Technorati Tag: Security Breach
Date Reported:
2/13/08
Organization:
Lifeblood
Contractor/Consultant/Branch:
None
Victims:
Blood donors
Number Affected:
320,000
Types of Data:
"names, contact information, blood type, gender, ethnicity, and, in some cases, Social Security numbers"
Breach Description:
Two laptop computers are lost and presumed stolen from a storage room at the Lifeblood office building. The laptops contained sensitive and personal information belonging to blood donors.
Reference URL:
Lifeblood Press Release
Commercialappeal.com story
WREG Memphis Channel 3 News
Report Credit:
Lifeblood
Response:
From the online sources cited above:
Two laptop computers are missing from Lifeblood’s possession and presumed to be stolen.
Someone got inside a storage room at the Lifeblood building on Madison and took the computers.
The dual-password protected laptops were used on mobile blood collection drives, and each included information about Lifeblood’s blood donors, including names, contact information, blood type, gender, ethnicity, and, in some cases, Social Security numbers.
[Evan] I have to say, "dual-password protected" sounds very impressive and very secure, but the I should follow-up and say IT'S NOT. I am guessing that one password is for the operating system, which takes less than five minutes to bypass/change and I am also guessing that there is (was) a password to access the database or the program that opens the database. The second password probably isn't that hard to crack/bypass either.
The organization is notifying all of the approximately 320,000 affected individuals about the situation and encouraging them to place fraud alerts on their credit reports in the unlikely event that an unauthorized person gained access to the data on the computers.
[Evan] What a hassle for 320,000 people.
Lifeblood started sending out letters to donors this week, notifying them about what happened.
Based on the level of password security and the intricacies of the database structure, Lifeblood believes that is extremely unlikely that an individual who is not specifically trained to use the laptop and who does not have a valid Lifeblood ID and password could access the information contained on it.
[Evan] If this statement weren't so sad, it would be funny. I could stretch and maybe agree with "unlikely", but I would certainly not go as far as to say "extremely unlikely". It really is easier than most people think.
"Our hope was we'd be able to locate the devices and with that we'd be able to find whether the database had been accessed or not," said Dr. Edward Scott of Lifeblood.
Since the discovery Lifeblood has implemented additional security measures to protect against future theft of property or donor information. These measures include more restrictive access to and continuous closed circuit monitoring of the areas housing the laptops, installation of software to allow remote tracking and erasure of the hard drives on laptops used on mobile drives, and additional programming to prevent full Social Security numbers from being downloaded to mobile laptops.
[Evan] WHERE IS ENCRYPTION? Remote tracking and erasure provides some protection, but it isn't very hard to disable/bypass either to anyone with skill. Nobody breaks strong encryption with sound key management, no matter how skilled they may be. Why does a donor have to supply a Social Security number to donate blood in the first place? What does my blood have to do with my Social Security benefits?
He says a private investigator's been working this case. But with no solid leads, they've now teamed up with Memphis Police.
"We're concerned it may be a former employee. Or someone else who had access to building at the time," said Dr. Scott.
[Evan] Someone did have access or the laptops wouldn't be stolen.
The worry now though is that this breach will discourage people from donating.
"Blood is always going to be needed in the community, there's no substitute for that," said Dr. Scott.
[Evan] This is by far the most intelligent remark of any I have read about this breach. PEOPLE NEED BLOOD AND BLOOD SAVES LIVES. At the end of the day, I would trade my Social Security number to save someone's life.
Commentary:
We have now reported two blood centers that each stored confidential personal information on laptops (without encryption) and had them stolen. The other was Memorial Blood Centers in Minnesota. I don't understand why blood centers need my Social Security number in order for them to take my blood. I assume they use it as a personal identifier. I would much prefer that they create an identifier for me that cannot be used against me later.
I really appreciate all the work that blood centers do for the communities they serve, but they really don't serve the victims well when they don't take the time to properly secure the information they collect.
I cannot think of a good alternative to laptop encryption. Why won't Lifeblood encrypt confidential data at rest?
