Confidential Data On 24.3m Patients Found Exposed Online

Between mid-July 2019 and early September 2019, Greenbone Networks carried out an analysis of approximately 2,300 medical image archiving systems connected to the public Internet.  Greenbone’s analysis shows that several hundred PACS servers worldwide are connected to the public Internet without any kind of protection for the personal and medical data stored on them. 

A considerable number of these systems even allow access to the individual image data of any patient. Now Greenbone Networks has released details of this new research in to the security of the servers used by health providers across the world to store images of X-rays as well as CT, MRI and other medical scans.

Of the 2,300 medical image archive systems worldwide that Greenbone analysed between mid-July and early September 2019, 590 of them were freely accessible on the Internet, together containing 24.3 million data records from patients located in 52 different countries.

In the UK, approximately 1,500 patient data records are publicly accessible, as well as around 5,000 images associated with these records. In the US, the number is orders of magnitude higher with 13.7 million data sets and 45.8 million images freely accessible on the internet. 

As an estimate derived from previous attacks and investigations by various security authorities, the value of this data on the Darknet would probably be in excess of one billion US dollars. 

Available data included patient names, dates of birth, dates of examination and some medical information about the reason for examination. For US patients (which make up 13.7 million of the compromised records), it also included Social Security numbers. More than 737 million images were linked to this patient data, with approximately 400 millions of these accessible or easily downloadable via the internet. In addition, 39 of these imaging servers allowed access to patient data via an unencrypted HTTP web viewer, without any level of protection.

Dirk Schrader, cyber resilience architect at Greenbone Networks who lead the research has said: “The data pertaining to millions of patients is there for anyone to access simply because of the careless configuration of these medical archiving servers. 

“A significant number of these servers have no protection at all, they aren’t password protected and have no encryption. Indeed, everyday internet users could gain access to these servers with very little effort, there’s no need to write any code or deploy any specialist hacking tools..... Health providers need to act now to secure their systems, not just because they could be in breach of regulations such as GDPR in the EU and HIPAA in the US, but because they are putting their patients at risk. 

“This data could be used to commit identity theft, highly-specialised phishing campaigns or even for extortion, where medical information is weaponised to blackmail people in the public eye.”

HelpNetSecurity:             Greenbone:

You Might Also Read:

Healthcare Organisations In The Cloud:

The Dangers Of Internet-of-Things In Healthcare:

 

« By 2021 The Cost Of Cybercrime Will Be $6 Trillion
New US Cyber Attacks On Iran »

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

DigitalStakeout

DigitalStakeout

A simple and cost-effective solution to monitor, investigate and analyze data from the web, social media and cyber sources to identify threats and make better security decisions.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

IRM Security (IRMS)

IRM Security (IRMS)

IRM is an international consultancy dedicated to helping organisations solve key business issues. We provide strategic cyber security advice across a wide range of sectors.

ACID Technologies

ACID Technologies

ACID provide a supplementary layer of protection by performing searches to detect potential threats and risks before actual attacks commence.

HoxHunt

HoxHunt

HoxHunt is an automated cyber training program that transforms the way your employees react and respond to the growing amount of phishing emails.

Stealthcare

Stealthcare

Stealthcare is a full service, global cyber security firm offering solutions that educate, empower and protect.

Span

Span

Span designs, develops and maintains information systems based on advanced technological solutions of global IT leaders.

NSIT

NSIT

NSIT SAS is a consulting, advisory and service provider in IT systems. Solution areas include networking & infrastructure, IT management & administration, and cyber security.

Salt Security

Salt Security

Salt Security protects the APIs that are the core of every SaaS, web, mobile, microservices and IoT application.

HARMAN International

HARMAN International

HARMAN designs and engineers connected products and solutions for automakers, consumers, and enterprises worldwide.