Banner Health Alerts 3.7 Million Potential Victims of Hack (bannerhealth.com) 30
New submitter Netdoctor writes: Apparently Banner Health is the latest victim of a cyber attack, with the Health conglomerate reporting on two incidents in July. While not all Banner customers were affected, payment details as well as customer information were leaked, according to their news brief. Some 3.7 million people are potentially affected by the attack, including patients, health plan members, healthcare providers and customers at its food and beverage outlets. Card payments for medical services appear to be safe. The company is offering a free one-year membership in monitoring services to those who are affected by the breach. Banner Health said in a statement: âoeThe patient and health plan information may have included names, birthdates, addresses, physiciansâ(TM) names, dates of service, claims information, and possibly health insurance information and social security numbers, if provided to Banner Health."
Good timing (Score:5, Funny)
I only have six free credit monitoring services from previous breaches and two are set to expire in a few months.
Do you feel safer? (Score:2)
Re: (Score:2)
With all those monitoring do you feel safer that nobody can do harm with your personal information?
Yes. I received free monitoring from Home Depot, and my wife got it from Target. So now we get an email alert anytime anyone makes a credit inquiry or applies for credit in our name. That is helpful, but it would make WAY more sense for that to be the default, rather than a special service. These monitoring services are due to expire soon, but I am hoping I will be the victim of yet another breach so I can get another year for free.
Re: (Score:2)
But it won't make the credit reporting agencies any money.
Ever notice how hard it is to get your one free credit report? You normally have to send them a letter by snail mail with a bunch of information on it. And not only do they not provide a simple form to fill out and mail, they want you to write
Re: (Score:2)
Ever notice how hard it is to get your one free credit report?
No. I go to freecreditreport.com, answer a few security questions to prove I am me, and get my report. Takes about 30 seconds.
You normally have to send them a letter by snail mail with a bunch of information on it.
Baloney. I have never had to do that.
I think it's time for the corporate death penalty. (Score:3)
We keep seeing companies losing the highly private health data of millions of people. At this point, in my opinion, the only thing that will stop this is a couple of high-profile companies getting successfully sued or fined out of existence. If companies see the most likely punishment as a small slap on the wrist with little chance of getting caught in the first place, then they'll continue to be sloppy with medical records and other similarly private data. If a couple of dozen insurance companies went Chapter 7 overnight, that would serve as sufficient warning to others that this sort of nonsense will not be tolerated, and the others would be forced to pay attention and take security and privacy seriously.
Re: (Score:2)
We keep seeing companies losing the highly private health data of millions of people. At this point, in my opinion, the only thing that will stop this is a couple of high-profile companies getting successfully sued or fined out of existence. If companies see the most likely punishment as a small slap on the wrist with little chance of getting caught in the first place, then they'll continue to be sloppy with medical records and other similarly private data. If a couple of dozen insurance companies went Chapter 7 overnight, that would serve as sufficient warning to others that this sort of nonsense will not be tolerated, and the others would be forced to pay attention and take security and privacy seriously.
Now that you're done with your call to have warning signs written in their blood with accompanying heads on a pike in order to form a lynch mob that you will so gloriously lead and people will forever hail your name, somebody should mention that Banner isn't exactly a wall-street darling since it's a non-profit organization. Furthermore if they were fined or otherwise sued out of existence, it would kind of suck for people like me who are presently listed for organ transplant through them, in addition to th
Re: (Score:2)
I can't give them a free pass just for being a nonprofit. The same HIPAA laws apply to them as to a for-profit company. And somebody will get screwed if any health insurance/care provider (for-profit or otherwise) disappears or has to scale back because of huge financial overruns from fines due to gross negligence with patient data. But the alternative to that is to not punish anyone for HIPAA violations, and if there's no punishment for breaking the law, there's no incentive to do the right thing, and
Re: (Score:2)
I didn't say give them a free pass. What I'm saying is that if they were sued out of existence, that would suck for a LOT of people first of all, second of all, it's interesting how of all parties involved in this, you choose to blame the victim the most.
Besides, with how the industry works, Banner will very likely see a fine in the hundreds of millions of dollars. Just a few weeks ago another hospital got fined 10 million just for having an unsecured wifi that didn't even connect to their internal network,
Re: (Score:1)
this is at least partially the government's fault for mandating electronic health records. if it's digital it is easier to duplicate; if it's online, it is practically an invitation to hack. combine the two it is destined to be an absolute failure.
how many breeches of patient data were there when records were on paper?
Re: (Score:2)
the only thing that will stop this is a couple of high-profile companies getting successfully sued or fined out of existence.
That would likely have the opposite effect: It would encourage companies to cover up breaches, and notify no one. Most experts already believe that only a small fraction of breaches are publicly reported. Draconian punishment of those trying to be responsible would not be helpful.
Why Try (Score:3, Insightful)
Why even try to secure information anymore - just make it all public.
Only need a way to not use all this info to spoof an identity for financial gain. If the Social Security Admin listed all the names & birthdays & numbers online, I'm sure industry would figure it out. Right?
Re:Why Try (Score:4, Insightful)
Why even try to secure information anymore - just make it all public.
Bingo. This is the solution. It is idiotic to have numbers, including SSNs and CC numbers, that need to be both secret and widely known. Everyone I have ever done business with (as an employee, contractor, contractee, patient, client, etc.) knows my SSN. Every waiter in most local restaurants has had access to my CC numbers along with the super secret 3-digit code that is printed directly on the card in plain view. It is absurd that someone can establish and use credit in my name with mere knowledge of these numbers. These numbers should be public so there can be no presumption that they are secret, and there should be a separate system of authentication that is not based on knowing semi-public information.
Re: (Score:2)
Did you just mean making SSNs public? They should be public info, like our names/address, but the number is being used as both an ID (by some) AND the password (by others). It should only be used as a ID key; utilizing it as a password is asinine.
If you meant ALL information public... That would be ok as long as it remained as anonymous data (which makes it worthless). Once it becomes "information" (grouped into meaningful data about something or someone), no thanks. If you want to, go ahead - but we'll be
Re: (Score:1)
I only meant what most people classify as personally identifiable, but already shared information: name, address, phone numbers, email, social media handles, SSN, birthdate, stuff like that.
We need some other mechanism than a hidden number that is shared with many institutions to verify identity. And biometric data doesn't work either as it can be cloned (e.g. 3D print a fingerprint from a scan, etc).
Re: (Score:2)
Thoughts and prayers (Score:2)
Funny how one set of human laws never apply to corporate 'persons': Responsibility.
Re: (Score:2)
I guess it is a good time to be in the credit monitoring business...
details on the hack! (Score:2)
the actual data attack has no real info, i can see public payment computers/kiosks for foodmart hacked ala Target POS hack, but the system hack of data how was that accomplished unless the payment processing public terminals are also connected to their internal databases? or they have other systemic problems!