Backup Tapes With 2 Million Medical Records Stolen 173
Lucas123 writes "A vehicle used by an off-site archive company to transport patient data was broken into on March 17. The University of Miami just made the theft public last week, saying the thieves removed a transport case carrying the school's six computer backup tapes. On those tapes were more than 2 million medical records. In fact, the archive company waited 48 hours before notifying the university itself. A University spokeswoman said the school has stopped shipping backup tapes off-site for now."
Easy case (Score:3, Funny)
yes but what's the value (Score:1)
Re: (Score:1)
Re:yes but what's the value (Score:4, Informative)
What would YOU pay for 2 million social security numbers?
Re: (Score:2)
Re:yes but what's the value (Score:5, Informative)
On the black market these days, a full identity (name, SSN, address, bank information, etc) can go for $14 each [washingtonpost.com]. If the tapes had full identities, that's 2 million x $14 = $28 million payday for a bunch of crooks. Even assume a "volume discount" for these guys and they're still in the many million dollar range. Even if it's just name, address, and SSN there's some value on the black market for these tapes.
When you're breaking into a vehicle filled with stuff that looks like computer equipment, it's hard to know whether the data is going to be social security numbers (valuable), credit card numbers (valuable), medical records (valuable if there's addresses and SSNs), or routine corporate records (not all that valuable). Enough data brokers [reputation...erblog.com] are sloppy enough with their security that there's a good chance to get some identity information that has value.
These guys were either extremely lucky or knew exactly what they were doing. Or they're complete idiots who are wondering why these tapes won't play on their 8-track player.
Re: (Score:2, Informative)
For Example: Alot of people don't want to publically share that they have STDs etc. Especially not if the files are cross linked with a list of their sexual partners.
While sale for identity fraud would most likely be the most profitable, there are alternative uses for this data. Given the enterprising nature of most criminals, this is
Doesn't modern tape backup software encrypt data? (Score:3, Insightful)
Good answer. Next question: Doesn't all modern tape backup software encrypt all data?
Even my personal DVD backups are encrypted automatically.
Re:Doesn't modern tape backup software encrypt dat (Score:2)
HTH, HAND :)
Seriously though, there's overhead and hassle involved with encrypted backups. The value of a backup is greatly diminished if you can't restore it.
Re: (Score:2)
Gotta be a lot of retired mainframe guys around who would "do a consulting job".
Yeah, but ... (Score:4, Funny)
Re: (Score:2)
TFA does NOT say they were encrypted (Score:3, Interesting)
There's nothing in the article that says they were encrypted. They were compressed and some kind of encoding was involved. But encoding could be any number of things, and quite possibly the coding used by medical records systems to compact common terms to numbers. It could be hard to make use of the data. But if it was an "inside job", or the perps can get the software used on this, it can be cracked easily. This is not strong encryption.
Re: (Score:2)
And yes, we do recall random tapes to ensure that we can restore from the encrypted volumes.
In this day and age of "Information Warfare" you should consider every system for moving data vulnerable and take measures to ensure that attempting to steal that data would be more work than what it's worth.
Re: (Score:3, Insightful)
In the case of physically moving backup high-value drives/tapes to off-site storage, that would mean an armored courier. That data is money to somebody, so protect it like money. Sure it's more expensive that the local Speedy Messenger cargo van, but so is losing control of the data.
Re: (Score:2)
Re: (Score:3, Insightful)
Another example: If you have a database, it is sufficient to only protect/encrypt one of the (i think it's five) identifiers to be
Re: (Score:2)
Crooks hoping for physical, got useless tapes (Score:3, Interesting)
pretty valuable for cherry-picking risk pools (Score:2, Insightful)
Re: (Score:2)
Beyond that, the value depends on how resourceful you are. If it were me (running across tapes..not stealing them) I'd spend some time getting to know the data involved. Then, I might start investigating parties who might be interested in that data.
Your average car thief doesn't have the skills or the thousands of dollars of equipment necessary to really utilize that data.
If I had to guess...the case was sold (if it was a
Hmm. (Score:5, Interesting)
After learning about the data breach, the university contacted local computer forensics companies to see if data on a similar set of backup tapes could be accessed. Menendez said security experts at Terremark Worldwide Inc. "tried for days" to decode the data but could not because of proprietary compression and encoding tools used to write data to the storage tapes.
