Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×
Security Medicine News

Backup Tapes With 2 Million Medical Records Stolen 173

Lucas123 writes "A vehicle used by an off-site archive company to transport patient data was broken into on March 17. The University of Miami just made the theft public last week, saying the thieves removed a transport case carrying the school's six computer backup tapes. On those tapes were more than 2 million medical records. In fact, the archive company waited 48 hours before notifying the university itself. A University spokeswoman said the school has stopped shipping backup tapes off-site for now."
This discussion has been archived. No new comments can be posted.

Backup Tapes With 2 Million Medical Records Stolen

Comments Filter:
  • Easy case (Score:3, Funny)

    by plover ( 150551 ) * on Saturday April 26, 2008 @12:58AM (#23205742) Homepage Journal
    This case should be pretty simple to solve. Just track down whoever buys a 9-track tape reader off eBay in the next month and nail him to the wall.
    • Why would someone steal the tapes? What is there value.
      • by Z00L00K ( 682162 )
        As usual - computers will be of value for anyone needing money for drugs. To a drug-addict that means that tapes must have some value too.
      • by Jhon ( 241832 ) * on Saturday April 26, 2008 @01:19AM (#23205806) Homepage Journal

        Why would someone steal the tapes? What is there value.


        What would YOU pay for 2 million social security numbers?
      • by WaltBusterkeys ( 1156557 ) * on Saturday April 26, 2008 @01:23AM (#23205818)

        Why would someone steal the tapes? What is there value.
        From TFA: The stolen backup tapes hold names, addresses, Social Security numbers and health information

        On the black market these days, a full identity (name, SSN, address, bank information, etc) can go for $14 each [washingtonpost.com]. If the tapes had full identities, that's 2 million x $14 = $28 million payday for a bunch of crooks. Even assume a "volume discount" for these guys and they're still in the many million dollar range. Even if it's just name, address, and SSN there's some value on the black market for these tapes.

        When you're breaking into a vehicle filled with stuff that looks like computer equipment, it's hard to know whether the data is going to be social security numbers (valuable), credit card numbers (valuable), medical records (valuable if there's addresses and SSNs), or routine corporate records (not all that valuable). Enough data brokers [reputation...erblog.com] are sloppy enough with their security that there's a good chance to get some identity information that has value.

        These guys were either extremely lucky or knew exactly what they were doing. Or they're complete idiots who are wondering why these tapes won't play on their 8-track player.
        • Re: (Score:2, Informative)

          Not to mention there is also the potential for blackmail. If anyone on the tapes has a serious, publically undisclosed, and socially stigmatic medical condition its ripe.

          For Example: Alot of people don't want to publically share that they have STDs etc. Especially not if the files are cross linked with a list of their sexual partners.

          While sale for identity fraud would most likely be the most profitable, there are alternative uses for this data. Given the enterprising nature of most criminals, this is

        • "On the black market these days, a full identity (name, SSN, address, bank information, etc) can go for $14 each."

          Good answer. Next question: Doesn't all modern tape backup software encrypt all data?

          Even my personal DVD backups are encrypted automatically.
        • Well after the "complete idiots" who stole the tapes read Slashdot, they know know they hit the jackpot.

          Gotta be a lot of retired mainframe guys around who would "do a consulting job".
        • I work for the University of Miami. These tapes will be entirely useless to anyone who snags them, and no, we haven't stopped off-site shipping. All of our off-site tapes are highly encrypted. We aren't idiots.
      • Among things mentioned by others, it enables you to blackmail people who have sensitive medical conditions they don't want the whole world knowing about.
      • More often than not, homeless people, and petty crooks just steal AYTHING out of cars hoping to get pennies on the dollar for whatever they stole. A nice looking, shiny case was probably thought to have some nice stuff in it, other than tapes. I bet the tapes are in some sewer drain or dumpster by now, and the case is being pawned for 5 dollars.
      • If I ran a medical insurance company, those tapes could let me know whose applications to deny and whose to accept. Very valuable indeed.
      • The last time I bought tapes (SDLT2 600GB tapes) they were $80 each. $80 x 6 = $480

        Beyond that, the value depends on how resourceful you are. If it were me (running across tapes..not stealing them) I'd spend some time getting to know the data involved. Then, I might start investigating parties who might be interested in that data.

