Ransomware attack targets Seguin dermatology practice
Lynn Brezosky Nov. 11, 2016
1of2News that Yahoo was breached back in 2013, and the personal information of more than 1 billion of its users was stolen, should serve as a reminder that everyone's email and personal information is vulnerable to hacking. Safeguards you can take include creating strong passwords and changing them when you have to.Photo: Reuters /File photo
2of2Specialists work at the National Cybersecurity and Communications Integration Center (NCCIC) in Arlington, Va., Tuesday, Sept. 9, 2014. Ground zero in the nation's fight against cybercrime hides in plain sight, in a nondescript suburban office building with no government seals or signs. Only after passing a low-key receptionist stationed on the seventh floor does one see the metal detectors, personal cellphone lockers and a series of heavy doors marked "classified" _ all leading to the auditorium-sized National Cybersecurity and Communications Integration Center. (AP Photo/Manuel Balce Ceneta)Photo: Manuel Balce Ceneta, STF / Associated Press
A Seguin dermatologist on Friday said his office computer system was attacked with ransomware that accessed confidential patient data, including names, social security numbers and billing codes for medical services.
"There was a high likelihood that protected health information (PHI) was accessed," Dr. Robert Magnon, owner of Seguin Dermatology, said in a press release issued by attorneys Brin & Brin of San Antonio. "Also, it could not be ruled out that confidential information may have been removed from the server."
Calls to Brin & Brin weren't immediately returned. The company didn't disclose how many patient records were affected or whether local law enforcement or the FBI was notified.
Magnon said the server did not contain medical records, lab reports, credit card or bank account information. An information technology company was brought in to remove the ransomware, decrypt the server and investigate what happened.
"Seguin Dermatology takes the security of PHI very seriously," Magnon said. "Upon learning the results of the forensic investigation, we immediately took steps to notify all affected patients. To prevent this from happening again, we are conducting a review of our physical and computer security, reassessing our office's policies and procedures, and performing staff training."
The practice also arranged for identity protection services for patients whose social security numbers were compromised and urged patients to place fraud alerts on their credit files.
Ransomware is used to lock computers until victims pay up. Between April 2014 and June 2015, the FBI's Internet Crime Complaint Center received 992 complaints about CryptoWall, one type of ransomware, with victims' losses totaling over $18 million. According to the Center, demands are typically for between $200 and $10,000, though victims inevitably pay out even more in network repairs and countermeasures, lost productivity, legal fees and costs to monitor credit for employees or customers.
Criminals bait victims through infected advertisements, websites and emails. Once the victim clicks on the bait, their devices get infected with ransomware that encrypts their files and sends a demand for payment if the victim wants to recover their data. The criminals usually ask for payment in Bitcoin, an internet currency that is difficult to trace.
Online thieves have been known to blackmail large corporations as well as small and medium-sized police departments, municipal governments, and universities. But they've increasingly been targeting smaller entities, and medical practices can be a treasure trove.
"There has been an uptick in attacks against health care institutions, and a lot of that is because what (the thieves) are realizing is the identity data that's provided … it's super useful and it's becoming sort of more valuable than credit cards," said Matt Snider, head of the information security practice at the Denim Group, a San Antonio-based computer security company.
"Credit card fraud has been around a long time and it's certainly still a problem, but I think what folks are starting to figure out is that for a longer term scam they can potentially make a lot more money with that personal information," he said.
Snider said the most likely scenario was that hackers put out a broad sweep that detected some vulnerabilities in the practice's server, then dispatched the malware.
The takeaway, he said, is that smaller companies needed to be as vigilant as larger ones about training staff on internet security, keeping software updated, and keeping a backup of data that's away from the server.
"Because the way that ransomware works, it crawls through your whole network," he said. "So anything that's on the current network is going to potentially be susceptible."
lbrezosky@express-news.net
Lynn Brezosky
Follow Lynn on:
lbrezosky
Lynn Brezosky is a business writer at the San Antonio Express-News.
Organic farmers' success causes rifts in the industry
For businesses, consumer behavior more than academic
Study: Richer or poorer, cheaters cheat