Hacker Holds Health Records Hostage for $10M
Source: Tom's Guide US | Keywords: hacker, health, records, hostage, virginia | Themes: The Internet
A hacker is holding the patient records of over 8 million people hostage, demanding $10 million for their safe return.
When users logged into the Virginia Prescription Monitoring Program (PMP) website on April 30, they were greeted with a ransom note in which an unknown hacker threatened to sell the patient records of 8,257,378 people to the highest bidder if he wasn’t sent $10 million within a week.
The note was also posted on Wikileaks. Below is the message in its entirety:
ATTENTION VIRGINIA
I have your sh*t! In *my* possession, right now, are 8,257,378 patient records and a total of 35,548,087 prescriptions. Also, I made an encrypted backup and deleted the original. Unfortunately for Virginia, their backups seem to have gone missing, too. Uhoh :(
For $10 million, I will gladly send along the password. You have 7 days to decide. If by the end of 7 days, you decide not to pony up, I'll go ahead and put this baby out on the market and accept the highest bid. Now I don't know what all this shit is worth or who would pay for it, but I'm bettin' someone will. Hell, if I can't move the prescription data at the very least I can find a buyer for the personal data (name,age,address,social security #, driver's license #).
Now I hear tell the Fucking Bunch of Idiots ain't fond of payin out, but I suggest that policy be turned right the fuck around. When you boys get your act together, drop me a line at hackingforprofit@yahoo.com and we can discuss the details such as account number, etc.
Until then, have a wonderful day, I know I will ;)
A statement from the Virginia Department of Health Professions acknowledged last Thursday’s breach but offered no detail as to how the Department was going to deal with the issue.
“A criminal investigation is currently underway regarding a potential security breach of the Virginia Department of Health Profession’s (DHP) Prescription Monitoring Program on Thursday, April 30,” the statement read. “While DHP cannot comment directly on an ongoing investigation, we can assure the public that all precautions are being taken for DHP operations to continue safely and securely”
The DHP went on to say that it is working with State and Federal law enforcement to resolve the situation and said it was “satisfied” all data has been properly backed up and that these backup files have been secured.
Virginias PMP program was set up in November 2007 and allows pharmacists to cross-reference prescriptions to see if a patient is issued multiple scripts for narcotics by several different doctors.
-
Previous News Article
Lock Your PC with Phone When You... -
Next News Article
Activision Confirms DJ Hero,...









What a bad asss, i hope we get so see his face one day, just for curiosity,
I wonder if he will get a way with this... probably.
What a bad asss, i hope we get so see his face one day, just for curiosity,I wonder if he will get a way with this... probably.
don't glorify filth like him. he should rot in prison or given the death penalty for threatening to ruin 8 million lives.
Ahahahahhahaha
This is what you get when you try to make things cool and trendy (cross reference trough web) without taking the necessary precautions!
shit thats not even 1% of 700billion that was ripped from our pockets. Just pay the man, WITH YOUR MONEY, NOT STATE TAX PAYERS, you fucks!
can we make this into made-for-TV movie on Oxygen?
Would someone hack this moron? I'll give lifetime thumbs up for the person who crashes his computer in his moms basement
If every person payed ~$1.21 they would have the $10M.
Sounds reasonable
pay the fool! In some small way I support him for having gigantic cajones that he is taking on the federal government. Man is his mom going to yell at him if he screws up.
but...seriously, who doesn't have a backup of such records? They have to!
Unfortunately, judging by the way this moron has worded his letter, that he'll be put to bed by the end of this week he's imposed on himself. He's challenging people he really shouldn't be challenging. Bad move.
Who thinks it's the Chinese government again?
I swear, the things ppl do these days. He/she has a very creative mind at least.
"Now I hear tell..."
gotta be a redneck
pay the fool! In some small way I support him for having gigantic cajones that he is taking on the federal government. Man is his mom going to yell at him if he screws up.but...seriously, who doesn't have a backup of such records? They have to!
This isn't the govt he's going to screw over, it's regular people.
And this guy is an idiot. If you look at the note he's obviously not too bright.
He may have been lucky enough to pull off the hack and get the data but it stops there. They will not pay the $10 mil. Even if they did it would be marked and no matter where it's wired to he would be picked up trying to withdrawal any of it.
I doubt he is streetwise enough to know how to sell this kind of data on the black market without getting caught or killed in the process.
Sadly, it was a cool trick but he will get caught.
And this guy is an idiot. If you look at the note he's obviously not too bright.
Actually, this person is most likely quite the opposite. You can word anything the way you want it to be perceived. It was written in a style that was suppose to make people think it was just some snot-nosed punk that pulled off a lucky hack one night.