Past Breaches:
Unknown
Date Reported: 2/13/08
Organization:
Lifeblood
Contractor/Consultant/Branch:
None
Victims:
Blood donors
Number Affected:
320,000
Types of Data:
"names, contact information, blood type, gender, ethnicity, and, in some cases, Social Security numbers"
Breach Description:
Two laptop computers are lost and presumed stolen from a storage room at the Lifeblood office building. The laptops contained sensitive and personal information belonging to blood donors.
Reference URL:
Lifeblood Press Release
Commercialappeal.com story
WREG Memphis Channel 3 News
Report Credit:
Lifeblood
Response:
From the online sources cited above:
Two laptop computers are missing from Lifeblood’s possession and presumed to be stolen.
Someone got inside a storage room at the Lifeblood building on Madison and took the computers.
The dual-password protected laptops were used on mobile blood collection drives, and each included information about Lifeblood’s blood donors, including names, contact information, blood type, gender, ethnicity, and, in some cases, Social Security numbers.
[Evan] I have to say, "dual-password protected" sounds very impressive and very secure, but the I should follow-up and say IT'S NOT. I am guessing that one password is for the operating system, which takes less than five minutes to bypass/change and I am also guessing that there is (was) a password to access the database or the program that opens the database. The second password probably isn't that hard to crack/bypass either.
The organization is notifying all of the approximately 320,000 affected individuals about the situation and encouraging them to place fraud alerts on their credit reports in the unlikely event that an unauthorized person gained access to the data on the computers.
[Evan] What a hassle for 320,000 people.
Lifeblood started sending out letters to donors this week, notifying them about what happened.
Based on the level of password security and the intricacies of the database structure, Lifeblood believes that is extremely unlikely that an individual who is not specifically trained to use the laptop and who does not have a valid Lifeblood ID and password could access the information contained on it.
[Evan] If this statement weren't so sad, it would be funny. I could stretch and maybe agree with "unlikely", but I would certainly not go as far as to say "extremely unlikely". It really is easier than most people think.
"Our hope was we'd be able to locate the devices and with that we'd be able to find whether the database had been accessed or not," said Dr. Edward Scott of Lifeblood.
Since the discovery Lifeblood has implemented additional security measures to protect against future theft of property or donor information. These measures include more restrictive access to and continuous closed circuit monitoring of the areas housing the laptops, installation of software to allow remote tracking and erasure of the hard drives on laptops used on mobile drives, and additional programming to prevent full Social Security numbers from being downloaded to mobile laptops.
[Evan] WHERE IS ENCRYPTION? Remote tracking and erasure provides some protection, but it isn't very hard to disable/bypass either to anyone with skill. Nobody breaks strong encryption with sound key management, no matter how skilled they may be. Why does a donor have to supply a Social Security number to donate blood in the first place? What does my blood have to do with my Social Security benefits?
He says a private investigator's been working this case. But with no solid leads, they've now teamed up with Memphis Police.
"We're concerned it may be a former employee. Or someone else who had access to building at the time," said Dr. Scott.
[Evan] Someone did have access or the laptops wouldn't be stolen.
The worry now though is that this breach will discourage people from donating.
"Blood is always going to be needed in the community, there's no substitute for that," said Dr. Scott.
[Evan] This is by far the most intelligent remark of any I have read about this breach. PEOPLE NEED BLOOD AND BLOOD SAVES LIVES. At the end of the day, I would trade my Social Security number to save someone's life.
Commentary:
We have now reported two blood centers that each stored confidential personal information on laptops (without encryption) and had them stolen. The other was Memorial Blood Centers in Minnesota. I don't understand why blood centers need my Social Security number in order for them to take my blood. I assume they use it as a personal identifier. I would much prefer that they create an identifier for me that cannot be used against me later.
I really appreciate all the work that blood centers do for the communities they serve, but they really don't serve the victims well when they don't take the time to properly secure the information they collect.
I cannot think of a good alternative to laptop encryption. Why won't Lifeblood encrypt confidential data at rest?
Past Breaches:
Unknown
