Cybersecurity researcher Jeremiah Fowler with Security Discovery reports the discovery of an internet-accessible database containing nearly 200,000 records of US vets containing sensitive data. The report notes “Upon further investigation of the data there were many references to a Jacksonville, North Carolina based company called United Valor Solutions. The records contained patient, physician, employee data, some contact information and diagnostic data, and other potentially sensitive information that should have not been publicly exposed. According to their website: United Valor Solutions provides disability evaluation services for the Veterans Administration and other federal and state agencies.
<p>An incident is discovered either by looking for it or being notified of it. I am sure that United Valor is going through the authentication and access logs to confirm who had access and whether all access is accounted for and mapping to authorized persons. If access was obtained via a stolen credential, that will make it a bit more challenging to track. This is one reason why organizations are moving away from static credentials like passwords. You can’t steal something if it doesn’t exist.</p> <p> </p> <p>It is always possible that the veterans’ data contained in this exposed database could eventually show up on the darknet, since the data was available publicly. The mystery is how the data got there, and who was involved in that chain.</p> <p> </p> <p>This could be a “tip of the iceberg” if the data exposure was done via an attack, but if it was put out in public due to an internal security failure or error, then it just be a one-off mistake.</p> <p> </p> <p>Our advice is to organizations is to follow zero trust principals and:</p> <ul> <li>Implement passwordless for employees</li> <li>Use a layered security approach using biometrics, FIDO2 keys, device biometrics</li> <li>Utilize risk signals to match an authenticated session with the risk associated with information/resource/service being accessed</li> <li>Encrypt all sensitive information at rest and in transmit</li> <li>Eliminate all extra standing privileges</li> </ul>
<p>The only explanation for having a database publicly exposed is due to poor application design and development. It might also indicate that United Valor practices poor internal cyber hygiene as it appears that “the data has only been accessed via our internal IP and yours.” This could be an indicator as to the presence of an internal threat. There are numerous tools and logging functionality available to monitor such internal threats and it appears these are non-existent in the United Valor IT toolbox or, they exist but are poorly utilized. Such tools could have helped identify when the “ransomware” occurred and provided useful in their follow-up investigations.</p> <p> </p> <p>It depends on the type of malware installed by the threat actor and the techniques employed to bypass any existing controls.</p> <p> </p> <p>It is possible that a ransomware incident and the exposed databases are related. In many cases poorly designed and tested application controls provide easily accessible gateways for threat actors to get to their targets: networks, systems, and data.</p> <p> </p> <p>This data could wind up on the dark net – for sale to the highest bidder. Such sensitive personal and health information are ripe targets for “Robin Hood theft” – a form of medical ID theft – which is rampant in the healthcare industry due to its difficulty in catching the user fraud in a timely manner. Such information carries a high price tag in the dark web. </p> <p> </p> <p>In many, cases, threat actors will not only steal the data but install backdoors for stealthy access to the network and systems and even install other types of malware which often go hidden for a long time. This incident could lead to discovery of additional security issues.</p> <p> </p> <p>“This shows why organizations must practice good cyber hygiene and test all components that are public facing. They also must employ time-tested cyber security strategies, tools and techniques when protecting such sensitive data.”</p>
<p>It is entirely possible that the United Valor systems had already been penetrated and infected by malware/ransomware. </p> <p> </p> <p>We are seeing a change in the tactics of ransomware attacks. Instead of encrypting data and ask for a ransom, more ransomware attacks have been threatening to expose data instead. This happened with the recent Japanese toolmaker ransomware attack. </p> <p> </p> <p>The data could show up on the darknet if the perpetrator\’s goal is fetching a handsome price for it, as health records are a much more attractive target than credit card data these days. Health records can sell for $150/record while credit card data is only a few dollars per record.</p> <p> </p> <p>Usually, such security incidents are not isolated. Once you discover some symptoms, you probably already had multiple incidents or breaches.</p>
<p>If the researcher found this database of 200,000 medical records, then who knows who else may have also found it and made off with the highly sensitive PII data of veterans. United Valor does not appear to be in control of the situation. They claim only two IP addresses accessed the data: United Valor’s and the researcher’s. That sounds doubtful. All in all, this is a troublesome discovery, especially given the sensitivity of the data.</p>