The email and home addresses of around 650,000 fashion shoppers were stolen following a security breach at e- commerce platform provider Fashion Nexus. The data breach allowed hackers to access customer details from fashion brands including Elle Belle Attire, AX Paris and Traffic People. Online fashion retailers Perfect Handbags and DLSB were also believed to be affected. Fashion Nexus said that on or around 9 July a “white hat hacker” or “ethical hacker” breached one of the company’s web servers
Presented on oct 2018, Repercussions-75k victims facing data breaches on center for
medicare and medical services, website-www.healthcare.gov
An official post from an anonymous site confirmed that about 75,000 user’s data from
Healthcare.gov service was hijacked by an obscure group of cyber-criminals. “Obamacare” – An
medical healthcare plan is a federally facilitated exchanges used by the healthcare agents and
brokers which has been uploaded in the site.On Saturday, a peculiar framework was announced by
the centers for medical and medicaid services (CMS) which provoked the executives to arouse a
warning and for an investigation inception, after a strange system activity detection in the FFE, said
by the CMS on October 13, 2018.The CMS said in a press release that the associated ones with the
anomalous activity were deactivated and due to surplus caution, the direct enrollment pathway for
the agents were disabled.Notions for replenishing and re-enabling FFE direct enrollment for agents
and brokers within the week are in the process - says Government agency. Obamacare health care
plans can still be enrolled by the U.S citizens through Healthcare.gov portal platform or the
Marketplace Call Center.
people who serve the Internet resources of companies make stupid mistakes. The reasons behind data leakage are Unprofessionalism and incompetence of IT professionals and the attempts of companies to save money. How can it be dangerous? For example, a person buys a train ticket with a departure date in six months. He receives an SMS with a link to his personal account to view and edit information. At the same time, "Yandex. Browser", Android or metric counter tells the search engine that a previously unknown page has appeared. The search engine sees that the page is working and indexes it. Hackers who do searches related to train ticket booking gets the data and access the user's personal account.
Reported on oct 2018, Repercussions- 72 HealthHub accounts suspected hacked, website- www.healthhub.com Singapore natives use HealthHub –An one stop portal and mobile application for accessing a wide range of health content, honours and E-services. On Sept 28th, Oct 3rd, Oct 8th and on Oct 9th, the agencies had detected the presence of more than usual attempted logins to the Healthhub portal through the usage of more than 27,000 unique ID’s or email addresses with 98% of the email address proving irrelevant to the current HealthHub accounts and the persuaded log-in attempts garnering failure. The successfully logged 72 accounts were subsequently locked and the HPB had intimidated the account holders of suspicious activity detection and to verify and inform if any of them had made the attempts of their own. Within the next few moments, the HPB were informed about a call from a suspected user claiming that her email ID had gone haywire by a person whom without authentication had logged into a portal. The agency later announced that no sign or gesture of a breach in a HealthHub system was sensed.
On November 6th 2018, a total of 4.4 million patient records were compromised from 117 health data sectors, with the patient record numbers in 2018 increasing by whopping numbers from 4,597 to 2909,689 due to the apathy of insiders, reports Protenus. More than 50% of those hacks were due to hacking and 23% from insiders incidents, due to lethargy. Healthcare providers have also experienced breaches from 3rd parties accounting to 1.34 million breached records.Of the 117 health data breaches, 86 were disclosed by healthcare providers with 13 by health plan, 13 by disclosure from business associates and 5 being disclosed by business or other organizations. This incident exhausted 402 days to get disclosed. Virginia based VCU health systems breach took 5,605 days to be discovered with reason citing to be the easy access towards health information which encompassed names, DO’s, medical record numbers and much more. When subjected towards states, Florida, California and Texas were leading as the distinct scapegoats of indistinct Data breaches.These breaches will be proliferating, unless the Healthcare organizations leverages contemporary technology services that enables in effectively auditing every patients data.
Legacy Health submitted a HIPAA Email Breach to the U.S. Department of Health and Human Services (HHS). In the health system, there are 38,000 legacy health patients' personal, medical and billing information might have been accessed in “Email breach”.The Portland-based non-profit health system said someone accessed multiple employees' email accounts, some of which contained patient information. Legacy, which operates 6 hospitals and 70 clinics in Oregon and southwest Washington, said Not all of the system’s patients are affected by the breach. It also said it’s implementing new policies to prevent future breaches.
Presented on oct 2018, Repercussions-10000 files exposed in online on amazon s3 buckets,website-docs.aws.amazon.com Security researcher Britton White intimidated Databreaches.net and discovered that North Carolina based tech vendor Medcall is disclosing protected patient data through Amazon S3 bucket 2 times in a month by leaving a storage bucket containing 10,000 files exposed in the internet available for downloading, deleting and for editing, with later confirming it. The databases which included few patient names, email and postal addresses, phone numbers, dates of birth and social security numbers with other files holding the records of patient evaluations and conversations with doctors, their medications, allergies and other brief personal data issues were listed on grayhatwarfare.com. An searchable tool, which overtly lists the current open Amazon S3 buckets. To intensify the shame, this isn’t the 1st time this database is exposed. It’s the2nd!!!
