William Farrell CPA - Cary NC

CPA leaks payroll information. Interesting thing happened today while we were reviewing faxes received by our company. We started receiving faxes from a local CPA firm containing payroll information. It could be that the CPA firm did not verify whom it was sending the information to before sending the fax and did not verify that the fax was received.

We are reaching out to the CPA firm for comment and will update this information once we receive a response.

Total Number of Records: 7 Pages
Received via: Fax Machine
Type: Inadvertent Disclosure

Update: We attempted to contact the organization via their website and guess what...

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  info@williamfarrellcpapc.com
    The mail server could not deliver mail to info@williamfarrellcpapc.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.

Highmark - Related to Anthem Attack

More than 51,000 current Highmark health insurance customers in Pennsylvania will receive letters this week notifying them that their personal information may have been stolen as part of the larger Anthem Inc. data heist.

Those customers are in Highmark’s Western and Central Pennsylvania markets, 49 counties in all. “Letters are going out now,” spokesman Aaron Billger said.

What is interesting is that Highmark has been noted in Open Source feeds as having compromised systems in the past as well. This may have been part of the vectors used to gain access to Anthem and deserves a second look.

DISCLOSURE: UMass Memorial Medical Group

The UMass Memorial Medical Group is working with law-enforcement personnel after it learned a former employee allegedly accessed private patient billing information that contained credit-card and debit-card numbers, Social Security numbers, and birth dates, according to hospital personnel.
Anthony Berry, the director of media and public relations for UMass, said the group is continuing to work with law enforcement, but there is "nothing concrete" to report yet.

Read more: http://www.lowellsun.com/todaysheadlines/ci_27447491/scope-data-breach-unknown#ixzz3Qkube1ms

Analyst Research: We have checked our OSINT-X system and have not seen any traffic from UMass on our sensor network. This may indicate that the issue was localized. If we note any activity we will update the blog with additional information. 

DISCLOSURE: Independence Blue Cross

Independence Blue Cross has indicated that a maintenance worker discarded 12,500 paper records in the normal trash in October.

Patient Disclosure Monitoring - 28 Oct 2014

BREACH: Delaware River and Bay Authority

The Delaware River and Bay Authority is warning customers of a possible data breach on board the Cape May-Lewes Ferry.

The Authority says they were notified on July 30, 2014 of a possible security compromise involving credit and debit card data stored on certain systems at the ferry's terminals and vessels. An investigation into this incident was investigated by the Authority's team as well as third-party forensics experts.

The Authority says the compromised data came from cards used from September 20, 2013 to August 7, 2014 and were used at systems relating to food, drink and retail sales at the Ferry. The Authority says the credit and debit card data potentially at risk includes the card number, the cardholder's name and/or the card's expiration date.

 NOTE: We are not releasing any additional information on this breach at this time.

Second Breach Kinston, NC Government

70 Lenoir County employees information has been published in a salary report. An employee failed to remove the information that included names and social security numbers in the documents.

The report was sent to one person who had worked in law enforcement and understood the gravity of the situation.

Let's hope we don't have to report on Kinston again in the future. This is the second report in 2 months.

BREACH: Cone Health Greensboro, NC (www.conehealth.com) - UPDATED 10:11PM EST 14 Oct 2014

This news article makes their issue look small but I can tell you they have additional issues they need to address.

NOTE: We have notified Cone Health and are awaiting a reply. 

Reference:
http://www.wfmynews2.com/story/news/local/2014/10/09/cone-health-admits-small-data-breach-patients-notified/16965745/

Type: PHI 
Area: Medical
First Noted: 9 Oct 2014
Location: NC
Total Records: 3561+ (There are additional items that need follow up)
Status: Not Monitoring for Follow Up (Not a client of SLC Security Services LLC)

Update:
2:49PM EST:
We received this automated response so far.
Thank you for your comment.  We will review it and provide a response as soon as possible.

3:08PM EST
We notified the media contact at Cone Health.

Our research indicates they have had disclosure issues far longer and larger than this recent disclosure.

14 Oct 2014:
9:30PM EST
Received follow up.

15 Oct 2014:
Left an additional voicemail for the compliance officer and to date have not received a response. Closing out the ticket as apparently they are not interested in resolving this issue.

16 Oct 2014:
Receiving media inquiries into this breach. Out of respect for those affected we have declined any interviews at this time to give Cone Health an opportunity to close their security related issues.

Closed our ticket due to non response.