The person obviously has sort of intelligence but it was wasted on a failed blackmail attempt that is only going to put them in jail. Only in hollywood are they able to erase or cover their digital tracks. In the real world...the government controls the data and knows exactly where this person is.
How is he gonna get the money, obviously they will wait for him at the pickup. If they transfer by internet, they can probably trace him, and eventually see him turn data into currency by camera at an ATM.
bgiyd-
That's what I mean. The note, his plan, the fact that he just baited the FBI means he is just dumb and has nothing to loose.
And it was a lucky hack because they obviously didn't protect their network properly.
Lmao he hacked it. I have no doubts he's smart enough to sell it. Specially consdering that can be done online, and he obviously knows what he's doing. Not to mention sometimes the smart thing to do is to seem stupid.
Although I'd put money on it that he's just bluffing. He could make more then 10mil just selling the ssn by themselves. Seems to me he's simply trying to screw over the big companies, and is trying to use threat of force.
8,257,378x100=825,737,800 Anybody here honestly think you can't get a $100 for ssn+all other personal info. If I was in it for just the money I would've took the info, and left as little trace as possible, and not make such far out claims specially knowning that their not gonna pay.
This would have been a much more effective threat had he articulated his letter in a smarter way.
This letter comes off as some stupid stunt someone is pulling to get a high, or a bit of attention.
Had he written the letter intelligently (and politely) it would have been much more intimidating.
That 'ransom' letter is absolutely pathetic. I wouldn't be surprised in the least if he was just trying to scam the money. He even stated himself he has no idea of the worth (or lack thereof) of whatever data he may actually have. This guy is a total amateur. A pro wouldn't have bothered with publicity and would have lined up contacts and potentials immediately after the take, if not beforehand.
It's only a little over a dollar each, not too unreasonable...
Additionally, for all of you arguing this guy's supposed 'intelligence':
The 'smart' thing to do would have been to copy the data to himself, leave their data intact, and do his best to cover his tracks. Hope that the intrusion goes unnoticed, at least long enough to sell the data and laugh all the way to the bank.
Pulling this stunt is going to bury him.
The things stupid people do just make me laughs....
I agree that his little note doesn't exactly paint the picture of a genius. It's also a little long-winded but who am I to judge. Either way, this is actually pretty serious, given the amount of personal data involved.
I can't understand the people saying "it's just over a dollar per person" and claiming that's not unreasonable. No one should have to pay (be it one dollar or one hundred) for something that is in no way their fault.
Well this guy is just a publicity hound. I mean if he really did do this, or did he just deface the page, he is just drawing even more attention to himself which means he will probably get caught and rightfully so. If he did do it he should have not said a word, sold the stuff, and all those that bought it would have to deal with it.
Now, this also goes to show just how stupid people in certain sectors are. I mean you would think that the Virginia Department of Health Professions would have that information locked down, but no, they just set it up and knew nothing of what it takes to make such things secure, or they just never thought it important enough to make sure of that. So much for all the so called benefits I am sure they talked up to get funding for this. I would never knowingly allow such information to even be put on the web for access regardless of the so called benefits and this is a clear indication why. Yet like a bunch of lemmings everyone just signs off on things like this only seeing the potential benefits not even thinking, much less considering the possiable disadvantages.
How is he gonna get the money, obviously they will wait for him at the pickup. If they transfer by internet, they can probably trace him, and eventually see him turn data into currency by camera at an ATM.
Something tells me he's not gonna roll down to his local ATM and do a cash withdrawl for 10 million.
That's right Jane, I don't believe the people should pay to get the data out of that hackers hands. However, this appears to be a screwup of a government program, and I am glad they are taking the necessary steps to rectify the situation. If it comes down to them having to pay the hacker, and then tracking him down later, then they better well do it. This program wasn't designed to protect people, or give them any service. It was designed to accumulate prescription demographics in an effort to catch con artists or abusers looking for prescription drugs, all in the name of the War against Drug Abuse. The people responsible for the protection of this information... if it wasn't this hacker, it would have been another who found a way in down the road. I wish the people of Virginia the best.
Yeah. I vote just give him the money than trace the idiot.
Just wonder if the email is the hackers? If not I would hate to be the guy that made that email address. If the email is the hackers then he deserves jail time for being so dumb.
What an idiot, does he honestly think he can get away with this. Not getting caught it one thing, but actually getting the ransom without getting caught is another. What's he going to do, pick it up in cash? Transfer it to a foreign bank account?
I'm betting this is just a joke and the hacker doesn't actually expect to get any money out of this.
Again a Cracker not a Hacker. Read and Heed.
http://db.glug-bom.org/lug-authors [...] ckers.html
Obama's single database Universal Health Insurance plans are looking at little more bleak today when this type of reality sets in.