4 ms·

LifeLabs pays ransom after data breach affecting up to 15M Canadians

73 points by eswat 7y ago

rayhendricks 7y ago
“For customers who are concerned, LifeLabs has offered to cover one year of data protection that includes dark web monitoring as well as identity theft insurance.” That’s it? If I was Canadian I’d want to see execs going to jail and or their contract yanked. If they switched over to using a webapp or chromeos on the desktop things would probably be much more secure. But that’s not going to happen, cuz it’s owned by the pension system.
- rkagerer 7y ago
  Yeah, it's disgusting. I'm not sure how "1 year" of "fraud protection" coverage and the like became the defacto response of corporations who suffer breaches. Also wonder how motivated they are to do security right if insurance covers it: In an interview, LifeLabs CEO Charles Brown said the company had purchased cyberinsurance, but did not provide details on the coverage. It makes me sad to see Marriott, Equifax and others skipping along with stocks at near record highs and little long-term impact from their incidents.
- bikeshaving 7y ago
  Does anyone know what “dark web monitoring” actually involves, and what sorts of firms provide this kind of service?
  - chx 7y ago
    It's called Snake Oil Consulting Inc and the sorts of firm that has very very good contacts to the federal gubmint...
- deleted 7y ago
  [deleted]
- organsnyder 7y ago
  The whole "one year of data protection" thing is always a joke. It's not like my demographic information changes every year. There's a reason those sorts of records are worth so much on the black market—they're incredibly durable.
- chx 7y ago
  Canadian here. I asked my federal MP why there are no criminal consequences and my provincial MLA why BC is not terminating their contract.
  - aguyfromnb 7y ago
    >why BC is not terminating their contract. To go where? Socialized healthcare creates monopolies. There are few competitors. You trust your data more to some upstart entity that doesn't yet exist?
    - chx 7y ago
      There needs to be consequences or there will never be progress in cybersecurity. These guys leaked the most private data of every second Canadian, the CEO needs to criminally prosecuted and there needs to be financial consequences proportional to this catastrophe.
- mdtancsa 7y ago
  Canadian here and one who has records potentially leaked.... In terms of reaction, I dunno... It depends where on the spectrum of We kept our "passwords on sticky notes on Windows XP monitors" to "We did everything industry best practices and then some" did they fall into.... I havent seen anything with respect to technical details.
rkagerer 7y ago
Non-paywalled: http://archive.is/mwQN6 http://archive.is/mwQN6
ttul 7y ago
If you don’t live in Canada, you might not know that LifeLabs has a virtual monopoly on the lab business. If your doctor wants you to take a blood test, you go to LifeLabs. Whomever broke into their systems knows a great deal about the private health information of a large fraction of Canadians.
- jkaplowitz 7y ago
  Do they perform some back-office analysis function for Quebec's public health system, or is this get another way Quebec is different from the rest of Canada? Here in Quebec we generally get our blood drawn for tests at a local public clinic called a CLSC, and can eventually view the results in a public government web system, but I'm not sure where the actual analysis happens.
  - allo37 7y ago
    In my experience, the CLSC sends your blood to a nearby hospital's lab for testing. We also have CDL which does private testing.
    - jkaplowitz 7y ago
      Makes sense. So not LifeLabs either way?
- rkagerer 7y ago
  New title: All your medical lab results are belong to us
- smnrchrds 7y ago
  From their website, it looks like they only operate in Ontario and BC, perhaps Saskatchewan. I certainly haven't seen one here in Alberta, unless they operate under a different name.
- Consultant32452 7y ago
  In the US this title seems to be held by Quest diagnostics.
g82918 7y ago
One thing people propose is criminalizing paying ransoms. I feel like this is short minded in that it may prioritize hig value targets like hospitals. I don't have a good answer for how to avoid issues like criminals prioritizing health/ life companies. In general maybe raising the idea the targeting hospitals makes you less than human might help.
- Thorrez 7y ago
  Why would criminalizing paying ransoms cause attackers to target hospitals? I would think hospitals would have a fairly strict compliance effort, whereas Joe Schmoe probably never even heard that it's illegal to pay a ransom.
- LoSboccacc 7y ago
  we need instead to fix laws around sensible data handling and criminalise it/managers that skirt around them, current laws are too vague, outdated and don't provide enough reparations to get people whose data was compromised to actually litigate them
guessmyname 7y ago
Just a few months ago I had to take a series of tests with LifeLabs (blood, urine, physical, etc) to update my immigration papers. Did you know you cannot choose where to take these tests? You are more or less forced to use LifeLabs because the doctors designated by the IRCC (Immigration, Refugees and Citizenship Canada) only partner with LifeLabs to do these tests, it’s an ugly monopoly that is impossible to fight as an immigrant. I knew, from the moment I walked in the laboratory, all the information I was handing and the data they were going to find was going to be leaked sooner than later. I have tried more than once to make secretaries, assistants and nurses to understand how bad most of their systems are and how easy it is to expose the information of all their patients to malicious actors, but arguing with them is pointless because they barely understand what I am talking about or do not have the power to change anything. And the worst thing is, I have to visit LifeLabs again next month for another physical checkup and to take some X-rays and these news will not change anything. Side note… I used to work as a malware researcher for a security information company in the US. One day I remembered the story of Sisyphus: > In Greek mythology Sisyphus was the king of Ephyra (now known as Corinth). He was punished for his self-aggrandizing craftiness and deceitfulness by being forced to roll an immense boulder up a hill only for it to roll down when it nears the top, repeating this action for eternity — https://en.wikipedia.org/wiki/Sisyphus https://en.wikipedia.org/wiki/Sisyphus I ended up quitting my job no long after reading this story because it made me realize I was fighting an endless fight.
- coldcoldground 7y ago