UPDATE: RSS Feed Brought Back Online - Round 2

Due to overwhelming request the past day we have brought the RSS feed back online tonight. We have however changed how the RSS updates are being conducted. Previously we were allowing the request to automatically generate the RSS content based on the most up to date information on our system but we realized that within 10-15 minutes and receiving over 10000 request for the feed that we needed to find a better solution.

RSS FEED (30 Minute Delayed)

What we have discovered today is that many of the people and organizations contacting us want us to provide the actual data that we verify prior to posting. Unfortunately providing this information would not make good business sense for us. As an example we have compared our notifications to others in the industry and have found that sometimes we are days, hours or even weeks ahead of other people because of how we obtain the data.

We will no longer provide information on how we obtain the data. If you actually own data we will try and notify you but you have to understand that we are a volunteer organization that decided to do this to protect some of our clients. We have seen the post about our feeds being a public relations nightmare. Our thought is this. If it was your data you would want to know. What we have found through our research over the past few years is that even when confronted with actual hard evidence of breaches, data disclosures, leaks or espionage that only 10% of the businesses we deal with ever release any notification to the public and the ones that do only do it if their hands are forced due to media disclosure.

We are open to suggestions and invite you all to become a part of this program. We are actively looking for vetted security engineers to volunteer time and help us improve our systems and notifications. We will be working on a submissions program in the future as well as a way to check our data sets to see if your information has been compromised.

Stay tuned we are upgrading infrastructure and providing services. We may loosen the reigns on the data flow but we need to ensure that we have a system in place that provides the proper notifications with checks and balances along the way.

Also we are flattered that so many people have ask for more information on what we have posted. We have seen positive and negative comments on this blog and our post but at the end of the day we can assure you that we see value in what we are doing. We have some of the best security engineers that I have ever met providing information into our system, various feeds both public and private and a highly customizable system that monitors everything from open proxies, TOR, Email, RSS and other locations for information and connects the dots saving our security analyst time in figuring out what is happening in cyberspace in near real time.

BREACH: Flinn Scientific

Science education website Flinn Scientific is notifying customers of a card payment data breach incurred by malware over the last several months.

Disclosure Letter

Type: Card Payment Data
Area: Scientific
First Noted: 5 Oct 2014
Location: NA
Total Records: Unknown
Status: Not Monitoring for Follow Up (Not a client of SLC Security Services LLC)

BREACH: AT&T notifying customers of insider breach - UPDATED

AT&T is notifying customers after discovering that a rogue employee was accessing customer information improperly. The employee, who has since had their employment terminated,  would have been able to access customers’ name, account information, including SSN and driver’s license number, and CPNI (Customer Proprietary Network Information).

From the wording of the notification letter, it sounds as though the information may have been misused, as AT&T writes that “To the extent this activity results in any unauthorized charges or changes to your account, they have been or will be reversed.”

Affected customers are being offered credit protection services through CSID.
The total number of customers being notified was not disclosed in the notification letter.

UPDATE:

AT&T explains 'Intruder' retrieved personal data of about 1600 customers

BREACH: eCar insurance in security breach via Brightside Group

The Brightside Group – manager of several motor insurance websites, including eCar insurance – has identified that there was breach in its security system on 29 September.
However, “the company confirms that there’s no evidence that any personal information was obtained by the perpetrator,” the firm told the BBC.

Note the screencap from eCar Insurance saying they’re undergoing “essential maintenance.” Why not be more transparent and admit there’s a breach that’s being investigated?

DISCLOSURE: 2nd Notification - Sheplers

Cowboy boot shoppers, take note. A Western apparel store based in Frisco, Texas, announced that it was hit with a data breach between June 11 and September 4. Sheplers—which has stores in Arizona, Colorado, Florida, New Mexico, Oklahoma, Texas, and Missouri—does not believe online shoppers have been impacted in the breach, and the retailer says it’s now safe to use cards at Sheplers stores in all locations. 

Sheplers says it discovered the breach after an informal tip from a financial institution.

DISCLOSURE: Owensboro Medical Group

Insider threat results in hospital data breaches all too often. But we don’t often hear about groups of employees accessing personal patient information and then leaving the hospital together to start a business selling the data. That’s what happened at Kentucky-based Owensboro Medical Group, where 3,000 patients’ data was stolen. Lawsuits are expected, according to local 14 News, and the medical group has sent letters to affected customers.

DISCLOSURE: American Family Care

Fewer than 2,500 patients at American Family Care were told that their personal information was at risk after a two unencrypted, password-protected computers were stolen from an employee’s vehicle in July, according to SC Magazine.

