<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: beneficiaries]]></title>
    <link>http://securityratty.com/tag/beneficiaries</link>
    <description></description>
    <pubDate>Thu, 20 Dec 2007 09:15:59 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Digital Cash in Iraq]]></title>
      <link>http://securityratty.com/article/84493590b736c33ff0c22bfa1fc5590a</link>
      <guid>http://securityratty.com/article/84493590b736c33ff0c22bfa1fc5590a</guid>
      <description><![CDATA[Smart cards have still never quite taken off across the US, and at this point its fair to wonder if they will or if they will be eclipsed by phones or some such, but smart cards sure are big outside...]]></description>
      <content:encoded><![CDATA[<p>Smart cards have still never quite taken off across the US, and at this point its fair to wonder if they will or if they will be eclipsed by phones or some such, but smart cards sure are big outside the US. One of the most interesting applications is of course digital cash and transaction processing. <a href="http://www.aplitec.co.za/">Net1 UEPS</a>&#160;(ticker: <a href="http://finance.google.com/finance?q=ueps">UEPS</a>) out of South Africa appears to be the leader here having built a $1.2B business out of this model. there are lots of regions in the world where people are underbanked or unbanked altogether and where its dangerous to have too much cash. I blogged about this earlier on <a href="http://1raindrop.typepad.com/1_raindrop/2007/08/beer-shotguns-a.html">Beer, Shotguns and Digital Cash</a>.&#160;</p><br /><div>Now <a href="http://biz.yahoo.com/iw/080804/0421781.html">Net1 UEPS is in Iraq as well</a>:</div><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: arial; line-height: normal; ">The first UEPS transaction was performed on Sunday, August 3, 2008, in Baghdad, Iraq, during the official launch of the UEPS smart card technology with the two state banks namely, Rafidain Bank and Rasheed Bank.</span></p></blockquote><div><span style="font-family: arial; line-height: normal;"><br /></span></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: arial; line-height: normal; ">The official launch, attended by invitees from Rafidain Bank, Rasheed Bank, the Iraqi Government, War Victim Ministry and Martyrdom Ministry, demonstrated smart card registration, biometric enrolment and issuing of UEPS cards, offline loading of wage payments and government grants to the UEPS cards and dispensing of cash.</span><br /><span style="font-family: arial; line-height: normal; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: arial; line-height: normal; ">The pilot project involving 100,000 beneficiaries is now ready for implementation across selected bank branches and will enable the distribution and payment of government grants to war victims and martyrdom beneficiaries, as well as salary and wage distribution and payment to employees of the two state banks.</span><br /><span style="font-family: arial; line-height: normal; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: arial; line-height: normal; ">Brenda Stewart, Net1 Senior Vice President Sales and Marketing, said, &quot;From the entire team at Net1, we congratulate the Iraqi consortium on this historic achievement and look forward to the successful implementation of the various projects already identified for implementation, as well as the projects currently in business development. Net1 is proud that the development of its core technology, from which it creates end-user products that satisfy the requirements of its customers, can change the way business is conducted leading to the improvement of people&#39;s lives. We share the belief of our Iraqi partners that our technology can play a fundamental role in the upliftment of the economy. The success of any technology should be measured, not only by the profits it generates for its inventors, suppliers and users, but also by the difference that it makes to the lives of people,&quot; Stewart concluded.</span></p></blockquote><div><span style="font-family: arial; line-height: normal;"><p>I think there are lessons to be learned here wrt data and message level security. Net1 UEPS is a good example a of system carrying valuable assets across hostile terrain, web security architecture can learn a lot from this model.</p><p>P.S. If you are a <a href="http://en.wikipedia.org/wiki/Joel_Greenblatt">Joel Greenblatt</a> geek - UEPS is a <a href="http://www.magicformulainvesting.com/">magic formula stock</a>&#160;(meaning they make cash and are priced cheaply) last time I checked.</p><p></p></span></div>]]></content:encoded>
      <pubDate>Mon, 11 Aug 2008 08:53:52 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ueps cards">ueps cards</category>
      <category domain="http://securityratty.com/tag/ueps">ueps</category>
      <category domain="http://securityratty.com/tag/digital cash">digital cash</category>
      <category domain="http://securityratty.com/tag/cash">cash</category>
      <category domain="http://securityratty.com/tag/net1 ueps">net1 ueps</category>
      <category domain="http://securityratty.com/tag/bank">bank</category>
      <category domain="http://securityratty.com/tag/net1">net1</category>
      <category domain="http://securityratty.com/tag/rafidain bank">rafidain bank</category>
      <category domain="http://securityratty.com/tag/ueps transaction">ueps transaction</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/08/digital-cash-in-iraq.html">Digital Cash in Iraq</source>
    </item>
    <item>
      <title><![CDATA[CBAC & Medical Identity Theft]]></title>
      <link>http://securityratty.com/article/02105d066a63c57c66a00f92ef63e99d</link>
      <guid>http://securityratty.com/article/02105d066a63c57c66a00f92ef63e99d</guid>
      <description><![CDATA[Good story to keep in mind for those of you working on CBAC. Claims neeed protection and verification. Why steal an identity when you can capture a claim? (hattip: askelizabeth
The Sopranokovs
The...]]></description>
      <content:encoded><![CDATA[<p>Good story to keep in mind for those of you working on CBAC. Claims neeed protection and verification. Why steal an identity when you can capture a claim? (hattip: <a href="http://askelizabeth.typepad.com/weblog/2008/07/medical-identity-theft-the-new-frontier-for-organized-crime.html">askelizabeth</a>)

