How Costly Can Data Breaches Be?
Recently, the state of Utah learned that a data breach a year ago is likely to be more 30 times more costly than originally estimated.
In late March 2012, hackers broke into a Medicaid server that a technician had placed online without changing the default simple factory password and then proceeded to downloaded the personal information over 750,000 people. Some of these people were on Medicaid, but the breach also affected those who were the privately insured, uninsured and retirees on Medicare. Of those people, 280,000 people had their Social
Security numbers exposed, which puts them at higher risk of fraud.
Initially, it was thought that less than 25,000 people had their information put at risk. The executive director of the state’s Department of Technical Services lost his job over the incident.
Utah’s Medicaid Management Information System, which receives eligibility inquiries and billing information from providers, was not protected by a firewall as it was upgrading on March of 2012, when hackers in Eastern Europe first gained access to the state server.
That server was also installed by an independent contractor a year earlier, violating the procedures that were normally in place to ensure that new servers are monitored and a risk assessment performed prior to use. This also meant that factory-issued default passwords were still in effect on the server. The final mistake was that this information stayed on the server for too long and while it was there, it was not encrypted, leaving
it vulnerable to hackers who began downloading as far back as March 30, 2012.
More than a year later, the state estimated the damage to be over $9 million, with $3.4 million coming from the department. This includes $467,000 to hire an ombudsman,staff a hotline, run ads and hold community meetings to notify victims; $1.9 million to provide two years of credit monitoring for those whose Social Security numbers were compromised; $741,000 on for a legal consultant and forensic security audit; and $300,000 to create an Office of Health Information and Data Security. The state also spent $1.2 million on a review of other state servers and $4.4 million to increase security.
According to security auditors who examined the breach, state residents and businesses face potential fraud of up to $406 million. Based on the auditors calculations, 122,000 cases of fraud will occur as a result of this breach, with each incident resulting over $3,330.00 of loss. It was also estimated that data theft will cost victims over $770.00 in out of pocket costs and require and average of 20 hours to resolve these cases.
Further is was estimated that victims of the data theft now have a 1 in 4 chance of having their information being used using fraudulently.
What can you do to prevent similar types of data breaches?
- Use strong passwords that are changed or a regular basis.
- Use encryption tools (where available) to encrypt sensitive data such as Credit Cards andSocial Security Numbers.
- Make sure that your Operation System and Application Security Service Packs are up to date.
- Make sure that your Anti-Virus and Anti-Malware systems are updated and logs checked frequently.
If you would like CCS to perform a security review, or need assistance with encrypting data, please contact the CCS Retail Systems Support Department.
– John