  There's something in this story that doesn't ring true. You knew from the moment you walked into the laboratory that their data handling practices were inadequate and prone to being hacked/leaked. How? You tried to explain this to their secretaries and nurses. Why bother when it's obvious they can't/won't do anything about it? Why not contacting their management or IT?
  - guessmyname 7y ago
    > You knew from the moment you walked into the laboratory that their data handling practices were inadequate and prone to being hacked/leaked. How? The laboratory is divided into small rooms where the patient talks with the nurse and/or doctor, each room looks something like this [1] along with a computer that is connected to whatever system LifeLabs uses. When I arrived for my appointment the nurse left me alone in the room for approximately 15 minutes, the computer was on, and the user session (which I believe was created using the doctor’s credentials) was still alive, I could have done a lot with that computer while the nurse was outside checking the other patients. Later, the doctor came to do the initial physical checkup and then left for another 10-15 minutes to talk with another nurse. This gave me more time to “snoop around” and in fact, I took the opportunity to take a picture of the computer screen [1]. Ironically, you can see in the picture that the doctor uses a Post-it Note to cover the webcam, which means they do care about their privacy but not the privacy of their patient’s. You may think “this is not LifeLabs fault but the doctor’s fault” but this is how social engineering works and as people say “A chain is only as strong as its weakest link”. > You tried to explain this to their secretaries and nurses. > Why bother when it's obvious they can't/won't do anything about it? > Why not contacting their management or IT? Yes, good point, but this doesn’t disprove the rest of my anecdote. [1] https://en.wikipedia.org/wiki/Doctor%27s_office https://en.wikipedia.org/wiki/Doctor%27s_office [2] https://i.imgur.com/c0tXTEK.png https://i.imgur.com/c0tXTEK.png
deleted 7y ago
[deleted]
imposterr 7y ago
Reading the official news release [1], the cynic in me thinks the wording of just "password" indicates that these were plain text passwords. From my experience, when the passwords are hashed/salted, the companies make it a point to include that. [1] https://www.lifelabs.com/lifelabs-releases-open-letter-to-customers-following-cyber-attack/ https://www.lifelabs.com/lifelabs-releases-open-letter-to-cu...
- slantyyz 7y ago
  I think the big concern is the presumption of a non-techie that a medical company would take good care of their information, because of regulations, etc. I would not be surprised if a LOT of Lifelabs customers used the same password on their Lifelabs accounts that they use for their email. FWIW, Lifelabs has two sub-sites that use different credentials - one for test results, and one for booking appointments.
riquito 7y ago
> Through proactive surveillance, LifeLabs recently identified a cyber-attack I'm confused, how do you pass from "proactive surveillance" to "there's a ransom to pay"?
- faeyanpiraat 7y ago
  They probably asked the attackers to provide info about the stolen data, but they only help in return of a payment.
emptybits 7y ago
The numbers: 15 million people in a country of 37 million had personal information "potentially accessed in this breach." In several provinces, LifeLabs is dominant and sometimes the only option for lab work. Here is the CEO's letter to those 15 million or so victims: https://customernotice.lifelabs.com https://customernotice.lifelabs.com Concerned Canadians could/should contact their government about this incident. I don't have a deep link but assume it's buried in this maze: https://www.priv.gc.ca/ https://www.priv.gc.ca/
dmix 7y ago
That’s a whole lot of STD tests and other highly personal details they got access to which could have been way worse than a ransomware.
dannyw 7y ago
Any cyber security firm that says the risk of a hackers not leaking data because they got paid a ransom, is one that should be blackballed for negligence at best, and fraudulent collusion at worst.
bhouston 7y ago
I wonder if medical test results (which I think could include STDs and chronic conditions) were included in the data breach? The downside of EMR is that they can get hacked. If so that can be incredibly personal information and way more serious than the usually the name, birth date and VISA numbers. I guess in the future with all these data breaches one will be able to get any private information on just about anyone by paying for it on the dark net. Basically there will be darknet data brokers who basically have unlimited inventory of information because they aggregate from the various data breaches. Will people get spam calls from a call center in a low cost country that bring up your test results from LifeLabs and threaten to share them with your employer or significant other unless you pay up? If not now, this will be happening in the near future.
motohagiography 7y ago
This breach seems to be downplayed because it affects the integrity of the entire health system. If medical blood test result data ends up on the dark web, people may likely be able to look up the following about us: - if you have a condition that puts you at higher risk for receiving disability or workers compensation. - if you have been pregnant and when. - if you got tested for an STD because you thought you needed to, and the frequency of your testing. - if you have an STD and around when you contracted it. That's without getting into specifics around medications, and the greater harm of people not getting tests done because they do not trust the privacy and security of the health system. These are typical threat model use cases in health information privacy assessment and systems design. In terms of consequences, the disclosure risk of this information can break up families and households, and silently disqualify people from jobs, both of which put their kids at a long term disadvantage, destroys familial wealth and assets, and in effect impoverishes everyone involved. Once the gravity of this sinks in, I'd be concerned for the mental health of the CEO.
ChrisArchitect 7y ago
interested in more info about them actually paying the ransom. Not that common a reaction in these corporate/public sector breaches I don't think. How much did they pay? Was it brokered or direct? Is anyone surprised they actually got the data back? Why are they convinced the 'hackers' won't still do anything with it. Reporting is weak on this as it doesn't say straight out ransomware that encrypted machine with data. That it likely came from any random email that someone opened. Not that there's some evil hacker person on the other end targetting LifeLabs and it could and does happen to anyone.