</p><blockquote><p>
	The Sopranokovs 
	</p></blockquote><blockquote><p>The Russian mob comes to town with a new scam—medical identity theft. 	
	</p></blockquote><blockquote><p>When FBI special agent Ted Price peered through the window of a dingy brick storefront on Southwest Morrison Street in March, it was what he didn’t see that caught his attention. 	</p></blockquote><blockquote><p>The business, called UnimedCorner, claimed to provide ailing seniors with orthotics—braces and other devices to correct foot, joint and back problems. 	
	</p></blockquote><blockquote><p>Price and other federal investigators were skeptical. 	
	</p></blockquote><blockquote><p>On Unimed’s showroom floor, Price saw wheelchairs, motorized scooters, a variety of canes and, on the walls, a selection of amateurish paintings and framed photographs. There was no evidence, however, of the kinds of equipment for which Unimed had billed Medicare nearly $2 million in the previous couple of months. 	
	</p></blockquote><blockquote><p>“I observed wheelchairs and canes through the window but did not see any orthotics in the store,” Price later wrote in a search-warrant affidavit. “It is a sign of fraud that the store is not stocking the items [for which] it is billing.” 	
	</p></blockquote><blockquote><p>By the time Price arrived on the scene, the company’s owner, a shadowy Russian immigrant named Alexandr Shcherbakov, was long gone. 	
	</p></blockquote><blockquote><p>Today, Shcherbakov’s store sits undisturbed. The message light on the phone blinks, dead potted plants droop and a stuffed toy monkey slumps in a glass display case. 	
	</p></blockquote><blockquote><p>And behind the cash register hangs a framed poster of television’s best-known mobsters, the Sopranos. 	
	</p></blockquote><blockquote><p>From interviews and information presented in federal affidavits, it is clear Shcherbakov moved to Oregon to commit a crime elegant and lucrative enough to make Tony Soprano envious: medical identity theft. 	
	</p></blockquote><blockquote><p>... 	
	</p></blockquote><blockquote><p>“Medical identity theft is the new frontier for organized crime,” says Alex Johnson, a former FBI agent who investigates fraud for Regence BlueShield. “Pretty much anybody can set up a mom-and-pop operation and start cranking out claims.”
	
	Someday, most Americans will need a cane, wheelchair, home hospital bed or another of the items healthcare professionals call “durable medical equipment,” or DME. 	
	</p></blockquote><blockquote><p>For those over 64 and without private insurance, there’s a good chance federally funded Medicare will pick up the tab for that equipment. Last year, according to federal statistics, Medicare spent $8.6 billion on DME. 	
	</p></blockquote><blockquote><p>Here’s the way the system is supposed to work: A doctor prescribes a device such as a wheelchair for a patient, who presents his prescription to a DME supplier. The supplier provides the equipment and bills Medicare, which typically pays 80 percent of the cost.
	
	Unlike pharmacists, who fill prescriptions under strict scrutiny of state and federal watchdogs, DME suppliers are lightly regulated.
	
	“DME is very vulnerable to fraud,” says Consuelo Woodhead, the chief healthcare fraud prosecutor for the U.S. Attorney’s Office in Los Angeles. “It doesn’t require any background in medicine, any kind of professional licensure or appreciable capital. </p></blockquote><blockquote><p>There are barriers of entry in other medical fields, but not in DME.”
	
	To operate, DME suppliers simply need a place of business, a business license and liability insurance. Unlike pharmacists, DME suppliers operate under an honor system: The feds count on them to supply the equipment they claim to provide to the beneficiaries who need it. 	
	</p></blockquote><blockquote><p>That honor system is not working. 	
	</p></blockquote><blockquote><p>The epicenter of DME fraud, according to the federal Department of Health and Human Services, is South Florida, where Medicare billing for DME quadrupled from 2002 to 2006 to $1.7 billion.
	
	Investigators found much of that increase was due to fraud. In 2006, federal inspectors revoked the licenses of 634 DME suppliers in South Florida, nearly half the DME dealers in the region. </p></blockquote><blockquote><p>Later the same year, raids in Southern California yielded similar results: The feds shut down 95 DME suppliers.
	
