Personal data now prime target for cyber criminals

(Reuters) — Whoever was behind the latest theft of personal data from U.S. government computers appears to be following a new trend set by cyber criminals: targeting increasingly valuable medical records and personnel files.

This data, experts say, is worth a lot more to cyber criminals than, say, credit card information. And the Office of Personnel Management breach revealed Thursday suggests cyber spies may now also be finding value in it.

Cyber investigators from iSight Partners Inc. said they had linked the OPM hack to earlier thefts of health care records from Anthem Inc., a health insurer, and Premera Blue Cross, a health care services provider. Tens of millions of records may have been lost in those attacks.

All three breaches have one thing in common, said John Hultquist of Dallas-based iSight. While cyber espionage usually focuses on stealing commercial or government secrets, these attacks targeted personally identifiable information.

The stolen data "doesn't appear to have been monetized, and the actors seem to have connections to cyber espionage activity", said Mr. Hultquist, adding that none of the data taken in the earlier attacks had turned up for sale on underground forums.

A source close the matter said U.S. authorities were looking into a possible China connection to the breach at OPM, which compromised the personal data of 4 million current and former federal employees.

Several U.S. states were already investigating a Chinese link to the Anthem attack in February, a person familiar with the matter has said.

China routinely denies involvement in hacking, and on Friday a spokesman for the Foreign Ministry in Beijing said suggestions it was involved in the OPM breach were "irresponsible and unscientific."

Mr. Hultquist said iSight could not confirm that China was behind the attacks, but similar methods, servers and habits of the hackers pointed to a single state-sponsored group.

Black market flooded

Security researchers say medical data and personnel records have become more valuable to cyber criminals than credit card data.

The price of stolen credit cards has fallen in online black markets, in part because massive breaches have spiked supply.

"The market has been flooded," said Ben Ransford, co-founder of security startup Virta Laboratories Inc.

The result: Medical information can be worth 10 times as much as a credit card number.

Fraudsters use this data to create fake IDs to buy medical equipment or drugs that can be resold, or they combine a patient number with a false provider number and file made-up claims with insurers.

State-sponsored hackers may not be after money, but would also be interested in such data because they could then build a clearer picture of their target.

That, said Philip Lieberman of security software company Lieberman Software Inc., would increase the chances of any targeted email attack, or spear phish, successfully obtaining confidential data.

Others said that, given the data affected includes job histories, those targets might be in other government departments. "It's likely this is less about money and more about gaining deeper access to other systems and agencies," said Mark Bower of HP Security Voltage, a data security company.

This interest in more granular data is pushing hackers of all stripes into more inventive ways of penetrating the defenses of hospitals and other institutions holding such data.

TrapX Security, a cyber security company, said it had discovered criminal gangs from Russia and China infecting medical devices such as X-Ray systems and blood gas analyzers to find their way into servers from which they stole personnel and patient data.

Other security researchers agreed this kind of attack was becoming more common.

Billy Rios, founder of security company Laconicly L.L.C., said he had found infected systems while working with several health care organizations. "Clinical software is riddled with security vulnerabilities," he said.

A survey by think-tank The Ponemon Institute L.L.C. issued last month said that more than 90% of health care organizations surveyed had lost data, most of it to hackers.

"This is going to get worse before it gets better," said Carl Wright, of TrapX, which discovered the breaches via medical devices.

Read more:https://www.businessinsurance.com/article/20150605/NEWS06/150609873/personal-data-now-prime-target-for-cyber-criminals?tags=%7C329%7C302%7C299