3 ms·

I think (right now) there isn't a way to really mass-target people illegally if you have their medical data. Blackmail requires some non-zero amount of effort p

by octo_t 11y ago

I think (right now) there isn't a way to really mass-target people illegally if you have their medical data. Blackmail requires some non-zero amount of effort per user. Compare this to getting a password dump from a social networking site and trying those emails/passwords in an automated way against sites like paypal/gmail/banks etc. EDIT: from the article "TrapX also found a bug called Citadel, ransomware that’s designed to restrict a user’s access to his or her own files, which allows hackers to demand payment to restore that access"

famousactress 11y ago
> I think (right now) there isn't a way to really mass-target people illegally if you have their medical data. Blackmail requires some non-zero amount of effort per user. I'm saying that's not really true anymore. These systems have patient email addresses and their medical histories. It's doesn't seem to me a big leap to automate ransomware. Hell, there's plenty of encryption-based ransomware schemes active right now and they involve needing access to the target's local PC. This doesn't even require that. One massive healthcare breach and anyone who can pull it down on bit-torrent can start going to town extorting. I think it's something that's been a practical possibility for a couple-few years now. Just hasn't happened yet.