Stolen Health Records Flooding Dark Web Markets

According to new research provided to CyberScoop and conducted by the Institute for Critical Infrastructure Technology and cybersecurity firms Flashpoint and Intel Security, the large amount of leaked patient records stolen and posted for sale to the dark web in recent months has caused prices for most of those records to drop.

In the face of exceeding supply, stagnant demand and increased law enforcement attention, it’s becoming increasingly difficult for criminals to make a living selling partial healthcare records, according to James Scott, a senior fellow at ICIT.

While the quality, quantity and sometimes origin of such electronic records will help dictate the price of any specific package for sale, average prices are largely trending downwards for individual, non-financial files, new research shows.

The value of similar healthcare records that sold last year for roughly $75 to $100 dollars can now be found for around $20 to $50 dollars.

“The volume of medical data for sale in the criminal underground is increasing, leading to very low prices for individual records,” Vitali Kremez, a senior analyst focused on cyber intelligence at Flashpoint, told CyberScoop.

A majority of stolen healthcare patient records sold on the dark web come from US-based institutions that have been breached, according to Intel Security.

The average price for a single complete electronic health record, described as a “fullz” in underground markets, typically tagged with financial information and supporting documents like utility bills or insurance receipts, currently hovers around $50, World Privacy Forum founder Pam Dixon recently estimated.

In broad strokes, an electronic healthcare record is rarely worth very much unless it is converted into a “complete ID kit,” which combines long form healthcare records, additional documents and are authorised via a breached government registration database, explained Scott.

Even so, because healthcare records contain vast personal information, these document offer scammers a stepping stone to more comprehensive fraud schemes.

Dixon told Healthcare IT News that decreasing prices are a general conclusion of easier access to sensitive personal records. One component of this eased access, based upon data gathered by ICIT and Intel Security, is the growing sale of hacking-as-a-service on the dark web, which enables those without technical backgrounds to hack into systems by relying on paid mercenaries.

Laying the groundwork for a further discordant dark web economy in some part, according to Kremez and Intel Security vice president Raj Samani, is also the ambiguous rise of prominent, dedicated healthcare hackers. Two of these mysterious actors, known simply by their vendor usernames “earthbound11” and “the dark-overlord,” have been flooding the market with medical fullz in recent months, thereby dictating the price for other smaller resellers.

A hacker’s underground reputation is typically one of the leading factors leading to the valuation and eventual sale of any records package they post, research shows.

“The larger trend in the trade of compromised personal healthcare information is toward larger breaches affecting more data,” said Kremez, “cyber-criminals themselves have realised that the value of their stolen medical data is much lower than once expected.”

Though it remains unclear how a recent fall in Dark Web prices have and now continue to influence hackers’ attack behavior towards the healthcare industry, several experts who spoke with CyberScoop believe it will ultimately lead to a spike in overall network intrusions at hospitals, the counter-intuitive thinking here being that larger data dumps will help dark web vendors recoup recent profit losses.

“After the 2015 breach of 100 million medical records from Anthem, Premera Blue Cross, and Excellus Health Plan, let alone the numerous smaller networks compromised in 2015 and 2016, the annual rate of medical identity theft could easily increase to be ten or twenty times greater than the 2014 rate,” an extensive, recent Dark Web report from ICIT reads.

Unlike stolen credit card details and other payment information sold online, however, a cloud of uncertainty looms over leaked healthcare records because cause and effect is difficult to decipher, said Samani. According to an April 2014 FBI bulletin, electronic healthcare record theft is also more difficult to detect, taking almost twice as long to spot as normal identity theft.

In most cases, the data necessary to draw a conclusive connection between a leaked patient record and relevant case of identity fraud, for example, is neither readily available nor visible The result is an environment where targeted data breaches occur but security researchers cannot definitely say how some, if not most, of the leaked information is being used, explained Samani.

“The impact of stolen payment cards is felt almost immediately whereas other forms of data the impact could be longer term,” said Samani, “indeed we can determine a direct correlation between a breach, and the pain felt when cards are declined. But it is not so easy to determine the origin of fraud with other forms of data.”

AIRS:     Why Are Hackers After Healthcare Records?:      Healthcare Data Breaches In 2017 Will Get Worse:

You Might Also Read:

Google Challenged For Collecting American Health Data:

 

« Give Children More Control Of Data Privacy
Non-Secure IoT Devices Are Powerful Weapons »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Cyber Defense Media Group (CDMG)

Cyber Defense Media Group (CDMG)

CDMG is the leading global media group for all things cyber defense.

Hitachi ID Systems

Hitachi ID Systems

Hitachi ID Systems offers comprehensive identity management and access governance, privileged access management and password management solutions.

The Open Group

The Open Group

The Open Group: Leading the development of open, vendor-neutral IT standards and certifications.

CyberSeek

CyberSeek

CyberSeek provides detailed, actionable data about supply and demand in the cybersecurity job market.

National Center for Manufacturing Sciences (NCMS)

National Center for Manufacturing Sciences (NCMS)

NCMS is a cross-industry technology development consortium, dedicated to improving the competitiveness of the US industrial base. Strategic initiatives include industrial cyber security.

Gulf Computer Services Co (GCSC)

Gulf Computer Services Co (GCSC)

Gulf Computer Services is a major player in the field of networking & Communication solutions for emerging industries such as Internet Services and Information Technology in Saudi Arabia.

CyberSAFE Malaysia

CyberSAFE Malaysia

CyberSAFE Malaysia is an initiative to educate and enhance the awareness of the general public on the technological and social issues and risks facing internet users.

Industrial Control System Information Sharing and Analysis Center (ICS-ISAC)

Industrial Control System Information Sharing and Analysis Center (ICS-ISAC)

ICS-ISAC is a non-profit, public/private Knowledge Sharing Center established to help facilities develop situational awareness in support of local, national and international security.

Jamf

Jamf

Jamf is the only Apple Enterprise Management solution of scale that remotely connects, manages and protects Apple users, devices and services.

DoControl

DoControl

DoControl gives organizations the automated, self-service tools they need for SaaS applications data access monitoring, orchestration, and remediation.

Minorities in Cybersecurity (MiC)

Minorities in Cybersecurity (MiC)

MiC was developed out of a unique passion to help fill the gap that exists in the support and development of women and minority leaders in the cybersecurity field.

Moonlock

Moonlock

Cybersecurity tech for humans. At Moonlock, we make software that seamlessly protects you and has your back as you live your life.

Acclaim Technical Services (ATS)

Acclaim Technical Services (ATS)

ATS provide operational products, services and solutions to the defense and intelligence communities for all types of critical mission needs.

ARGOS Cloud Security

ARGOS Cloud Security

ARGOS aims to simplify and strengthen cloud security, by creating a visual map of security vulnerabilities, to your priceless information stored in any cloud provider environment.

Winslow Technology Group (WTG)

Winslow Technology Group (WTG)

Winslow Technology Group is a leading provider of IT Solutions, Managed Services, and Cybersecurity Services dedicated to providing exceptional business outcomes for our customers since 2003.

SGS Brightsight

SGS Brightsight

SGS Brightsight is the largest independent security evaluation lab in the world, with ten recognised labs worldwide.