	Many of the DME suppliers shut down around Los Angeles were run by immigrants from the former Soviet Union. It’s probably no coincidence that when the feds raided Los Angeles DME suppliers, some Angelenos fled to cities where there was less scrutiny—such as Portland.</p></blockquote>]]></content:encoded>
      <pubDate>Thu, 10 Jul 2008 06:09:41 +0000</pubDate>
      <category domain="http://securityratty.com/tag/dme suppliers simply">dme suppliers simply</category>
      <category domain="http://securityratty.com/tag/dme suppliers">dme suppliers</category>
      <category domain="http://securityratty.com/tag/dme fraud">dme fraud</category>
      <category domain="http://securityratty.com/tag/fraud">fraud</category>
      <category domain="http://securityratty.com/tag/dme">dme</category>
      <category domain="http://securityratty.com/tag/identity">identity</category>
      <category domain="http://securityratty.com/tag/medical identity theft">medical identity theft</category>
      <category domain="http://securityratty.com/tag/dme dealers">dme dealers</category>
      <category domain="http://securityratty.com/tag/dme supplier">dme supplier</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/07/cbac-medical-identity-theft.html">CBAC &amp; Medical Identity Theft</source>
    </item>
    <item>
      <title><![CDATA[Walter Reed Army Medical Center breach through P2P]]></title>
      <link>http://securityratty.com/article/9729c053ac7d1be346029b81accc1754</link>
      <guid>http://securityratty.com/article/9729c053ac7d1be346029b81accc1754</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/2/08

Organization
United States Army

Contractor/Consultant/Branch
Walter Reed Army Medical Center (&quot;WRAMC

Victims
Military Health System...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/walterreed.jpg" align="right" height="107" width="197"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/2/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.army.mil/">United States Army</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.wramc.amedd.army.mil/Pages/default.aspx">Walter Reed Army Medical Center ("WRAMC")</a> <br><br><span style="font-weight: bold;">Victims:</span><br>"Military Health System beneficiaries" or patients<br><br><span style="font-weight: bold;">Number Affected:</span><br>~1,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"Names, Social Security numbers, birth dates and other information"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"WASHINGTON (AP) — Sensitive information on about 1,000 patients at Walter Reed Army Medical Center and other military hospitals was exposed in a security breach, sparking identity theft concerns and an investigation by the Army."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.wramc.amedd.army.mil/Lists/WRNews/DispForm.aspx?Id=68&amp;">Walter Reed Army Medical Center News</a> <br><a href="http://ap.google.com/article/ALeqM5ggIYzqvXf4Qosf6ubPXxZRRAMPEAD9127N4O0">Associated Press</a> <br><a href="http://www.wishtv.com/Global/story.asp?S=8413762">WISH TV Channel 8 News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Walter Reed Army Medical Center<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>WASHINGTON (AP) — Sensitive information on about 1,000 patients at Walter Reed Army Medical Center and other military hospitals was exposed in a security breach, sparking identity theft concerns and an investigation by the Army.<br><br>Names, Social Security numbers, birth dates and other information was released, hospital officials said Monday.<br><span style="font-style: italic;">[Evan] This information belongs mostly to military personnel that were patients of WRAMC.&nbsp; The victims are the people that defend this country.&nbsp;&nbsp; Grrr.</span><br><br>The computer file that was breached did not include information such as medical records, or the diagnosis or prognosis for patients, they said.<br><br>Walter Reed officials declined to explain exactly how the information was compromised, pending an ongoing investigation by the hospital and the Army.<br><span style="font-style: italic;">[Evan] There is more insight into the cause of the breach below.&nbsp; Keep reading.</span><br><br>Preliminary results of an on-going investigation have identified a computer from which the data was apparently compromised.<br><br>Data security personnel from Walter Reed and the Department of the Army continue to investigate the source and causes for the information compromise.<br><br>The medical center learned of the breach on May 21 from an outside data mining company, which officials did not identify.<br><br>the company was working for another client, found the file and contacted Walter Reed.<br><br>The hospital said it is working to notify all of the people named in the data file. Letters or e-mails were being sent out, beginning Monday.