Proprietary compression and encoding tools? the article reeks of FUD but proprietary technologies still aren't without their faults...but eh, it's not like they used this "09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0" [wikipedia.org], right?
Re:Hmm. (Score:5, Funny)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
"IT Security has been asked that all departments and schools verify that all backup tapes being sent offsite are encrypted. Tapes being kept within the University must be stored in a secure location, if they are not encrypted. If any unencrypted tapes have been sent offsite, please contact IT Security or myself."
I've said it twice now, just figure I'll reply to people here. TFA is incorrect, our tapes are encrypted, not encoded.
My new data security plan. (Score:2, Insightful)
Multi key, multi volume encryption: Lock each of the tapes in a different cabinet in the van, each with a different key.
Security through obscurity: Remove large sign on van reading "Secure Data Transport, 'Transporting your valuable data since 1991'" replace with "Flowers By Irene"
Introduce comprehensive staff security training: Hold their families hostage, and tell them that if they lose the data
Re: (Score:2)
The customer of said courier needs to make sure that sufficient encryption is in plac
*Still* no encryption?? (Score:5, Insightful)
Transporting confidential data off-site via any medium, including the Internet, without industry-recognized encryption (not something that is proprietary and untested) ought to be a criminal offense with severe penalties.
TFA talks about proprietary compression and encoding and not about encryption. I simply do not believe that it is difficult to recover that data - whatever proprietary software wrote those files can be obtained from somewhere for a price. You can probably Google the file extension or some information in the header to determine the format and/or software.
It's incredible, really. Since TrueCrypt 5.0 arrived,I don't even carry my work laptop or flash drives around without either full disk encryption or encrypted container files on them, and they do not contain anything as sensitive as 2 million medical records.
Re:*Still* no encryption?? (Score:5, Interesting)
This isn't a question where they've got a file sitting on their desktop called "Data.abx" and all they need to do is figure out what program creates an ".abx" file. In all likelihood, there's an old custom or semi-custom mainframe system that wrote this to the tape that didn't format in FAT32. (Nor would it make sense to even both with a filesystem on this type of backup system -- you're not backing up files, you're backing up a database.) From looking at a stream of data dump, there's no way to immediately make sense of it. If there's no file headers, there's not as much of a clue as to where to start. It just looks like an endless string of hex (2 million records is a lot of data).
Somehow I doubt that this is just an Access file, sorry. Or even a SQL dump. They're not complete idiots.
Re: (Score:3, Informative)
Which means the file format could be anything...
I'm just glad they're not our customer. 8-)
Re: (Score:2)
Actually, this is not rocket science.
You could hook up/jerry rig any tape player that's remotely close to the backup tape in question, in terms of size and reading area of the magnetic head (the magnetic head could be bigger too), the rotation s
Re: (Score:2)
Re: (Score:2, Insightful)
2 million lost records is a lot, so just about any company would be compelled to own up to it...and they really aren't at risk here since they didn't knowingly or recklessly (geek level arguments about data transport aside) release the data.
Since they didn't technically violate any HIPPA laws, I don't think that
Re: (Score:2)
Re: (Score:2)
But that's the point, that tape they lost was encrypted (apparently to a high enough level). The contingency plan was this encryption. The system looks like
Re: (Score:2)
Lots of new mainframe level systems still use tapes. Many customers prefer tape drives for backup of any sensitive data - it means that you don't have to put the systems on the open internet to get offsite backups done. While tapes aren't the most robust medium for constant access, it's a very good format to write to and throw into a store room for backups.
Remember also hardware-wise, tape is still a pretty interesting format. LTO [wikipedia.org] currently uses 800GB tapes with 1.6 and 3.2 TB versions planned. The 120M
Re: (Score:2)
Tapes are still the norm for large-scale backup.
Unless you still consider GB-sized files to be "large" ofcourse, in which case other technology might suffice.
Re: (Score:3, Funny)
Always assume the person is a complete idiot, unless proven otherwise.
Re: (Score:2)
We believe they may be lacking some critical parts.
Re:*Still* no encryption?? (Score:5, Informative)
1. It works.
2. IBM (assuming they are using IBM kit) mainframes are still being built today, and while they're totally different internally to the systems of 30 years ago, they're still compatible.