73 points by eswat 7y ago

“For customers who are concerned, LifeLabs has offered to cover one year of data protection that includes dark web monitoring as well as identity theft insurance.” That’s it? If I was Canadian I’d want to see execs going to jail and or their contract yanked. If they switched over to using a webapp or chromeos on the desktop things would probably be much more secure. But that’s not going to happen, cuz it’s owned by the pension system.

rkagerer 7y ago
Yeah, it's disgusting. I'm not sure how "1 year" of "fraud protection" coverage and the like became the defacto response of corporations who suffer breaches. Also wonder how motivated they are to do security right if insurance covers it: In an interview, LifeLabs CEO Charles Brown said the company had purchased cyberinsurance, but did not provide details on the coverage. It makes me sad to see Marriott, Equifax and others skipping along with stocks at near record highs and little long-term impact from their incidents.
bikeshaving 7y ago
Does anyone know what “dark web monitoring” actually involves, and what sorts of firms provide this kind of service?
- chx 7y ago
  It's called Snake Oil Consulting Inc and the sorts of firm that has very very good contacts to the federal gubmint...
deleted 7y ago
[deleted]
organsnyder 7y ago
The whole "one year of data protection" thing is always a joke. It's not like my demographic information changes every year. There's a reason those sorts of records are worth so much on the black market—they're incredibly durable.
chx 7y ago
Canadian here. I asked my federal MP why there are no criminal consequences and my provincial MLA why BC is not terminating their contract.
- aguyfromnb 7y ago
  >why BC is not terminating their contract. To go where? Socialized healthcare creates monopolies. There are few competitors. You trust your data more to some upstart entity that doesn't yet exist?
  - chx 7y ago
    There needs to be consequences or there will never be progress in cybersecurity. These guys leaked the most private data of every second Canadian, the CEO needs to criminally prosecuted and there needs to be financial consequences proportional to this catastrophe.
mdtancsa 7y ago
Canadian here and one who has records potentially leaked.... In terms of reaction, I dunno... It depends where on the spectrum of We kept our "passwords on sticky notes on Windows XP monitors" to "We did everything industry best practices and then some" did they fall into.... I havent seen anything with respect to technical details.