Norwood, MA-based Reliable Respiratory has discovered a hacker hasgained access to the email account of its employee and potentiallyaccessed the protected some of the health information of patients. Thirdparty security consultants were called in to investigate the phishing attackand to determine the extent of the breach. The company confirmed thatthe account had been compromised between June 28 and July 2. The typesof information exposed differed per individual but may have includedname, medical diagnoses, treatment information, medication/prescriptioninformation, medical record number, health insurance information, bankor financial account information, driver’s license or state identificationnumber, Social Security number, claims/billing information, date of birth,credit or debit card information, username and password, and passportnumber. Reliable Respiratory has implemented security controls to preventphishing and other cyber attacks
Air Canada says personal information of 20,000 of its mobile app users may have been affected by a data breach. In a news release, the airline explained that it noticed “unusual login activity” between Aug. 22-24. All users of the app — about 1.7 million customers — have been locked out of their accounts until they update their passwords. Users have also been emailed instructions on how to log in to the app and change passwords. The app stores names and contact information, which may have been accessed.
Hackers stole more than 50% of patients records among the 80% of unauthorized disclosure from 1,138 health care data breaches from 2009 to 2017, with half of breaches reported due to the firm’s own mistake, according to a new JAMA Internal Medicine report. Researchers from Michigan State University and Johns Hopkins Carey Business school demystified that 2/3rd of security breaches from 133.8 million records were caused due to theft (or) from someone outside the organization. Researcher say that Healthcare entities must manage their plans in their security execution.Most corrective plans like encryption and restriction of mobile devices, enhancing physical security and digitizing PHI were strengthened. For those occurred in the cloud, remediation’s like better monitoring, audit access and strengthening the firewalls were implemented. "Cyber security will have the greatest impact on the healthcare sector”, reports JAMA with survey from 44 executives from 38 distinct health systems.Organizations flaunt in spending towards defending cyber attacks with survey. Survey says that employees apathy are the 62% reasons for biggest potential vulnerability, Nevertheless still employee awareness given the least precedence. Another survey indicates that 75% of hospital administrators were victimized by cyber attacks.The deal is not to seal with an impenetrable security but ensuring the implemented quality is extremely difficult to be
broken.
Reported on oct 2018, Impact - 21000 patients details leaked on Minnesota
Department of Human Services, website-https://mn.gov/dhs/
Mail accounts of two DHS employees which comprised of names, addresses, telephone numbers,
birth dates, social security numbers, educational records, medical information, employment and
financial information, were confirmed to be breached by the investigation panel after the
personnel’s clicked on malicious links which were triumphantly conjured by the hackers through
phishing. Ongoing investigation of other employees mail id’s being compromised are yet to be
disclosed by the Minnesota DHS, with contingencies oscillating towards the “YES” side. The IT
department confirmed the breaches only on August with the incident happening at the time of 28th
and 9th of June and July 2018, respectively. Post the discovery of phishing attacks, both accounts
were secured for paving further access to other data’s. Immediate actions for securing these
accounts were facilitated with “Blanked out scenario” prevailing on the verdict of Data being
viewed, downloaded or in being misused.
A data breach notification service called Leak Base obtained a copy of the database and – upon analysis – found that it contained a total of 28,722,877 records including usernames, hashed credentials and personal email addresses. The Taringa website claimed to have 28,511,984 registered users. Passwords were reportedly encrypted with MD5, an algorithm long-known to be vulnerable to attack. LeakBase, which charges customers fort to check if their details are included in hacked databases, claimed that it had already cracked 26,939,351 (93.79%) of the passwords in the trove.T here were, the service claimed, a total of 15 million unique credentials included in the database. Impacted Taringa users confirmed the records were linked to personal profiles, A notification posted to the Taringa website claimed the incident took place on 1 August 2017, They suffered an external attack that compromised the security of our databases and the code of Taringa." It said there was no evidence that the hackers still had access to servers.
A phishing attack aimed at the email accounts of 24 university faculty and administrators at Augusta University Health led to the exposure of medical and personal information on about 417,000 individuals. The hackers solicited usernames and passwords, giving them access to a number of internal email accounts for a small percentage of patients, Social Security and driver’s license numbers were included. Notifications will be sent to impacted patients in the coming weeks and will include one year of free credit monitoring. The health system also implemented software to screen emails for protected health or other personal data to prevent a similar incident in the future. Officials said they’ve also increased security training and enhanced compliance-related policies.
In November 20 2018, a second breach on Health Equity post their first breach in June was reported with compromises of 190,000 customers data, after an unauthorized user exploited two employee accounts.In an email to the HealthITSecurity.com, sophisticated methods such as bypassing the multi-factor and device authentication were used for exploitation by hackers, reports officials. After detecting the attacks within hours, measures like passwords resetting, error correction and hiring forensics firm were levied as a proactive approach for protecting personal members information before the devil (hacks) strikes. The breached email accounts encompassed data’s like names, health savings plan, social security numbers and much more. Databreaches.net obtained four different versions of notification letters from the Californian individuals. The 1st version reached 3700 Californians for notifying the breached social security number. The 2nd version reached 6000 Californians for notifying the breached employee names. In-spite of the Healthcare organizations providing a year of free credit monitoring, identity theft protection and $1 million insurance reimbursement policy. Health Equity President and CEO Jon Kessler apologized for this incident and we are working hard to make it right. As an Ulterior approach towards security, Health Equity has adopted best measures for preventing hacks, implementing security measures and is actively monitoring for suspicious detection.