3. This is what companies like SunGard and IBM (yes, they have a DR consultancy team) specialise in. You tell them what equipment you'll need in a disaster recovery scenario, they agree to loan it to you. In which case, who cares how old the system is?
Re: (Score:2)
Nobody uses 9" real to real tapes these days.
Re: (Score:2)
Yes encryption is a great thing and should be used all the time, especially on laptops. Well actually, there is one time when it *shouldn't* be used (or at least, not automatically). Want to know when that is?
For backups. Want to know the easiest way to render your carefully planned backup system useless? Forget the password for the system and not have another way in.
Oh sure, they could just write down the password (which is a good option often), but
Re: (Score:3, Insightful)
I knew that I would see a post saying something like this.
Yes encryption is a great thing and should be used all the time, especially on laptops. Well actually, there is one time when it *shouldn't* be used (or at least, not automatically). Want to know when that is?
For backups.
THANK YOU. I'm glad I'm not the only person who thinks this.
The backup software I use (http://www.bacula.org - a fantastic piece of work) does have the facility to encrypt everything.
But I've considered the risk to the business in the event of tape loss versus the risk to the business in the event that we can't decrypt the data because for whatever reason the office has burnt to the ground and the offsite copies of the keys aren't recoverable.
I concluded that if it's a choice between explaining a lost tap
You keep your backups safe - why not your keys? (Score:2)
Re: (Score:2)
Identifying information about real people does not fall on that list. It's not really *your* information to lose. It is far better that you should forget a key and h
Re: (Score:2)
Do you inform your customers that their data is shipped to remote sites unencrypted?
Yes, failure to restore due to password loss is a risk, but then so is data escape.
Having identified the password issue, you need to have a scheme to protect against password loss, particularly long-term backups. Just not encrypting replaces one problem with another.
Re: (Score:2)
You're using the same facilities that you trust for your other backups. Recovery is relatively straightforward. Only now, if a tape goes missing on its way to the facility, you don't have to worry as much.
(Yeah, I know that some of you send a dozen tapes to different facilities guarded by warring factions of ninja assassins and you encrypt your encryption keys su
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
If the contents of your tapes are encrypted it matters not if they go missing.
Relative Risk (Score:2)
Re: (Score:3, Insightful)
First, if your recovering from an off site backup tape, something went down and it's going to take a while to get it running again. Decrypting can't add much more than 20 - 30% (number pulled from appropriate nether region) to the time. If it does you need to upgrade those C-64's you're using in the server room.
Second, if the data is bulk stuff going off site, it's obviously not a primary rapid-respons
Re: (Score:2)
Re: (Score:2)
The data put on our tapes is fully encrypted, and on top of that encoded with wtfever our tape backup system uses.
Do not panic (Score:3, Insightful)
Even better (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
2 million records, or people? (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Old school (Score:4, Funny)
Re: (Score:2)
Who waited how long? (Score:2)
Let's see here. Archive America waited 2 days. Then the university waited 27 more days. Who needs to do the most explaining?
Proprietary compression? (Score:2)
Proprietary compression cannot be cracked? I can tell you that this can be hard to do. And this is from experience. I once worked at a company where a project one year involved writing some programs to extract data from files stored be various competitor products to enable customers to easily migrate to our products. I was given the one that the managers thought wasn't even possible to do, because the data look like gibberish (because, unknown to them at the time, it was compression). It took me FIVE w
In 2025 those will still be valid SS numbers (Score:5, Insightful)
put it in the Word
Stock it deep in the
by the ludicrous length and the strength of a reputedly
dictionary-attack-proof string of characters
(this, imperative to thwart all the disparagers
of privacy: the NSA and Homeland S).
You better PGP the
You better take the
scan that into a TIFF. Then, if you seek redoubt
for your data, scramble up the order of the pixels
with a one-time pad that describes the fun time had by the thick-soled-
boot-wearing stomper who danced to produce random
claptrap, all the intervals in between which, set in tandem
with the stomps themselves, begat a seed of math unguessable.
Ain't no complaint about this cipher that's redressable!
Best of all, your secret: nothing extant could extract it.
By 2025 a children's Speak & Spell could crack it.
You can't hide secrets from the future with math.
You can try, but I bet that in the future they laugh
at the half-assed schemes and algorithms amassed
to enforce cryptographs in the past.