        Your average car thief doesn't have the skills or the thousands of dollars of equipment necessary to really utilize that data.

        If I had to guess...the case was sold (if it was a
  • Hmm. (Score:5, Interesting)

    by Ethanol-fueled ( 1125189 ) * on Saturday April 26, 2008 @01:00AM (#23205748) Homepage Journal
    From TFA:

    After learning about the data breach, the university contacted local computer forensics companies to see if data on a similar set of backup tapes could be accessed. Menendez said security experts at Terremark Worldwide Inc. "tried for days" to decode the data but could not because of proprietary compression and encoding tools used to write data to the storage tapes.

    Proprietary compression and encoding tools? the article reeks of FUD but proprietary technologies still aren't without their faults...but eh, it's not like they used this "09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0" [wikipedia.org], right?
    • Re:Hmm. (Score:5, Funny)

      by Anonymous Coward on Saturday April 26, 2008 @01:05AM (#23205768)
      When questioned further, Terremark employees answered, "what's EBCDIC?"
    • Proprietary compressions and encodings: the poor man's encryption... Except that it costs a buttload
      • Encryption is never mentioned, and I believe if there had been any encryption that it certainly would have been, and that they would not even bother having someone try to decode data on a similar tape.
    • Physical Security: Lock the damn doors to the van when you leave it parked outside the Cheesy Burger.

      Multi key, multi volume encryption: Lock each of the tapes in a different cabinet in the van, each with a different key.

      Security through obscurity: Remove large sign on van reading "Secure Data Transport, 'Transporting your valuable data since 1991'" replace with "Flowers By Irene"

      Introduce comprehensive staff security training: Hold their families hostage, and tell them that if they lose the data

      • You're joking, right? These couriers probably visit over 100 different businesses each day loading up with boxes of tapes and printouts for storage and/or destruction. You can't possible think that the courier's driver, being paid a little over minimum wage; is going to take the time to sort out tapes and put them in different bins. They grab the boxes, throw them in the back of the van and move on to their next stop.

        The customer of said courier needs to make sure that sufficient encryption is in plac
  • by DigitAl56K ( 805623 ) on Saturday April 26, 2008 @01:23AM (#23205816)
    There needs to be a law regarding data encryption. Virtually every time data is stolen, be it on CDs, laptops, backup tapes, missing hard drives, and so forth, it is not encrypted. In fact, I can think of only one case that has made press in the last 4-5 years that I can remember encryption being used to safeguard the data.

    Transporting confidential data off-site via any medium, including the Internet, without industry-recognized encryption (not something that is proprietary and untested) ought to be a criminal offense with severe penalties.

    TFA talks about proprietary compression and encoding and not about encryption. I simply do not believe that it is difficult to recover that data - whatever proprietary software wrote those files can be obtained from somewhere for a price. You can probably Google the file extension or some information in the header to determine the format and/or software.

    "The university feels confident that the person who took [the tapes] doesn't know what they have."
    They do now!

    "Even though I am confident that our patients' data is safe, we felt that in the best interest of the physician-patient relationship we should be transparent in this matter."
    That data is not safe. At best it is in an obscure, but not secure format.

    It's incredible, really. Since TrueCrypt 5.0 arrived,I don't even carry my work laptop or flash drives around without either full disk encryption or encrypted container files on them, and they do not contain anything as sensitive as 2 million medical records.
    • by WaltBusterkeys ( 1156557 ) * on Saturday April 26, 2008 @01:50AM (#23205906)

      You can probably Google the file extension or some information in the header to determine the format and/or software.
      Not everything is on Google. If we're talking tapes, we're probably talking old mainframe-level systems. That means the problem might even be at the level of accessing the tape at all. The data coming off the tape is still just a string of ones and zeroes to them.

