Kaiser Permanente has issued a breach notice regarding a data breach which occurred in early April, exposing 70k patients’ names, medical record numbers, dates of service and lab test results. Although not specified in Kaiser’s breach notice, regulators from the US Department of Health and Human Services Office for Civil Rights confirms this as a result of the email security slip-up at Kaiser’s Washington unit that let threat actors get in and have a few hours of access before they were shut down. I use the words “slip-up” based on this from the breach notice:
The employee received additional training on safe email practices, and we are exploring other steps we can take to ensure incidents like this do not happen in the future.
That means that the employee was either phished or clicked on something that ran malware to allow this to happen.
Sanjay Raja, VP of Product, Gurucul:
“It is most likely that the threat actor(s) involved were already inside for some time and what was detected was the actual data being exfiltrated within hours. What is becoming more evident as we see attacks similar to the Kaiser disclosure is Identity Threat Detection and Response (ITDR) is a critical component of any security operations program. However, too many solutions are rushing to announce identity-based capabilities for XDR or SIEM, but are simply correlating Active Directory data, while claiming to offer ‘identity analytics. This does nothing to automatically detect a threat and leaves security teams to continue to manually determine if an attack is active, which also leaves them chasing a lot of false positives that can potentially waste a lot of time and resources. Incorporating a full-blown set of identity data ingestion, analytics on infrastructure activity, access privileges and entitlements, combined with user and entity behavior analytics can provide security teams with not only understanding of risky or suspicious activity, but rapidly determine if an actual attack is taking place. More importantly, the key to stopping data from being stolen is enabling identity-centric response based on a full understanding of the risk to an organization based on what the context discovered and analyzed. Unfortunately, the vendor marketing hype is in full force already.”
Hopefully Kaiser Permanente does more than just do training on one employee. Because now that this is out there, a lot of patients are going to be worried about their personal information. Which will likely lead to some of them calling their lawyers. And that won’t end well for Kaiser Permanente.
Related
This entry was posted on June 13, 2022 at 2:56 pm and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Kaiser Permanente Pwned…. Info On 70K Patients Exposed
Kaiser Permanente has issued a breach notice regarding a data breach which occurred in early April, exposing 70k patients’ names, medical record numbers, dates of service and lab test results. Although not specified in Kaiser’s breach notice, regulators from the US Department of Health and Human Services Office for Civil Rights confirms this as a result of the email security slip-up at Kaiser’s Washington unit that let threat actors get in and have a few hours of access before they were shut down. I use the words “slip-up” based on this from the breach notice:
The employee received additional training on safe email practices, and we are exploring other steps we can take to ensure incidents like this do not happen in the future.
That means that the employee was either phished or clicked on something that ran malware to allow this to happen.
Sanjay Raja, VP of Product, Gurucul:
“It is most likely that the threat actor(s) involved were already inside for some time and what was detected was the actual data being exfiltrated within hours. What is becoming more evident as we see attacks similar to the Kaiser disclosure is Identity Threat Detection and Response (ITDR) is a critical component of any security operations program. However, too many solutions are rushing to announce identity-based capabilities for XDR or SIEM, but are simply correlating Active Directory data, while claiming to offer ‘identity analytics. This does nothing to automatically detect a threat and leaves security teams to continue to manually determine if an attack is active, which also leaves them chasing a lot of false positives that can potentially waste a lot of time and resources. Incorporating a full-blown set of identity data ingestion, analytics on infrastructure activity, access privileges and entitlements, combined with user and entity behavior analytics can provide security teams with not only understanding of risky or suspicious activity, but rapidly determine if an actual attack is taking place. More importantly, the key to stopping data from being stolen is enabling identity-centric response based on a full understanding of the risk to an organization based on what the context discovered and analyzed. Unfortunately, the vendor marketing hype is in full force already.”
Hopefully Kaiser Permanente does more than just do training on one employee. Because now that this is out there, a lot of patients are going to be worried about their personal information. Which will likely lead to some of them calling their lawyers. And that won’t end well for Kaiser Permanente.
Share this:
Like this:
Related
This entry was posted on June 13, 2022 at 2:56 pm and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.