Re: (Score:2)
Artist: MC Frontalot
Title: Secrets from the Future
Full lyrics: here [actionext.com].
Parent omits the second half of the song.
Re: (Score:2)
Mathematics are about the one part we can have certainty in.
Nothing can crack a one-time pad ; not a real one with proper random numbers. Not even a quantum computer could do it.
Other than that, a nice poem
Re: (Score:2)
Tape encryption is avaliable for all, use it. (Score:2, Interesting)
Some vendors like Sun and IBM give the key management stations away for free if you use encryption. People just do not understand how hi-tech tape is nowadays. Everyones perception of tape is old DAT, people need to look at Sun T10000, IBM TSxxxx or LT04. If you are
Re: (Score:2)
What we need to do is get a law passed that mandates strong encryption and proper key handling for all qualifying data (anything with personally identifying information, including SSN, bank account numbers, CC numbers, health information, etc), held by any entity (corporate, organizations, governments), that is transported, transferred, or exchanged offsite by any means (tapes, disks, internet, private data circuits). There should be a minimum violation penalty for cases where the data was not stolen or ta
Re: (Score:2)
Alternatively, how do you fine the employees of a government agency if there aren't any, because no one was crazy enough to expose themselves to getting fined while working at government rates?
Person for the Distant Early Warning Station 150 Km north of Where-Polar-Bears-Shit-On-Ice, Canada for a nice stable 3 year tour of duty.
Re: (Score:2)
Some vendors like Sun and IBM give the key management stations away for free if you use encryption
Who gives them away for free? IBM, SUN, or HP?
Enterprise grade encrypting tape drives cost as much as a SUV anyway, so I wouldn't think they're above this tactic, I just haven't heard of it.
The cheap end, LTO4 encryption, is still way too new. Search the links for LTO... Give it a year or so before major backup software natively supports it well. If you just want your tape library managing the encryption keys, well, have at it I guess.
IBM [ibm.com]
SUN [sun.com]
I think the best bet for cheap, solid tape encryption at the
Read the important words (Score:2)
I highly suspect this translates as "until we think people have forgotten about this". Why fix the problem when we can just pretend it's gone away?
Time for Brinks (Score:2)
Maybe they should list SSNs, Birthdays, and Addresses in the foreign exchange markets so people will get a clue.
How many times does it have to happen? (Score:2)
This stuff has to be taken seriously, but right now
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Totally unnecessary (Score:2)
Why Uni need 2 Million medical records in 1st pl.? (Score:2)
What does a University need with 2 Million medical records? Since when did patients agree that Universities could have a copy of their information?
Re:Why Uni need 2 Million medical records in 1st p (Score:2)
Ever heard of encryption? (Score:2)
I've never been happier... (Score:2)
Oh, fuck yes.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
It might be that the armored car companies don't want to increase the profile of their trucks that much. The security is designed to make attacks more costly than the contents, which is defeated by transporting things of too significant a value.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Has nothing to do with medical staff (Score:2, Insightful)
Medical staff and any other people untrained in information security just aren't going to have the computer literacy or "computer common sense" to handle millions of peoples' medical records adequately.
But it's all in the name of tracking your every move, so I guess it's OK.
Your network should be secure (they don't set that up)
The software they use should be secure (they didn't write it)
The method you use to transmit your claims should be secure (they don't set that up)
All you have to tell them is "don't email claim/medical record files" I have taught literally hundreds and hundreds of shockingly stupid people (the people at your doctor's office or the hospital that do the billing are almost certainly the lowest paid people in the chain...in the ballpark of minimum wage) how
Re: (Score:2)
As far
Re: (Score:2)
Re: (Score:2)
3 years statute of limitations of litigations, (Malpractice),
7 years statute of limitation for tax liability (IRS and dentists get audited a lot),
30 years for OSHA and some FDA required records for medical devices (Dental implants and sleep apnea and anti-snoring devices and anything of foreign origin); so the ADA just recommends 30 years for everything.
Re: (Score:2)
The tapes come up missing. Employee A is fired, jailed, and probably sued for everything he's worth as he only has $20 an hour or so for the past 5 years to hire a lawyer with. Supervisor A is fired, Manager A might be fired too..because they both knew about it. People
Re: (Score:2)
qz
Re: (Score:2)
qz