      This isn't a question where they've got a file sitting on their desktop called "Data.abx" and all they need to do is figure out what program creates an ".abx" file. In all likelihood, there's an old custom or semi-custom mainframe system that wrote this to the tape that didn't format in FAT32. (Nor would it make sense to even both with a filesystem on this type of backup system -- you're not backing up files, you're backing up a database.) From looking at a stream of data dump, there's no way to immediately make sense of it. If there's no file headers, there's not as much of a clue as to where to start. It just looks like an endless string of hex (2 million records is a lot of data).

      Somehow I doubt that this is just an Access file, sorry. Or even a SQL dump. They're not complete idiots.
      • Re: (Score:3, Informative)

        by Xtravar ( 725372 )

        Somehow I doubt that this is just an Access file, sorry. Or even a SQL dump. They're not complete idiots.
        Chances are, since it's a health system, it probably uses a post-relational database, typically of this variety: http://en.wikipedia.org/wiki/MUMPS [wikipedia.org]

        Which means the file format could be anything...

        I'm just glad they're not our customer. 8-)
      • Not everything is on Google. If we're talking tapes, we're probably talking old mainframe-level systems. That means the problem might even be at the level of accessing the tape at all. The data coming off the tape is still just a string of ones and zeroes to them.

        Actually, this is not rocket science.

        You could hook up/jerry rig any tape player that's remotely close to the backup tape in question, in terms of size and reading area of the magnetic head (the magnetic head could be bigger too), the rotation s

        • LTO4 includes on-tape encryption as part of the spec. These'll be modern tapes (which are still very much in use).
          Forget my previous post, if this university was located in my jurisdiction, it may not even be legally required to notify anyone about its loss (although, I couldn't be sure about that since I do not work in a Medical field). So please, someone chime in if you know about that.
          • Re: (Score:2, Insightful)

            I work for an insurance claims clearinghouse. The company I work for takes the HIPPA laws very seriously. One big mix up with patient data and no matter how good you are nobody will want to use you.

            2 million lost records is a lot, so just about any company would be compelled to own up to it...and they really aren't at risk here since they didn't knowingly or recklessly (geek level arguments about data transport aside) release the data.

            Since they didn't technically violate any HIPPA laws, I don't think that
          • HIPPA is the 800 lbs gorilla in healthcare IT and I believe that unauthorized release of identifiable medical data is a $50,000.00 fine; I'm not sure if losing backup tapes with 2 million records is one release or 2 million releases! I expect lawyers to get rich on this one when it goes class action, that's when everybody on the tapes will get notified.
            • HIPPA is the 800 lbs gorilla in healthcare IT and I believe that unauthorized release of identifiable medical data is a $50,000.00 fine; I'm not sure if losing backup tapes with 2 million records is one release or 2 million releases! I expect lawyers to get rich on this one when it goes class action, that's when everybody on the tapes will get notified.

              But that's the point, that tape they lost was encrypted (apparently to a high enough level). The contingency plan was this encryption. The system looks like

      • by asc99c ( 938635 )

        Lots of new mainframe level systems still use tapes. Many customers prefer tape drives for backup of any sensitive data - it means that you don't have to put the systems on the open internet to get offsite backups done. While tapes aren't the most robust medium for constant access, it's a very good format to write to and throw into a store room for backups.

        Remember also hardware-wise, tape is still a pretty interesting format. LTO [wikipedia.org] currently uses 800GB tapes with 1.6 and 3.2 TB versions planned. The 120M

      • by mwvdlee ( 775178 )

        If we're talking tapes, we're probably talking old mainframe-level systems.

        Tapes are still the norm for large-scale backup.
        Unless you still consider GB-sized files to be "large" ofcourse, in which case other technology might suffice.
      • Re: (Score:3, Funny)

        They're not complete idiots.
        Famous last words. :)

        Always assume the person is a complete idiot, unless proven otherwise.
      • They're not complete idiots.


        We believe they may be lacking some critical parts.
    • I knew that I would see a post saying something like this.

      Yes encryption is a great thing and should be used all the time, especially on laptops. Well actually, there is one time when it *shouldn't* be used (or at least, not automatically). Want to know when that is?