<br><br>The chairman of the House Armed Services Committee, Rep. Ike Skelton, D-Mo., said he wants to hear from the Army about its investigation.<br><br>"It's very troubling when private data is inappropriately released," Skelton said. "We must ensure that personal information is protected and prevent any future compromise of patient records."<br><span style="font-style: italic;">[Evan] Obviously easier said than done.</span><br><br>Walter Reed plans to offer free credit protective services to patients whose information was revealed.<br><br>The hospital also has set up a hot line for people to call to see if their information was disclosed (1-877-854-8542, ext. 9).<br><br>The Health Insurance Portability and Accountability Act of 1996 protects patients from unauthorized release of their health records. The Walter Reed Army Medical Center has a robust information assurance program that meets all program standards and requirements. The compromised data file did not include protected health information such as medical records, diagnosis or prognosis for patients.<br><br><span style="font-weight: bold;">Message to "Team WRAMC" from COL Patty Horoho:</span><br>I want to ensure that each of you have an understanding of what may be in the papers regarding possible disclosure of personal data. Walter Reed officials were notified of a possible disclosure of personally identifiable information through a Peer to Peer (P2P) network of approximately 1000 Military Health System beneficiaries. The information did NOT contain any protected health information such as medical records, diagnosis or prognosis for patients. The individuals impacted have been identified and we are taking a proactive approach to contact them to assist in providing fraud protection services. Below is the media release we sent out will provide more details. A 24/7 hotline has been established in the Combined Operations Center, 202-782-8333 or 877-854-8542 ext 9 and a info site on the web page is also being created. <br><br>I need everyone to ensure that they are not loading or down loading programs that are not authorized by the command as it increases our vulnerability and possibly can cause a breach in protected information being shared. <br><br><span style="font-weight: bold;">Commentary:</span><br>So the cause of this breach was an unauthorized installation and configuration of a Peer to Peer (P2P) program.&nbsp; My concerns about this revolve around the ability to install the application and the inability of WRAMC personnel to block and/or detect the network traffic.&nbsp; <br><br>The installation of computer programs on a computer usually require elevated privileges such as administrative access.&nbsp; Are users of WRAMC information resources also administrators of their systems?&nbsp; If so, this is generally not a good idea.<br><br>P2P programs such as BitTorrent, Morpheus, Lime Wire, etc. are dependent upon a network to work, thus the "Peer to Peer".&nbsp; Most, if not all P2P network traffic is easy to block and/or detect with any combination of filtering, network access control and intrusion detection or prevention.&nbsp; Are these technologies not in use at WRAMC?<br><br>Lastly, what is WRAMC policy with respect to acceptable use and network access?&nbsp; There is no mention in the news reports. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>April, 2008 - <a href="http://breachblog.com/2008/04/13/usaasc.aspx">Excel Spreadsheet on the web exposes Army officers and civilians</a> </font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/03/walterreed.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 03 Jun 2008 05:14:34 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/walter reed">walter reed</category>
      <category domain="http://securityratty.com/tag/sensitive information">sensitive information</category>
      <category domain="http://securityratty.com/tag/wramc personnel">wramc personnel</category>
      <category domain="http://securityratty.com/tag/wramc">wramc</category>
      <category domain="http://securityratty.com/tag/network access control">network access control</category>
      <category domain="http://securityratty.com/tag/network access">network access</category>
      <category domain="http://securityratty.com/tag/team wramc">team wramc</category>
      <source url="http://breachblog.com/2008/06/03/walterreed.aspx">Walter Reed Army Medical Center breach through P2P</source>
    </item>
    <item>
      <title><![CDATA[LPL Financial reports eighteen compromised logons]]></title>
      <link>http://securityratty.com/article/cacd9aa988fd370cb50e60d379a7975a</link>
      <guid>http://securityratty.com/article/cacd9aa988fd370cb50e60d379a7975a</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/6/08

Organization
LPL Financial

Contractor/Consultant/Branch
None

Victims
Customers

Number Affected
10,219

Types of Data
names, addresses, phone...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/lpl.jpg" align="right" height="60" width="200"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>5/6/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.lpl.com/">LPL Financial</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>10,219<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, addresses, phone numbers, account numbers, Social Security numbers, and dates of birth"<br><br><span style="font-weight: bold;">Breach Description:</span><br>LPL Financial recently notified the Maryland State Attorney General of a breach in which "hackers compromised the logon passwords of fourteen financial advisors and four assistants of LPL Financial ("LPL")."&nbsp; The "hackers used these passwords to gain access to customer accounts in order to "pump and dump" penny stocks."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.oag.state.md.us/idtheft/Breach%20Notices/ITU-152079.pdf">Maryland State Attorney General breach notification</a>&nbsp; <br><br><span style="font-weight: bold;">Report Credit:</span><br>Maryland State Attorney General<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>We write to advise you of incidents in which hackers compromised the logon passwords of fourteen financial advisors and four assistants of LPL Financial ("LPL").<br><span style="font-style: italic;">[Evan] How does a "hacker" compromise usernames and passwords of eighteen people working for the same company?&nbsp; Compromised logon server, spear phishing, malware?</span><br><br>To our knowledge, the hackers used these passwords to gain access to customer accounts in order to "pump and dump" penny stocks.<br><br>Attempted transactions were intercepted and either rejected or reversed.<br><br>No losses were passed on to customers<br><br>Hackers compromised the logon passwords of fourteen financial advisors and four assistants in branch offices located in New Jersey, Illinois, Rhode Island, Pennsylvania, Colorado, Texas, California, Georgia and Connecticut over the course of several months.<br><br>These incidents affected approximately 10,219 individuals<br><br>The information that was potentially accessible included unencrypted names, addresses and Social Security numbers of customers and non-customer beneficiaries.<br><span style="font-style: italic;">[Evan] I don't know the architecture of LPL's network or other infrastructure components, but I question why customers or financial advisors need access to Social Security numbers as part of a trading system.&nbsp; I know that LPL needs to store Social Security numbers for tax and other reporting purposes, but financial advisors, traders and customers don't need access to them.</span><br><br>At this time, LPL has no specific knowledge that any customer information was accessed or misused as a consequence of the breach<br><br>We also are unaware of any personal instance of identity theft related to these incidents.<br><br>LPL learned of the first incident on July 16, 2007 and took the following actions: (1) notified law enforcement; (2) notified our primary regulator, the Financial Industry Regulatory Authority; (3) investigated the situation; (4) determined what information had been compromised; and (5) notified and offered solutions to the affected individuals.<br><br>LPL has taken several important steps to improve its level of data security and compliance<br><br>LPL has increased the profile of data security issues within the company at all levels, up to and including senior management.<br><br>In March 2008, LPL hired Marc Loewenthal as SVP - Chief Security/Privacy Officer, a newly created position at LPL.<br><span style="font-style: italic;">[Evan] This is the first breach notification that I have read that included this type of information.&nbsp; I don't know Mr. Loewenthal (which doesn't say too much), but I do know that he is stepping into a pressure situation.</span><br><br>Mr. Loewenthal has extensive experience in the area of data protection.&nbsp; As a member of senior management, he reports directly to the Chief Risk Officer of LPL.<br><span style="font-style: italic;">[Evan] I like when I read about information security personnel occupying "senior management" positions.&nbsp; Effective information security management needs to be as "senior" as possible in order to effect change in the organization.&nbsp; Information security governance is NOT an IT issue, but an organizational issue.&nbsp; There needs to be more good CISOs and CSOs.</span><br><br>In addition, LPL has developed a new, comprehensive information privacy and security program with new policies and procedures that were implemented in April 2008.<br><br>In August 2007, LPL engaged the services of Kroll Inc. ("Kroll"), a risk consulting company, to provide various services<br><br>In addition, LPL has commenced a project to enhance security on its advisor facing trading and operations systems in September 2007 and expects the project to complete in December 2008.<br><span style="font-style: italic;">[Evan] Details are not available, but I would be interested in knowing more.&nbsp; Maybe removal of SSNs from the advisor facing trading systems and two-factor authentication are part of the mix.</span><br><br>Finally, LPL recently engaged the services of Edwards Angell Palmer &amp; Dodge LLP to advise Mr. Loewenthal and LPL's in-house counsel as needed on information privacy and security issues.<br><br>LPL Financial is providing affected individuals with credit protection services from Kroll, Inc.<br><br>If you have any questions or feel you have an identity theft issue, please call ID TheftSmart at 1-800-588-9839 between 9:00 a.m. and 6:00 p.m. (Eastern Time), Monday through Friday.<br><br>If you want to talk to someone at LPL Financial to clarify or discuss the contents of this letter, please call us 1-800-558-7567, option 3 - Customer Service, between 9:00 a.m. and 6:00 p.m. (Eastern Time), Monday through Friday.<br><br>We apologize for any inconvenience or concern this situation may cause.<br><br>We at LPL Financial believe it is important for you to be fully informed of any potential risk resulting from this incident.<br><br>We remain committed to maintaining customer privacy as a key priority and will continue to take the needed steps to protect your information.<br><br><span style="font-weight: bold;">Commentary:</span><br>What makes this breach so interesting to me is the fact that there were at least 18 points of attack.&nbsp; I don't get the feeling that this was some sophisticated high-tech "hack" of LLP Financial's systems.&nbsp; It is much easier to craft an email or call someone and convince them to give you their login information.&nbsp; <br><br>Good luck Mr. Loewenthal, I'm sure you'll do fine! <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/05/20/lpl.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 20 May 2008 04:56:31 +0000</pubDate>
      <category domain="http://securityratty.com/tag/lpl financial">lpl financial</category>
      <category domain="http://securityratty.com/tag/lpl">lpl</category>
      <category domain="http://securityratty.com/tag/lpl financial recently">lpl financial recently</category>
      <category domain="http://securityratty.com/tag/lpl recently">lpl recently</category>
      <category domain="http://securityratty.com/tag/login information">login information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/information security governance">information security governance</category>
      <category domain="http://securityratty.com/tag/information privacy">information privacy</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <source url="http://breachblog.com/2008/05/20/lpl.aspx">LPL Financial reports eighteen compromised logons</source>
    </item>
    <item>
      <title><![CDATA[Cashing in on employee theft, or honest whistleblower?]]></title>
      <link>http://securityratty.com/article/6220385518c92bd41671151d57327dcd</link>
      <guid>http://securityratty.com/article/6220385518c92bd41671151d57327dcd</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
2/22/08

Organization
LGT Group - The Wealth and Asset Management Group of the Princely House of Liechtenstein
English Version
German Version
French...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/lgt.jpg" align="right" height="67" width="71"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>2/22/08<br><br><span style="font-weight: bold;">Organization: </span><br>LGT Group - The Wealth and Asset Management Group of the Princely House of Liechtenstein<br><a target="_blank" href="http://www.lgt.com/en/index.html">English Version</a> <br><a target="_blank" href="http://www.lgt.com/de/index.html">German Version</a> <br><a target="_blank" href="http://www.lgt.com/fr/index.html">French Version</a> <br><a target="_blank" href="http://www.lgt.com/it/index.html">Italian Version</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>LGT Treuhand AG<br>(LGT Trust Ltd in English)<br><br><span style="font-weight: bold;">Victims:</span><br>Clients of LGT Trust (prior to 2002)<br><br><span style="font-weight: bold;">Number Affected:</span><br>~1,400*<br><br><font size="1">*there may be an additional 4,527 beneficiaries affected.</font><br><br><span style="font-weight: bold;">Types of Data:</span><br>Confidential bank account information.<br><br><span style="font-weight: bold;">Breach Description:</span><br>Confidential customer information was stolen from LGT Trust in 2002 by a former employee of the company.&nbsp; As a result of this breach, Heinrich Kieber was convicted of "serious fraud, dangerous threats, unlawful compulsion, and suppression of documents."&nbsp; Now it appears that German authorities paid Mr. Kieber "as much as 5 million euros ($7.4 million)" for information about German account holders for the purpose of investigating tax evaders.&nbsp; Other countries that are interested in the information allegedly stolen by Mr. Kieber include the United Kingdom (U.K.), the United States (U.S.), Australia and others.&nbsp; Mr. Kieber now has a new identity (possibly as part of the arrangement with Germany) and his whereabouts are unknown.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a target="_blank" href="http://www.lgt.com/export/sites/inta_lgtcom/_news/attachments/080224_LGT_Media_Release_en.pdf">LGT Group Media Communique dated 2/24/08</a> <br><span style="font-style: italic;">[Evan] Highly recommended interesting read</span><br><a target="_blank" href="http://www.theaustralian.news.com.au/story/0,25197,23276025-601,00.html">The Australian online news story</a> <br><a target="_blank" href="http://www.bloomberg.com/apps/news?pid=20601085&amp;sid=atBBrvCnsT6w&amp;refer=europe">Bloomberg.com online news story</a> <br><a target="_blank" href="http://www.marketwatch.com/news/story/uk-authorities-have-liechtenstein-tax/story.aspx?guid=%7BC132E3BB-306E-46C9-B4D0-37F2CBD5C4A2%7D">MarketWatch online news story</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Chad Thomas, Bloomberg.com<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>For LGT Group, all the facts now point - despite contradictory statements form sources said to be close to the German intelligence service - to the fact that the data material illegally disclosed to the German authorities is limited, in as far as LGT is concerned, to the client data stolen from LGT Treuhand in 2002.<br><br>Even though other rumors have been circulated about the occurrences, LGT Group is assuming on the basis of numerous indications that the person, who illegally passed the data on to the German intelligence service, is the same former employee of LGT Treuhand who stole the data in 2002.<br><br>Apparently, the stolen data material has also been illegally disclosed, directly or indirectly, to other authorities.&nbsp; According to reports in the media, the previously convicted offender was paid a sum of several millions for the information and was provided with a new identity.<br><br>this is a possibility that law firms were interposed as intermediaries.&nbsp; LGT will now re-register its report of a criminal offence committed by a person unknown directly against the convicted data thief.<br><br>approximately 1,400 client relationships with LGT Treuhand, which were established before the end of 2002.&nbsp; The largest proportion, about 600 clients, are resident in Germany.&nbsp; The figure circulated in the media of 4,527 sets of data represents the number of beneficiaries of all the foundations<br><br>it has become increasingly clear that the so-called "informant" of the BND German intelligence service is indeed the same convicted data thief who illegally disclosed the client data in 2002<br><br>Acting on the information, German authorities raided the home of one of the country's most high-profile executives, the chief executive of Deutsche Post AG, alleging he evaded paying about E1 million in taxes.<br><br>The government, which paid as much as 5 million euros ($7.4 million) for information on German account holders in Liechtenstein on a disk provided by an informant to the Federal Intelligence Service, or BND, will share this information with other countries, the finance ministry said today.<br><span style="font-style: italic;">[Evan] You mean to tell me that its possible (and acceptable) to steal confidential corporate information and sell it for big bucks?&nbsp; German authorities paid over $12,000 per record (7,400,000/600)!&nbsp; The question is, is this an informant or a data thief cashing in?</span><br><br>U.K. tax collectors, after initially turning up their nose at an informant's offer to sell them confidential data from a Liechtenstein bank, have now paid up and have information on about 100 wealthy British subjects<br><br>they were persuaded to pay the informant around 100,000 pounds only after Berlin tax officials launched in recent weeks a high-profile crackdown on Germans with money said to be stowed away in Liechtenstein<br><span style="font-style: italic;">[Evan] The UK got a deal.&nbsp; They only paid ~$2,000 per record.</span><br><br>Australian authorities have been given details of Australian clients of Liechtensteinische Landesbank (LL<img src="http://breachblog.com/emoticons/cool.png" border="0" />, according to reports in the Wall Street Journal and Guardian newspapers.<br><br>"The Australian Tax Office does not pay for information about tax schemes," an ATO spokeswoman said. "Nonetheless, we have a good flow of information from people concerned about fairness and equity in the tax system."<br><span style="font-style: italic;">[Evan] The best deal of all.&nbsp; Australia got the stolen information for free!</span><br><br>The former employee, who was convicted of the data theft, is a Liechtenstein citizen named Heinrich Kieber (HK).<br><br>He was active from October 1999 as an external employee of an IT-company, and from April 2001 to November 2002 as an employee of LGT Treuhand.&nbsp; At the time of his recruitment and during his employment with LGT Treuhand, he had not been previously convicted of a crime.&nbsp; However, as would become known later, an arrest warrant had been issued against HK, which was not accessible for examination during the standard checks carried out on new employees.<br><br>This arrest warrant was linked to a real estate deal in Spain in 1996, which HK had allegedly financed with uncovered checks, and was issued by the Spanish criminal prosecution authorities in 1997, firstly at national and subsequently at international level.<br><br>It has been reported that he (Heinrich Kieber)&nbsp; has been given a new identity and is living in Australia.<br><br><span style="font-weight: bold;">Commentary:</span><br>This is a very intriguing story and one that will take a while to shake out.&nbsp; I am a little torn by the series of events, and struggle with the ethics of it all.&nbsp; I don't think Heinrich Kieber is any kind of hero by any means.&nbsp; I think he is a common thief that just received a huge payday. <br><br>A couple of questions to think about:<br></font><ul><li><font size="2">Do you think Heinrich Kieber is lucky criminal, or do you think he is an honest "informant" and "whistleblower"?&nbsp; <br></font></li><li><font size="2">If he were truly an honest guy, why would he shop the confidential information around like he did and not give it freely?</font></li><li>Do you think this story will encourage other insiders to follow suit?<br></li></ul><font size="2"><br>On one hand authorities catch criminals, which is great!&nbsp; On the other hand, we just enabled (and in some circles encouraged) insider criminal activity and potentially employee fraud.&nbsp; Read the <a target="_blank" href="http://www.lgt.com/export/sites/inta_lgtcom/_news/attachments/080224_LGT_Media_Release_en.pdf">LGT Group Media Communique</a>, it is very interesting stuff. <br><br>Past Breaches:<br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/02/25/lgt.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 25 Feb 2008 11:03:19 +0000</pubDate>
      <category domain="http://securityratty.com/tag/confidential">confidential</category>
      <category domain="http://securityratty.com/tag/confidential data">confidential data</category>
      <category domain="http://securityratty.com/tag/kieber">kieber</category>
      <category domain="http://securityratty.com/tag/named heinrich kieber">named heinrich kieber</category>
      <category domain="http://securityratty.com/tag/lgt">lgt</category>
      <category domain="http://securityratty.com/tag/lgt trust">lgt trust</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <source url="http://breachblog.com/2008/02/25/lgt.aspx">Cashing in on employee theft, or honest whistleblower?</source>
    </item>
    <item>
      <title><![CDATA[TRICARE breach affects 4,700 households]]></title>
      <link>http://securityratty.com/article/15bfaf273b2fdbbbdf76168fa62115ad</link>
      <guid>http://securityratty.com/article/15bfaf273b2fdbbbdf76168fa62115ad</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
12/07/07

Organization
TRICARE

Contractor/Consultant/Branch
TRICARE Area Office Europe (TAO-Europe
Department of Defense TRICARE Management Activity...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/tricare.jpg" align="right" height="57" width="105"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>12/07/07<br><br><span style="font-weight: bold;">Organization: </span><br>TRICARE<br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>TRICARE Area Office Europe (TAO-Europe)<br>Department of Defense TRICARE Management Activity (TMA)<br>Electronic Data Systems (EDS)<br><br><span style="font-weight: bold;">Victims:</span><br>TRICARE beneficiaries located in Europe between the years 2004 and 2007<br><br><span style="font-weight: bold;">Number Affected:</span><br>4,700 households<br><br><span style="font-weight: bold;">Types of Data:</span><br>Full or partial Social Security Numbers, and for one or more members of the affected household, their name, date of birth, and a medical diagnosis code associated with a health benefits claim submitted to TMA<br><br><span style="font-weight: bold;">Breach Description:</span><br>On November 7th, 2007 Electronic Data Systems (EDS) reported to TRICARE that they had discovered a potential compromise of sensitive personally identifiable information belonging to beneficiaries located in Europe.&nbsp; EDS is an IT contractor for TRICARE and "had not appropriately secured a part of the system" they support.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.tricare.mil/taoeuropebreach.cfm" target="_blank"> TRICARE TMA Website Announcement</a><br><a href="http://www.airforcetimes.com/news/2007/12/military_tricarebreach_071207w/" target="_blank"> Air Force Times Story</a><br><br><span style="font-weight: bold;">Report Credit:</span><br>TRICARE<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>A potential compromise of personally identifiable information belonging to approximately 4,700 TRICARE beneficiaries located in Europe occurred recently due to a problem with a claims Web site managed by Electronic Data Systems (EDS). <br><br>The incident was reported to TRICARE on November 7, 2007. The information that was potentially compromised, however, existed between the years 2004 and 2007.<br><br>The compromised information may include your full or partial Social Security Number, and for one or more members of your household, their name, date of birth, and a medical diagnosis code associated with a health benefits claim submitted to TRICARE Management Activity.<br><br>Although the assessment yields that external entities did in fact, access the system for purposes that do not appear malicious, at this time we have no indication that any of your personal information has been misused.<br><span style="font-style: italic;">[Evan] This statement is a little confusing to me.&nbsp; Are the "external entities" authorized or not?&nbsp; If they were not authorized to use the system, and they had in fact accessed the system, then I would say that the access was probably malicious in nature.</span><br><br>It is possible that an unauthorized person could have accessed your personal information, but the Department of Defense is taking proactive steps to keep you informed.<br><span style="font-style: italic;">[Evan] I don't like the word "proactive" when using it in reference to a reaction.&nbsp; The notification is a reaction to a lack of proactivity.&nbsp; You dig?</span><br><br>Those who may have been potentially affected by this compromise will receive a notification letter<br><br>The data was held on a Web application server that allowed external entities an unauthorized level of access without going through the required authentication process if the Web address was known.<br><br>That situation has since been remedied.<br><br>Practices such as Public Key Infrastructure (PKI) requirements and authentication verification cookies have fixed all known vulnerabilities associated with this incident. In addition, the CMS application has since been taken off-line. EDS has completed the forensics analysis of the server and is performing a by-line code review to ensure there are no further critical vulnerabilities present in the code.<br><span style="font-style: italic;">[Evan] Should EDS be the ones conducting the vulnerability assessment and code review?&nbsp; If it were me, I would feel more comfortable with a third-party review.</span><br><br>EDS is offering beneficiaries put at risk a free, one-year subscription to a credit monitoring and protection service.<br><br>Additionally, those affected will receive up to $20,000 identity theft protection coverage with no deductible as it relates to this matter.<br><br>Affected beneficiaries with questions or concerns may contact the EDS Incident Response Center at 1-800-556-3195.<br><br>Those located outside the United States must dial the country’s AT&amp;T USADirect access number first.<br><br><span style="font-weight: bold;">Commentary:</span><br>I am trying to determine with some certainty what led to this breach.&nbsp; <br>Was it poorly written code?&nbsp; (check out <a href="http://www.owasp.org/index.php/Main_Page" target="_blank"> OWASP</a>)<br>Was it a mis-configuration of the web server?<br>Was encryption not required, i.e. a user could use http or https to access the application?<br>Was it a combination of factors?&nbsp; I will assume it was a combination of factors.<br><br>On the one hand, I commend EDS for disclosing the breach to TRICARE, but on the other hand I am concerned about how long this problem may have gone un-noticed.&nbsp; Web applications acquiring, processing, accessing, storing or interacting with sensitive information in any manner require regular security reviews commensurate with the risk to the such information (unauthorized disclosure, alteration or destruction).&nbsp; This seems to be a case where you have an IT contractor in charge of design, implementation and maintenance of an application (typically with functionality as a driving factor) but also in charge of maintaining it's security.&nbsp; Information security really is a "stand-alone" function that should not be lumped into the same IT contract and warrants a "stand-alone" contract with a company that specializes in information security.&nbsp; My $.02.<br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2007/12/20/tricare.aspx" type="text/javascript" charset="utf-8"></script>
<br>
<br>
<script type="text/javascript"><!--
google_ad_client = "pub-4721162729073131";
google_ad_width = 468;
google_ad_height = 60;
google_ad_format = "468x60_as";
google_ad_type = "text_image";
google_ad_channel = "";
//-->
</script>
<script type="text/javascript">
</script>]]></content:encoded>
      <pubDate>Thu, 20 Dec 2007 09:15:59 +0000</pubDate>
      <category domain="http://securityratty.com/tag/tricare">tricare</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/code review">code review</category>
      <category domain="http://securityratty.com/tag/by-line code review">by-line code review</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/tricare beneficiaries">tricare beneficiaries</category>
      <category domain="http://securityratty.com/tag/beneficiaries">beneficiaries</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <source url="http://breachblog.com/2007/12/20/tricare.aspx">TRICARE breach affects 4,700 households</source>
    </item>
  </channel>
</rss>
