We Told You So!

I just read a post on databreaches.net that talks about the issues at WakeMed. Remember this is not the first time they have popped up on this blog. We contacted them and received no response. If they were smart they would talk to us because we provided other information and to date they have done nothing about it.

The response I received was that they didn't care because it was end users accounts that were affected. Just goes to show that all of this could have been prevented but their response to us was not what we would have expected.

Reference:
https://www.databreaches.net/wakemed-exposed-patients-phi-in-bankruptcy-claims-uploaded-to-pacer-attorney/

Previous Warnings:
http://vulnerabledisclosures.blogspot.com/search/label/wakemed

WakeMed again in the HIPAA Hot Seat

While I previously have taken down a post at the request of WakeMed I felt that I had to report this one. As reported on WRAL:

WRAL in North Carolina reports:

A Cary law firm has filed a motion against WakeMed, accusing the hospital of releasing patients’ private information, including Social Security numbers, making them susceptible to identity theft.
Cort Walker, a bankruptcy and civil business litigation attorney at Sasser Law Firm, said he noticed a problem while reviewing records WakeMed had filed to collect debts from former patients who had declared bankruptcy.
[…]
The law firm says it found 158 cases involving its clients dating back to 2013 where WakeMed violated federal bankruptcy code by including Social Security numbers, full dates of birth and medical records.

Read more on WRAL.

As they note in their report, and as noted in the motion for contempt, sanctions, and damages,  Duke University Health System had a similar situation three years ago. I had covered that breach at the time, and noted that it had been reported to HHS as a HIPAA breach. WakeMed will almost certainly report their incident to HHS, although depending on how many patients, total, have had their PHI exposed,  we may not see it in the public breach tool.

Like most HIPAA-covered entities, WakeMed has been noted on this site before. Most recently, in 2014, this site noted reports by SLC Security that WakeMed was leaking patient PHI and they had reached out to them and spoken to them, but the leaks persisted, and WakeMed did not respond to attempts by SLC Security or this site to alert them and get a response from them.  It is not known to this site whether WakeMed ever reported the alleged leaks to HHS, but there is no entry in HHS’s public breach tool.

Credit to DataBreaches.net for the heads up on this one. 

Previously we reported on a problem with communications from the EPIC system that is even more troubling. This entity continues to have issues. Maybe they should hire us to do a full assessment?

Despite our Warnings - Wake Health

Despite our previous warnings we are now seeing indications that Wake Health is being specifically targeted by external actors. While we have talked to them on at least one occasion by phone and several post have been made to the blog they have continued to ignore the information we have sent to them.

Today we started seeing information indicating that they are specifically being targeted. These are the same types of indicators that we noted from Anthem months before they acknowledged that they were breached. It is our belief that Wake Health will be the next entity to see similar issues.

What starts out as probes end up with infiltration and we can tell you from previous visits that Wake Health is not protecting PHI concerning patients. They have taken the same route as some other entities in ignoring our warnings and are not a client so we are helpless to help them.

Specifically we are seeing that compromised servers in Switzerland and in Russia are being used to target their employees. It will only take one slip up and they will suffer the same fate as Anthem and some of the educational institutions we have been alerting on.

Again Wake you should seriously hire us to secure your network. I am pretty sure it's probably already too late but you can't say we didn't warn you numerous times to this type of activity.

Here is what is known to date:
1. Wake Health has been leaking PHI for well over a year. The information was more than likely being used to collect information such as usernames (which we have observed as well).
2. Domains and existing malicious actors are utilizing previously compromised host to send email to Wake's employees to infect their infrastructure with targeted malware (cannot confirm but this is the same pattern we have previously observed).
3. Patient information and PHI is currently being shopped in underground markets so this is an indicator that they may have already been compromised yet they have not acknowledged (and they ignored our previous warnings).

We will update if we see any information but will only talk to Wake Health directly concerning this matter and only if under contract.

NOTIFICATIONS: Pending Patient Notifications

SLC Security Services LLC will begin notifying patients of Cape Fear Valley Health System (Fayetteville, NC) and WakeMed (Various Locations) after formal notification has been made to the entities formally.

We have previously contacted both entities and neither entity responded to our notification letters.