      For backups. Want to know the easiest way to render your carefully planned backup system useless? Forget the password for the system and not have another way in.

      Oh sure, they could just write down the password (which is a good option often), but
      • Re: (Score:3, Insightful)

        by jimicus ( 737525 )

        I knew that I would see a post saying something like this.

        Yes encryption is a great thing and should be used all the time, especially on laptops. Well actually, there is one time when it *shouldn't* be used (or at least, not automatically). Want to know when that is?

        For backups.

        THANK YOU. I'm glad I'm not the only person who thinks this.

        The backup software I use (http://www.bacula.org - a fantastic piece of work) does have the facility to encrypt everything.

        But I've considered the risk to the business in the event of tape loss versus the risk to the business in the event that we can't decrypt the data because for whatever reason the office has burnt to the ground and the offsite copies of the keys aren't recoverable.

        I concluded that if it's a choice between explaining a lost tap

        • Anybody who uses encryption wisely knows that they should guard the key with their life (not literally), not just from being stolen but also from being -lost-. That typically includes keeping a second set of the keys (protection against loss; unless both sites are hit at the same time) somewhere only you know about (protection from targeted theft) in a way that makes it nigh impossible to determine what they're for (protection from random theft); or just useless once realized they're compromised (change th
          • Photometer data, seismic measurements, tide levels, temperature logs, astronomical images, ephemeris data, past lotto numbers, emergency procedures, core sample measurements, and many others are all examples of things that shouldn't be encrypted. (and should probably be stored in plain ASCII delimited lists, uncompressed as well, if possible)

            Identifying information about real people does not fall on that list. It's not really *your* information to lose. It is far better that you should forget a key and h
        • Do you inform your customers that their data is shipped to remote sites unencrypted?

          Yes, failure to restore due to password loss is a risk, but then so is data escape.

          Having identified the password issue, you need to have a scheme to protect against password loss, particularly long-term backups. Just not encrypting replaces one problem with another.

        • by PapaZit ( 33585 )
          Consider the relative difficulty involved in sending an occasional tape to your offsite facility that's clearly labeled "backup decryption keys".

          You're using the same facilities that you trust for your other backups. Recovery is relatively straightforward. Only now, if a tape goes missing on its way to the facility, you don't have to worry as much.

          (Yeah, I know that some of you send a dozen tapes to different facilities guarded by warring factions of ninja assassins and you encrypt your encryption keys su
        • by firewood ( 41230 )
          Print the keys out on paper and stick them in a fire proof safe, taking copies to a bank vault far offsite well before shipping a set of backup tapes using that key. It's not like even a 4096 bit key takes more than a page.
      • You have a very good point. I would say that backups that stay in the data center and are just shelved back in your tape vault should *not* be encrypted. Backups that go outside the high-security area of your data center or pass into the hands of people who shouldn't be reading them (and your off-site storage people may be trusted to hold your backups, but they still have no business reading them) need to be encrypted.
      • by DarkOx ( 621550 )
        Not to mention anyone who has worked with tape knows its not usually the most reliable media. One of the main reasons your rotate through multiple backups is because you exepect unrecoverable CRC errors and like from tape. You go to your next oldest set and pull whatever file/files/database you could not get from the bad set of tapes and pull that from there. When you do major upgrades or equipment moves where the expectation of needing the backup go up good admins will want the prior two backups in the
    • by jabuzz ( 182671 )
      I would add to this that every enterprise backup system that I know of has had the ability to encrypt the backup for ages. It's number six on the Tao of Backup, and that is 11 years old.

      If the contents of your tapes are encrypted it matters not if they go missing.
    • I work for a health care organization. We ship our backups off-site just like these guys. When it comes to encrypting hard drives, what you say makes sense. When it comes to backup tapes, it's not going to happen. The main reason is that encryption is slow. If I have to restore 500 GB of data and decrypt it, suddenly you're telling physicians that they can't get to the patient information they need to treat the patient even later than before. If someone loses the encryption keys, the information patie
      • Re: (Score:3, Insightful)

        by ColdWetDog ( 752185 ) *
        Bah, I would disagree. And IAAP (I am a physician) - who has worked in IS intermittently for decades.

