern is that the suspected goal of the data breach is to facilitate future attacks using the data obtained, such as through personal information which can established identity.

The article provides:

One of the biggest hospital groups in the US revealed Monday that it suffered a monumental security breach, which possibly led to 4.5 million patients’ data being stolen, according to Reuters.

Community Health Systems, which oversees 206 hospitals in 29 states, said the stolen information includes Social Security numbers, patient names and addresses, telephone numbers, and birth dates, according to Reuters. This is the largest known attack to involve hospital patient information since the US government began tracking these types of data breaches in 2009.

“One possible goal of this attack is to facilitate future targeted attacks,” Elysium Digital data security expert Joseph Calandrino told CNET. “The type of data that was stolen from the hospital system is often used to verify a person’s identify. The exposure of this data creates a risk that the hackers could leverage it to gain access to other accounts and information.”

It’s believed the cyberattack originated in China, according to Reuters. Security firm Mandiant, which investigated the breach in April and June, said the hackers belong to a group that targets defense, engineering, financial services, and health care companies. It’s unclear if these hackers are affiliated with the Chinese government.

The cyberattack on Community Health Systems is just one of many over the past few months. Last December, retailer Target revealed 110 million people’s data was stolen in a breach, and retailers Neiman Marcus and Michaels Stores were also attacked around the same time. Earlier this month, cybersecurity firm Hold Security identified what is arguably the largest known data breach in history, in which a Russian cybergang allegedly stole 1.2 billion username and password combinations and more than 500 million email addresses.

Community Health Systems told Reuters it stopped the cyberattack by removing the malicious software used by the hackers. The hospital group is currently notifying its patients of the breach.

The story is also covered by Reuters in Community Health says data stolen in cyber attack from China which provides:

– Community Health Systems Inc (CYH.N), one of the biggest U.S. hospital groups, said on Monday it was the victim of a cyber attack from China, resulting in the theft of Social Security numbers and other personal data belonging to 4.5 million patients.

Security experts said the hacking group, known as “APT 18,” may have links to the Chinese government.

“APT 18” typically targets companies in the aerospace and defense, construction and engineering, technology, financial services and healthcare industry, said Charles Carmakal, managing director with FireEye Inc’s (FEYE.O) Mandiant forensics unit, which led the investigation of the attack on Community Health in April and June.

“They have fairly advanced techniques for breaking into organizations as well as maintaining access for fairly long periods of times without getting detected,” he said.

The information stolen from Community Health included patient names, addresses, birth dates, telephone numbers and Social Security numbers of people who were referred or received services from doctors affiliated with the hospital group in the last five years, the company said in a regulatory filing.

The stolen data did not include medical or clinical information, credit card numbers, or any intellectual property such as data on medical device development, said Community Health, which has 206 hospitals in 29 states.

The attack is the largest of its type involving patient information since a U.S. Department of Health and Human Services website started tracking such breaches in 2009. The previous record, an attack on a Montana Department of Public Health server, was disclosed in June and affected about 1 million people.

Chinese hacking groups are known for seeking intellectual property, such as product design, or information that might be of use in business or political negotiations.

Social Security numbers and other personal data are typically stolen by cybercriminals to sell on underground exchanges for use by others in identity theft.

Over the past six months Mandiant has seen a spike in cyber attacks on healthcare providers, although this was the first case it had seen in which a sophisticated Chinese group has stolen personal data, according to Carmakal. Mandiant monitors about 20 hacking groups in China.

NEW SCRUTINY

Cybersecurity has come under increased scrutiny at healthcare providers this year, both by law enforcement and attackers.

The FBI warned the industry in April that its protections were lax compared with other sectors, making it vulnerable to hackers looking for details that could be used to access bank accounts or obtain prescriptions.

Mandiant has tracked “APT 18” for four years. When asked if the hackers were linked to the Chinese government, Carmakal said it was “a possibility” but declined to elaborate.

Another cybersecurity firm, CrowdStrike, which has also been monitoring “APT 18” for about four years, said it believes the hackers are either backed by Beijing or work directly for the government, based on the targets they have chosen.

CrowdStrike Chief Technology Officer Dmitri Alperovitch said his firm has seen “APT 18” targeting human rights groups and chemical companies.

“They are of above average skill” among Chinese hackers, said Alperovitch, whose company dubbed the group “Dynamite Panda.”

The issue of Chinese state-sponsored hacking is highly sensitive. Tensions between Washington and Beijing have grown since May, when a U.S. grand jury indicted five Chinese military officers on charges they hacked into American companies for sensitive manufacturing secrets. China has denied the charges.

FBI spokesman Joshua Campbell said his agency was investigating the Community Health case, but declined to elaborate.

The Department of Homeland Security said it believed the incident was isolated, although it shared technical details about the attack with other healthcare providers. An agency official told Reuters it was too soon to say who was behind the attack.

Community Health said it has removed malicious software used by the attackers from its systems and completed other remediation steps. It is now notifying patients and regulatory agencies, as required by law.

The company said it is insured against such losses and does not at this time expect a material adverse effect on financial results. Community Health’s stock rose 66 cents, or 1.3 percent, to close at $51.66 on the New York Stock Exchange on Monday.