rkagerer 7y ago

Non-paywalled: http://archive.is/mwQN6 http://archive.is/mwQN6

ttul 7y ago

If you don’t live in Canada, you might not know that LifeLabs has a virtual monopoly on the lab business. If your doctor wants you to take a blood test, you go to LifeLabs. Whomever broke into their systems knows a great deal about the private health information of a large fraction of Canadians.

jkaplowitz 7y ago
Do they perform some back-office analysis function for Quebec's public health system, or is this get another way Quebec is different from the rest of Canada? Here in Quebec we generally get our blood drawn for tests at a local public clinic called a CLSC, and can eventually view the results in a public government web system, but I'm not sure where the actual analysis happens.
- allo37 7y ago
  In my experience, the CLSC sends your blood to a nearby hospital's lab for testing. We also have CDL which does private testing.
  - jkaplowitz 7y ago
    Makes sense. So not LifeLabs either way?
rkagerer 7y ago
New title: All your medical lab results are belong to us
smnrchrds 7y ago
From their website, it looks like they only operate in Ontario and BC, perhaps Saskatchewan. I certainly haven't seen one here in Alberta, unless they operate under a different name.
Consultant32452 7y ago
In the US this title seems to be held by Quest diagnostics.

g82918 7y ago

One thing people propose is criminalizing paying ransoms. I feel like this is short minded in that it may prioritize hig value targets like hospitals. I don't have a good answer for how to avoid issues like criminals prioritizing health/ life companies. In general maybe raising the idea the targeting hospitals makes you less than human might help.

Thorrez 7y ago
Why would criminalizing paying ransoms cause attackers to target hospitals? I would think hospitals would have a fairly strict compliance effort, whereas Joe Schmoe probably never even heard that it's illegal to pay a ransom.
LoSboccacc 7y ago
we need instead to fix laws around sensible data handling and criminalise it/managers that skirt around them, current laws are too vague, outdated and don't provide enough reparations to get people whose data was compromised to actually litigate them

guessmyname 7y ago

Just a few months ago I had to take a series of tests with LifeLabs (blood, urine, physical, etc) to update my immigration papers. Did you know you cannot choose where to take these tests? You are more or less forced to use LifeLabs because the doctors designated by the IRCC (Immigration, Refugees and Citizenship Canada) only partner with LifeLabs to do these tests, it’s an ugly monopoly that is impossible to fight as an immigrant. I knew, from the moment I walked in the laboratory, all the information I was handing and the data they were going to find was going to be leaked sooner than later. I have tried more than once to make secretaries, assistants and nurses to understand how bad most of their systems are and how easy it is to expose the information of all their patients to malicious actors, but arguing with them is pointless because they barely understand what I am talking about or do not have the power to change anything. And the worst thing is, I have to visit LifeLabs again next month for another physical checkup and to take some X-rays and these news will not change anything. Side note… I used to work as a malware researcher for a security information company in the US. One day I remembered the story of Sisyphus: > In Greek mythology Sisyphus was the king of Ephyra (now known as Corinth). He was punished for his self-aggrandizing craftiness and deceitfulness by being forced to roll an immense boulder up a hill only for it to roll down when it nears the top, repeating this action for eternity — https://en.wikipedia.org/wiki/Sisyphus https://en.wikipedia.org/wiki/Sisyphus I ended up quitting my job no long after reading this story because it made me realize I was fighting an endless fight.

coldcoldground 7y ago
There's something in this story that doesn't ring true. You knew from the moment you walked into the laboratory that their data handling practices were inadequate and prone to being hacked/leaked. How? You tried to explain this to their secretaries and nurses. Why bother when it's obvious they can't/won't do anything about it? Why not contacting their management or IT?
- guessmyname 7y ago
  > You knew from the moment you walked into the laboratory that their data handling practices were inadequate and prone to being hacked/leaked. How? The laboratory is divided into small rooms where the patient talks with the nurse and/or doctor, each room looks something like this [1] along with a computer that is connected to whatever system LifeLabs uses. When I arrived for my appointment the nurse left me alone in the room for approximately 15 minutes, the computer was on, and the user session (which I believe was created using the doctor’s credentials) was still alive, I could have done a lot with that computer while the nurse was outside checking the other patients. Later, the doctor came to do the initial physical checkup and then left for another 10-15 minutes to talk with another nurse. This gave me more time to “snoop around” and in fact, I took the opportunity to take a picture of the computer screen [1]. Ironically, you can see in the picture that the doctor uses a Post-it Note to cover the webcam, which means they do care about their privacy but not the privacy of their patient’s. You may think “this is not LifeLabs fault but the doctor’s fault” but this is how social engineering works and as people say “A chain is only as strong as its weakest link”. > You tried to explain this to their secretaries and nurses. > Why bother when it's obvious they can't/won't do anything about it? > Why not contacting their management or IT? Yes, good point, but this doesn’t disprove the rest of my anecdote. [1] https://en.wikipedia.org/wiki/Doctor%27s_office https://en.wikipedia.org/wiki/Doctor%27s_office [2] https://i.imgur.com/c0tXTEK.png https://i.imgur.com/c0tXTEK.png