        First, if your recovering from an off site backup tape, something went down and it's going to take a while to get it running again. Decrypting can't add much more than 20 - 30% (number pulled from appropriate nether region) to the time. If it does you need to upgrade those C-64's you're using in the server room.

        Second, if the data is bulk stuff going off site, it's obviously not a primary rapid-respons

    • Ok, so, let's say you've got a regulatory requirement to keep certain records for a long time (medical records are a good example of this). And you've got to guarantee that you can recover them no matter what. Even if the hospital is reduced to a smoking crater, or the actual company that made the backup software (or encryption software) went out of business 20 years ago. You could have a problem with conflicting regulations. You also have to factor in everything that could go wrong with the encryption syst
    • All of the university machines have full drive encryption on them using, you guessed it, TrueCrypt. The drives will look like garbage to anyone who sees them.

      The data put on our tapes is fully encrypted, and on top of that encoded with wtfever our tape backup system uses.
  • Do not panic (Score:3, Insightful)

    by Psychotria ( 953670 ) on Saturday April 26, 2008 @01:29AM (#23205842)

    A University spokeswoman said the school has stopped shipping backup tapes off-site for now."
    Well, I am sure that makes everyone sleep a little easier tonight--it's obviously all under control.
    • Even better (Score:5, Insightful)

      by Psychotria ( 953670 ) on Saturday April 26, 2008 @01:45AM (#23205894)

      "The university feels confident that the person who took [the tapes] doesn't know what they have. Even if they do know what's contained inside, it's very difficult to extract that information," remarked Menendez.
      I am sorry Menendez, but difficult for who exactly. Your school is not unique, nor is it the pinnacle of knowledge (no school is). If we could decrypt things 50 years ago, how is a "compression" method hard to work out?
      • And if it's worth 20+ million (at $14 per identity * 2 million individuals), I'm sure they can rent the help of some black hats to help them decode a tape from a proprietary system.
  • by pclminion ( 145572 ) on Saturday April 26, 2008 @01:34AM (#23205854)
    The article is very careful to phrase it as "2 million medical records." I somehow doubt that this means the medical records of 2 million separate individuals -- if it did, surely the news outlet would have said so, as it is much more dramatic. I bet a "medical record" is a single row in the database, and what was really stolen was a DB with 2 million records (as in "rows") in it. I seriously doubt the medical records of 2 million people are all collected on a single set of tapes.
  • Old school (Score:4, Funny)

    by LoudMusic ( 199347 ) * on Saturday April 26, 2008 @01:57AM (#23205916)
    Tape is so last millennium. Anybody who's anybody backs up to hard drives across the internet.
  • Let's see here. Archive America waited 2 days. Then the university waited 27 more days. Who needs to do the most explaining?

  • Proprietary compression cannot be cracked? I can tell you that this can be hard to do. And this is from experience. I once worked at a company where a project one year involved writing some programs to extract data from files stored be various competitor products to enable customers to easily migrate to our products. I was given the one that the managers thought wasn't even possible to do, because the data look like gibberish (because, unknown to them at the time, it was compression). It took me FIVE w

    • by plantman-the-womb-st ( 776722 ) on Saturday April 26, 2008 @05:38AM (#23206368)
      Get your most closely kept personal thought:
      put it in the Word .doc with a password lock.
      Stock it deep in the .rar with extraction precluded
      by the ludicrous length and the strength of a reputedly
      dictionary-attack-proof string of characters
      (this, imperative to thwart all the disparagers
      of privacy: the NSA and Homeland S).
      You better PGP the .rar because so far they ain't impressed.
      You better take the .pgp and print the hex of it out,
      scan that into a TIFF. Then, if you seek redoubt
      for your data, scramble up the order of the pixels
      with a one-time pad that describes the fun time had by the thick-soled-
      boot-wearing stomper who danced to produce random
      claptrap, all the intervals in between which, set in tandem
      with the stomps themselves, begat a seed of math unguessable.
      Ain't no complaint about this cipher that's redressable!
      Best of all, your secret: nothing extant could extract it.
      By 2025 a children's Speak & Spell could crack it.

