Confidential Data On 24.3m Patients Found Exposed Online
Between mid-July 2019 and early September 2019, Greenbone Networks carried out an analysis of approximately 2,300 medical image archiving systems connected to the public Internet. Greenbone’s analysis shows that several hundred PACS servers worldwide are connected to the public Internet without any kind of protection for the personal and medical data stored on them.
A considerable number of these systems even allow access to the individual image data of any patient. Now Greenbone Networks has released details of this new research in to the security of the servers used by health providers across the world to store images of X-rays as well as CT, MRI and other medical scans.
Of the 2,300 medical image archive systems worldwide that Greenbone analysed between mid-July and early September 2019, 590 of them were freely accessible on the Internet, together containing 24.3 million data records from patients located in 52 different countries.
In the UK, approximately 1,500 patient data records are publicly accessible, as well as around 5,000 images associated with these records. In the US, the number is orders of magnitude higher with 13.7 million data sets and 45.8 million images freely accessible on the internet.
As an estimate derived from previous attacks and investigations by various security authorities, the value of this data on the Darknet would probably be in excess of one billion US dollars.
Available data included patient names, dates of birth, dates of examination and some medical information about the reason for examination. For US patients (which make up 13.7 million of the compromised records), it also included Social Security numbers. More than 737 million images were linked to this patient data, with approximately 400 millions of these accessible or easily downloadable via the internet. In addition, 39 of these imaging servers allowed access to patient data via an unencrypted HTTP web viewer, without any level of protection.
Dirk Schrader, cyber resilience architect at Greenbone Networks who lead the research has said: “The data pertaining to millions of patients is there for anyone to access simply because of the careless configuration of these medical archiving servers.
“A significant number of these servers have no protection at all, they aren’t password protected and have no encryption. Indeed, everyday internet users could gain access to these servers with very little effort, there’s no need to write any code or deploy any specialist hacking tools..... Health providers need to act now to secure their systems, not just because they could be in breach of regulations such as GDPR in the EU and HIPAA in the US, but because they are putting their patients at risk.
“This data could be used to commit identity theft, highly-specialised phishing campaigns or even for extortion, where medical information is weaponised to blackmail people in the public eye.”
You Might Also Read:
Healthcare Organisations In The Cloud:
The Dangers Of Internet-of-Things In Healthcare:
