During a breach of DC Health Care Link’s servers, health data and other personal information about members of Congress and staff were stolen, and they are now for sale on the dark web.
The House of Representatives’ chief administrative officer, Catherine Szpindor, informed House members of the intrusion in a letter on Wednesday. The intrusion was discovered by the FBI. Szpindor wrote that the FBI and US Capitol Police informed her of the hack.
The Affordable Care Act’s online marketplace for healthcare plans for members of Congress, their families, and staff is DC Health Link.
Szpindor called the occurrence a huge information break that uncovered the individual recognizable data (PII) of thousands of DC Wellbeing Connection workers and cautioned the Delegates that their information might have been compromised.
She wrote, Currently, I do not know the size and scope of the breach, adding that the FBI informed her that hundreds of House and staff members’ account information and PII had been stolen. Szpindor will get in touch with the affected individuals directly once she has a list of the collected data.
A DC Health Link spokesperson confirmed the breach in a statement to The Register and stated that the company was working with forensic and law enforcement investigators as well as conducting its own investigation.
House pioneers search for replies
In a letter to Mila Kofman, the chief overseer of the DC Medical advantage Trade Authority, House Speaker Kevin McCarthy (R-CA) and House Popularity based Pioneer Hakeem Jeffries (D-NY) requested more data about the assault, including when the impacted House individuals and their staff and family would be advised and what administrations -, for example, credit observing – would be advertised.
They also want to know specifically what data was stolen, what was done to prevent future breaches, and how the damage is being reduced.
Since 2014, McCarthy and Jeffries wrote, Thousands of House Members and employees from across the United States have enrolled in health insurance through DC Health Link for themselves and their families. It’s possible that the number and scope of affected House customers are extraordinary.
In her letter, Szpindor advised House members to consider freezing their credit with Equifax, Experian, and TransUnion until the extent of the breach, including which representatives and staff members’ data, is known.
An email sent to offices on that side of Congress indicated that the Senate at Arms was informed of the breach by law enforcement and that the data included the full names, date of enrollment, relationship (self, spouse, or child), and email address, but no other Personally Identifiable Information (PII)
In a brief statement released to the media, the FBI stated that it was aware of this incident and is assisting. An investigation into this is ongoing. The Capitol Police claimed collaboration with the FBI.
Data for sale A dark web marketplace hosted at least some of the personally identifiable information stolen during the breach. McCarthy and Jeffries noted in their letter that the FBI was able to acquire the compromised PII and other enrollee information. Names of spouses and dependent children, Social Security numbers, and home addresses were included in the data.
According to CNBC, a post on a dark web site offered for sale the data of 11 users and 170,000 Health Link members.
The two leaders of the House of Representatives wrote, This breach significantly increases the risk that Members, staff, and their families will experience identity theft, financial crimes, and physical threats — already an ongoing concern.
Unfortunately, the individuals selling the information appear unaware of the high level of sensitivity of the confidential information in their possession and its relation to Members of Congress, they added. As the breach is made more widely known by media reports, this will undoubtedly change.
Now what?
It’s possible that this knowledge has little effect. According to Joseph Carson, chief security scientist and advisory CISO at security software manufacturer Delinea, cybercriminals do not care whose records they steal so long as they are sensitive enough to make people pay for them.
It’s likely that this wasn’t a deliberate attack on a particular group of people. Generally the cybercriminals wouldn’t be as open about it, nor would the records be available to be purchased, Carson told The Register.
He stated, I don’t believe this would make any difference other than increasing the focus on the attackers. In the end, the attackers don’t really care who the victims are because they want to make money from this data theft.
However, due to the high visibility of the victims and attention they are now receiving along with the FBI’s involvement, the attackers will likely want to lay low for a period of time.
Channelnomics’ chief research officer Chris Gonsalves said that the criminals probably knew a lot about the target because they usually do reconnaissance before an attack. He told The Register that they simply did not care.
Gonsalves said, The stuff is already for sale on the dark web, has been sold at least once that we know of, and will remain so until it is no longer profitable. He also said that although the FBI is good at investigating cases like this one, it is not the only one on their docket and that their success rate is roughly a coin flip. Depending on how loud things get on the Hill, they might put in a little more effort on this one, but this isn’t a new case.
He stated, The good news here is that people with loud voices and a big microphone got hit this time instead of just us poor saps. As a result, there’s a good chance this will turn a spotlight on the problem, which is never a bad thing. Let’s see how long that continues.
Given the vast amounts of PII and health data they hold on doctors, staff, and patients, from medical records to Social Security numbers, healthcare organizations have come under increasing attacks in recent years.
According to a report from the cybersecurity company Check Point, the number of cyberattacks worldwide increased by 38% year-over-year in 2022, and the top three targeted sectors were healthcare, education and research, and government.
Read More:
Global and United States Office Building Ambient Lighting Market Report & Forecast 2022-2028
Global Safety Ear Muffs Sales Market Report 2021
Cut Proof Glove Market Size, Regional Status, and Outlook 2023-2028
Global HDPE Jug Sales Market Report 2021
Nail Polish Market Size, Current Insights and Demographic Trends 2023-2028
Global Printing Plate Sales Market Report 2021
Global Crash Lock Cartons Sales Market Report 2021
Intelligent Toilet Market Size, Current Insights and Demographic Trends 2023-2030
