It was reported late last week that about 42,000 AdventHealth Medical Group patients are being notified that their personal and health data was breached for more than a year due to a hack of the Florida provider’s systems. The breached data contained troves of personal and health data, including medical histories, insurance carriers, Social Security numbers, along with demographic information like names, phone numbers, email addresses.
Warren Poschman, Senior Solutions Architect at comforte AG:
“While the longstanding focus of attackers has been financial data from retail, e-commerce, and financial services sectors, the untapped trove of personal data are a series of softer targets such as localities, social services, and healthcare. Not only are these systems just as rich with data as the traditional targets but security often lags due to the focus on, in the case of healthcare, patient care over IT.
AdventHealth had a series of perimeter and intrusion security measures but none of those security measures ultimately detected a 16-month long breach.
Similar to Equifax and other long-term breaches, data was accessed and likely exfiltrated because it was stored in the clear or protected by passive means such as volume level encryption or database encryption. Therein lies the issue – attackers went undetected because the perimeter was breached and once inside there was nothing substantial to stop the attackers from accessing the real target, their patient data. Instead of focusing solely on the perimeter and network levels, healthcare providers are highly advised to implement strong data protection strategies that deal with the eventuality of attackers gaining some level of access to a network – after all, it’s the data that the attackers are after, not the firewalls, servers, and other infrastructure.
Focusing on infrastructure, perimeter and intrusion detection is a losing battle since these measures only protect you from the threats you know about and don’t offer any protection once compromised or circumvented. Adopting a data-centric security model allows for the data to be protected as it is acquired and traverses through the organization and, if an attacker gains access through the perimeter, then the risk that the actual personal data will be exposed is dramatically reduced. And that is what I call a high degree of patient care!”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.