Presented on oct 2018, Repercussions-37k patients detailed leaked on gold coast
health plan , website-https://m.goldcoasthealthplan.org/
About 37,000 patients data’s under the California-based Gold Coast Health Plan which included
member names, health plan identification numbers, dates of medical services, dates of birth and
medical procedures, were breached through a phishing attack which was executed by hackers
when an email account of an employee was compromised from mid-June till August dawn. This
information went inebriated in surface after being discovered by the Gold coast officials on Aug
8th, due to which unauthorized access was halted on the same day with law enforcement and cyber
forensics being contacted for ulterior investigation. After scrutiny, it was revealed that hackers have
illegitimately persuaded in transferring the funds of Gold coast health Plan into their account. After
this official verdict, the victims were cautioned to monitor the medical bills on their credit
reports for anomalous detection. Since then, hazards of phishing attacks have been imparted with
heightened security monitoring kind of method being levied for obstruction of unauthorized access
and for the enhancement of security perimeter
Reddit announced that it suffered a security breach in June that exposed some of its users' data, including their current email addresses and an old 2007 database backup containing usernames and hashed passwords. hacker(s) managed to gain read-only access to some of its systems that contained its users' backup data, source code, internal logs, and other files. The hack was accomplished by intercepting SMS messages that were meant to reach Reddit employees with one-time passcodes, eventually circumventing the two-factor authentication (2FA).
A transcriptionist vendor for Orlando Orthopaedic Center made an error during a software upgrade in dec 2017. But in the process, the server was left open to the public and allowed access without authentication. they became aware of the breach in February 2018. The investigation revealed patient names, dates of birth, insurance details, employers and medical treatment were all included in the exposed data. Social Security numbers were breached for a “limited number of patients.” Officials could not rule out theft or unauthorized access. The HHS Office of Civil Rights takes delayed notification very seriously. Presence Health was hit with a $475,000 fine in January 2017 for waiting about 100 days to report a breach. The fine is pretty severe, given Presence was just 40 days late.
Being ignorant of physical data’s disclosure could steer health care organizations to risk, In-spite of the various legacy devices often being used by them with more than 75% of healthcare communications being processed by outdated machines in healthcare sector, despite the prevalence of advanced technologies is truly, berserk and contemptible. Post the discovery of a “Cyber attack stimulation through fax number” kind of vulnerability, with contingencies for an hacker to easily launch it as revealed form the sources of Checkpoint researchers, it has further dreaded the security researchers in attaching personal data’s to the recipient through faxes. All the 3 devices printers, scanners and fax machines are considered as office supplies and not a role of the management and tech team. As most fax machines are leased, it’s taken after the lease period by the vendor and there may be data’s impending in it, which would ensure high certainty for breaches to occur. These stuffs aren’t even supervised by techies nor the management team and its arguably
a huge risk for data beach risk.Most infosec leaders are fully aware of the processes going on but they don’t ensure the devices before being taken back by the vendor are free with all information erased, says Harstrick. He concludes that, “Everyone focus on their living but none towards the end of their life”.
Reported on oct 2018, Repercussions-20k patients records exposed on Catawba valley, website-www.cvcc.edu
Officials discovered unauthorized access on an employee email account on Aug. 13 and
immediately secured the account and launched an investigation with help from a third-party forensic firm. The investigation determined it was not one but two accounts hacked for more than a month between July 4 and August 17. The investigation found those email accounts included patient names, dates of birth, medical data and health insurance information, according to officials. Social security numbers were included for some patients. Catawba Valley began notifying patients on Oct. 12 and created a dedicated call center to handle patient questions about the breach. Officials are recommending patients review any statements they receive from their insurance carrier to make sure they’re not billed for any services they didn’t receive. The medical center has since hired security experts to improve employee education while bolstering email controls and upgrading its software and hardware controls,
Online jobs platform cpjobs.com has reported a security breach to police after an “unauthorised third party” stole customer data. South China Morning Post Publishers, which owns the site, said it had shut down affected pages, deactivated users’ passwords and added extra data security measures. There was no evidence to suggest users’ CVs had been compromised. We have shut down the impacted pages, deactivated all users’ passwords, and installed additional layers of data security safeguards,” a cpjobs.com spokesman said. “In addition, we have notified law enforcement and are working closely with them on their investigation.”Site representatives apologised for the incident, stressing privacy was its top priority.“Our teams are re-evaluating every part of our system to ensure maximum security,” the spokesman added. Attempts were made to breach the site’s systems on August 28 and 30, with user data and passwords stolen. Readers of scmp.com are not affected by the breach as it is protected by a separate security system, a spokesman added.