Criminals spent 10 days in US dental insurer's systems extracting data of 9 million

The criminals who hit one of the biggest government-backed dental care and insurance providers in the US earlier this year hung about for 10 days while they extracted info on nearly 9 million people, including kids from poverty-stricken homes. Managed Care of North America (MCNA) bills itself as "providing high quality …

[Version 1.0]

Payment information has arrived ...

Look at the attached payment information, payment_data_pdf.exe contains your payment details, please open the file and deposit the payments ...

These arrive all the time these days, this is how so many systems fall over - criminal activity is normal now, AI has created huge changes in the business world with users falling over all the time.

[abend0c4]

Medicaid, Children's Health Insurance Program (CHIP), and Medicare

That's quite an amalgam. No doubt they're braced for a tongue-lashing over the fissures in their veneer of security and are whitening as we speak. They will need much wisdom to rebuild bridges, root out the decay in their systems and regain their crown.

[Grogan]

Re: Medicaid, Children's Health Insurance Program (CHIP), and Medicare

It'll be like pulling teeth to get them to smarten up :-)

[Anonymous Coward]

Re: Your copyright violation

Dear Master Grogan, I am sorry to inform you that your "pulling teeth" wisecrack was already used in the body of the article: Sometimes it can be like pulling teeth, right guys? , and that you are now being sued for copyright violation. Fortunately for you, there is help available, if you act quickly before your plug is pulled: https://www.donotcall.gov/register

[Missing Semicolon]

Once again

The criminals (the data holding companies that regard the pitiful fines and compensation a cost of doing business) get away with totally failing to compensate the victims in any meaningful way.

[VoiceOfTruth]

Re: Once again

Not just that, they pass the problem onto the people whose data has been slurped.

-> Those with children whose data was taken in the haul were offered advice in the breach notice on how they could "check to see if someone has created a credit file using my child's information."

Your data has been taken, here is how YOU can check what has happened to it.

[MachDiamond]

Value?

I can see they trotted out the "think of the children" trope by writing about all of the data on poverty stricken kids. I don't see how Big Data will find any value in that. Maybe some graduate student will pay a few bob for some data to use on their dissertation.

I still think that company-ending fines should be on the punishment menu along with prison time for C-level execs if negligence can be demonstrated. It would suck that people would be put out of work, but there would be openings at other insurers that would be picking up loads of new customers.

[J. Cook]

Re: Value?

The fines from HIPAA violations are pretty sizable, I'll note. Unfortunately,, there's a maximum annual cap on how large the fines can be, depending on how it's been classified. And criminal charges *can* be filed against the company officers as well.

[MachDiamond]

Re: Value?

"And criminal charges *can* be filed against the company officers as well."

But they aren't so the downside to being cavalier about PII and data security continues. Why should companies hire good IT security people and keep their hardware/firmware/software security patches up to date if it's less expensive to not spend that money (more left for bonuses and executive retreats in the Bahamas). If an executive making 8 figures a year had a risk of going to prison or losing their position and being banned from an industry for a decade to life, security would be a regular item on their agenda.

[Nifty]

"12 months of credit monitoring with identity theft protection"

So the ID theft will begin in earnest on day 366. The other question that's begged is, shouldn't this sort of protection be built into government, banking and insurance systems already?

[Anonymous Coward]

yup

This is why I don't mind when we find bodies of criminals dumped road side, they are people like this gang, will off each other when paranoid, or an opportunity to take what they took.

[t245t]

The attackers broke into MCNA's servers

"the attackers broke into MCNA's servers"

Why wasn't this information encrypted, to be only accessed with a security fob?

It's like déjà vu all over again, Yogi

[jlturriff]

Oh, yes; that message posted on their website will be a lot of help to low-income victims who don't have internet access...