Feeds

Hackers demand $10m ransom for Virginia medical data

8.3 million records held hostage

Securing Web Applications Made Simple and Scalable

Almost 8.3 million patient records have been stolen from a Virginia government website that tracks prescription drug abuse, according to hackers who are demanding a $10 million ransom for their return.

"I have your shit!" the note, which was posted to Wikileaks read. "In *my* possession, right now, are 8,257,378 patient records and a total of 35,548,087 prescriptions. Also, I made an encrypted backup and deleted the original. Unfortunately for Virginia, their backups seem to have gone missing, too."

The message said if officials didn't respond within seven days the information would be made available to whoever offered the highest bid. The story was first reported by Brian Krebs's Security Fix blog.

The claims could not immediately be verified. It stretches the imagination to believe outsiders could break into a state-run website and destroy both the original data and its backup, which presumably would be stored off-site. A spokeswoman from Virginia's Department of Health Professions didn't return a phone call seeking comment. She told Security Fix the website was shut following following the April 30 discovery of an intrusion. She never directly addressed whether sensitive data was stolen or deleted.

The Virginia PMP homepage remained unreachable at time of writing, and the state has temporarily discontinued email to and from the department, Security Fix said. An FBI spokesman in Richmond, Virginia told the Associated Press the agency was investigating a referral from the Virginia Information Technologies Agency. State police said they are assisting as well, the AP reported.

The episode is the latest cautionary tale to involve the mass storage of medical records in electronic form. When not secured properly, these are easier to steal than paper records. In November, pharmacy prescription processor Express Scripts offered a $1m bounty for information leading to the arrest of blackmailers who threatened to disclose stolen records belonging to millions of patients.

President Barack Obama has made the digitization of medical records a major pillar of his push to lower the cost of health care. Assuming the extortionists in this case aren't bluffing when they say they've acquired records belonging to almost 8.3 million people, electronic storage of such sensitive information comes with a cost that can be underestimated only at our peril. ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.