The laptops may have contained all kinds of personal information belonging to these patients, including Social Security number, names, addresses, dates of birth, phone numbers, medical record numbers, medical information, insurance information, driver’s licenses. These computers were not used in direct patient care. Because of this incident, American Family Care is now requiring encryption on work computers and is reviewing its policies.

UPDATED DISCLOSURE: JPMorgan UPDATED WITH REPSONSE FROM JPMORGAN

For the second time in roughly three months, JPMorgan Chase is scrambling to contain the fallout from a security breach of its vast computer network, according to several people with knowledge of the investigation.

JPMorgan, the nation’s largest bank, recently found that hackers, with links to Italy or southern Europe, had gained entry to some of the bank’s servers, these people said. The discovery follows an attack that was uncovered in late July and suggests that it was more extensive than first thought. In that attack, hackers obtained entry to dozens of the bank’s servers and reviewed information on more than one million customer accounts. Security experts briefed on the matter had said that the full extent of the July attack was not known and that it could take the bank months to discover all of the fallout.

It is unclear whether the latest discovery constitutes a second breach or is part of broader fallout from the first incident.

Type: Account Information
Area: Financial
First Noted: 2 Oct 2014
Location: Various
Total Records: Unknown
Status: Not Monitoring for Follow Up (Not a client of SLC Security Services LLC)


UPDATE:
JPMorgan Chase labels as inaccurate a New York Times report about a second data breach against the financial institution.

"The story is false," JPMorgan Chase spokeswoman Patricia Wexler tells Information Security Media Group. "We are not aware of any new breach."

Reference: http://www.consumerreports.org/cro/news/2014/10/protect-yourself-from-chase-mystery-breach/index.htm
 

DISCLOSURE: Eastern Pines EMS (easternpines.org)

Entity is leaking patient health information to include name, injury, location, treatment and doctors information. 

Type: PHI
Area: Medical
First Noted: 1 Oct 2014
Location: NC
Total Records: 3 
Status: Not Monitoring for Follow Up (Not a client of SLC Security Services LLC)

BREACH: Lost Pizza Co in North Mississippi exposed to data hack via OSINT-X Newswire

The data hack that exposed the customers of more than 216 Jimmy John's locations has also netted two Lost Pizza Company locations, both in North Mississippi.

Credit card authorization and point-of-sale technology company Signature Systems, Inc. recently revealed that the customer data at 216 Jimmy John’s stores and 108 other restaurant locations including the Lost Pizza Co. locations in Tupelo and Southaven, Mississippi, had been exposed by cyber criminals.

"We have determined that an unauthorized person gained access to a user name and password that Signature Systems used to remotely access POS systems," a statement on Signature Systems website said. "The unauthorized person used that access to install malware designed to capture payment card data from cards that were swiped through terminals in certain restaurants. The malware was capable of capturing the cardholder’s name, card number, expiration date and verification code from the magnetic stripe of the card."

DISCLOSURE: Southeast Womans Center (www.southeastwomenscenter.com)

Sending patient records unencrypted by email and through unencrypted other channels.

We are aware of various issues with this provider. They have been known to send records via email as well as fax and through unsecured systems of other providers.

Type: PHI
Area: Medical
First Noted: 22 Sept 2014
Location: North Carolina
Total Records: 100+
Status: Not Monitoring for Follow Up (Not a client of SLC Security Services LLC)

Update: Additional violations noted since original post. 

Bay Area Bioscience Association (BayBio) notifies online customers of breach

Dear BayBio Customer,
It has come to our attention that sometime within the past two weeks the security of our online payment system was breached. We believe an intruder inserted files that captured the keystrokes of our visitors and may have captured credit card numbers in the process.

You are receiving this because you have made a transaction at BayBio.org’s checkout page to pay for an event or membership. Please review your credit card statement and immediately alert your bank if you see any unusual transactions or unfamiliar vendor names.

We are taking these matters seriously and are working to resolve this security issue as quickly as we can and to install tightened security measures to ensure this doesn’t happen again. We will advise you when we’ve completed these actions and have restored the security of our online payment system.

For the present time, enrollment in events and membership renewals can be accomplished through www.baybio.org without providing credit card information. Payments will be processed by phone until our web page security problem is fixed.

Your online security while using the BayBio site is of the utmost concern to us. We regret any inconvenience this problem may have caused you. We truly appreciate your participation in the BayBio community.

Regards,
Gail Maderis
President and CEO, BayBio
250 East Grand Avenue, Suite 26
South San Francisco, CA 94080