deleted 7y ago

[deleted]

imposterr 7y ago

Reading the official news release [1], the cynic in me thinks the wording of just "password" indicates that these were plain text passwords. From my experience, when the passwords are hashed/salted, the companies make it a point to include that. [1] https://www.lifelabs.com/lifelabs-releases-open-letter-to-customers-following-cyber-attack/ https://www.lifelabs.com/lifelabs-releases-open-letter-to-cu...

slantyyz 7y ago
I think the big concern is the presumption of a non-techie that a medical company would take good care of their information, because of regulations, etc. I would not be surprised if a LOT of Lifelabs customers used the same password on their Lifelabs accounts that they use for their email. FWIW, Lifelabs has two sub-sites that use different credentials - one for test results, and one for booking appointments.

riquito 7y ago

> Through proactive surveillance, LifeLabs recently identified a cyber-attack I'm confused, how do you pass from "proactive surveillance" to "there's a ransom to pay"?

faeyanpiraat 7y ago
They probably asked the attackers to provide info about the stolen data, but they only help in return of a payment.

emptybits 7y ago

The numbers: 15 million people in a country of 37 million had personal information "potentially accessed in this breach." In several provinces, LifeLabs is dominant and sometimes the only option for lab work. Here is the CEO's letter to those 15 million or so victims: https://customernotice.lifelabs.com https://customernotice.lifelabs.com Concerned Canadians could/should contact their government about this incident. I don't have a deep link but assume it's buried in this maze: https://www.priv.gc.ca/ https://www.priv.gc.ca/

dmix 7y ago

That’s a whole lot of STD tests and other highly personal details they got access to which could have been way worse than a ransomware.

dannyw 7y ago

Any cyber security firm that says the risk of a hackers not leaking data because they got paid a ransom, is one that should be blackballed for negligence at best, and fraudulent collusion at worst.

bhouston 7y ago

I wonder if medical test results (which I think could include STDs and chronic conditions) were included in the data breach? The downside of EMR is that they can get hacked. If so that can be incredibly personal information and way more serious than the usually the name, birth date and VISA numbers. I guess in the future with all these data breaches one will be able to get any private information on just about anyone by paying for it on the dark net. Basically there will be darknet data brokers who basically have unlimited inventory of information because they aggregate from the various data breaches. Will people get spam calls from a call center in a low cost country that bring up your test results from LifeLabs and threaten to share them with your employer or significant other unless you pay up? If not now, this will be happening in the near future.

motohagiography 7y ago

This breach seems to be downplayed because it affects the integrity of the entire health system. If medical blood test result data ends up on the dark web, people may likely be able to look up the following about us: - if you have a condition that puts you at higher risk for receiving disability or workers compensation. - if you have been pregnant and when. - if you got tested for an STD because you thought you needed to, and the frequency of your testing. - if you have an STD and around when you contracted it. That's without getting into specifics around medications, and the greater harm of people not getting tests done because they do not trust the privacy and security of the health system. These are typical threat model use cases in health information privacy assessment and systems design. In terms of consequences, the disclosure risk of this information can break up families and households, and silently disqualify people from jobs, both of which put their kids at a long term disadvantage, destroys familial wealth and assets, and in effect impoverishes everyone involved. Once the gravity of this sinks in, I'd be concerned for the mental health of the CEO.

ChrisArchitect 7y ago

interested in more info about them actually paying the ransom. Not that common a reaction in these corporate/public sector breaches I don't think. How much did they pay? Was it brokered or direct? Is anyone surprised they actually got the data back? Why are they convinced the 'hackers' won't still do anything with it. Reporting is weak on this as it doesn't say straight out ransomware that encrypted machine with data. That it likely came from any random email that someone opened. Not that there's some evil hacker person on the other end targetting LifeLabs and it could and does happen to anyone.