      You can't hide secrets from the future with math.
      You can try, but I bet that in the future they laugh
      at the half-assed schemes and algorithms amassed
      to enforce cryptographs in the past.
      • Correct Attribution:
        Artist: MC Frontalot
        Title: Secrets from the Future

        Full lyrics: here [actionext.com].

        Parent omits the second half of the song.
      • The math sayeth ; you are wrong.

        Mathematics are about the one part we can have certainty in.

        Nothing can crack a one-time pad ; not a real one with proper random numbers. Not even a quantum computer could do it.

        Other than that, a nice poem :-)
  • Hopefully people will use tape encryption now, it's been available for years. As I am afraid that tape is still the most efficient for moving large amounts of data. Also the tape encryption is uses very strong algorithms e.g. AES-256 etc.

    Some vendors like Sun and IBM give the key management stations away for free if you use encryption. People just do not understand how hi-tech tape is nowadays. Everyones perception of tape is old DAT, people need to look at Sun T10000, IBM TSxxxx or LT04. If you are

    • by Skapare ( 16644 )

      What we need to do is get a law passed that mandates strong encryption and proper key handling for all qualifying data (anything with personally identifying information, including SSN, bank account numbers, CC numbers, health information, etc), held by any entity (corporate, organizations, governments), that is transported, transferred, or exchanged offsite by any means (tapes, disks, internet, private data circuits). There should be a minimum violation penalty for cases where the data was not stolen or ta

    • Some vendors like Sun and IBM give the key management stations away for free if you use encryption

      Who gives them away for free? IBM, SUN, or HP?
      Enterprise grade encrypting tape drives cost as much as a SUV anyway, so I wouldn't think they're above this tactic, I just haven't heard of it.

      The cheap end, LTO4 encryption, is still way too new. Search the links for LTO... Give it a year or so before major backup software natively supports it well. If you just want your tape library managing the encryption keys, well, have at it I guess.
      IBM [ibm.com]
      SUN [sun.com]

      I think the best bet for cheap, solid tape encryption at the

  • "For now".

    I highly suspect this translates as "until we think people have forgotten about this". Why fix the problem when we can just pretend it's gone away?
  • It shouldn't be easy to steal these things. It's time valuable data is treated like it has value. That means armored vehicles for transport.

    Maybe they should list SSNs, Birthdays, and Addresses in the foreign exchange markets so people will get a clue.
  • It's going to keep happening. This sort of sloppy data handling is going to continue until there's proper incentive to protect data. And that means (IMHO) crippling penalties for those involved. Penalties so immense that the business nearly goes under. Penalties for the individuals who allowed unencrypted data to be put at risk - not just the peons swapping tapes, but the executives who didn't mandate/allow proper procedures. All the way up the food chain.

    This stuff has to be taken seriously, but right now
    • by SRA8 ( 859587 )
      If people cared enough, they would reach out to their lawmakers and have such a law passed. California's laws were a start, but we have a ways to go. I have reached out to my representatives, but clearly it isnt a priority for most, or we'd already have laws.
    • Why do you want to punish the underling who was ordered to transport something probably without even being told what it was or how important it was? This sort of thing is the job of an armored car. For wanting to punish the least responsible party involved, you are an asshole.
    • The Hospital hired an experienced, insured and bonded company specializing in document storage and retrieval services for the Medical Legal and Business comunities.
  • I wonder if the HIPPA compliance officer got canned. Why the hell wasn't this data encrypted?
  • Mr. Obvious asks:

    What does a University need with 2 Million medical records? Since when did patients agree that Universities could have a copy of their information?
  • Apparently not. Incompetents.
  • I've never been happier to be unable to afford to go to a doctor. :D

    Oh, fuck yes.

Genius is ten percent inspiration and fifty percent capital gains.

Working...