13 ms·

Hackers threaten to leak plastic surgery pictures

• pstrateman 6y ago
  Why would you even keep these on anything but archive media??
  • arkitaip 6y ago
    Because they are lazy, incompetent and indifferent. But they might be against a very powerful and public group of people who can sue them out of existence, so maybe that will scare other health providers into better security practices.
    • adkadskhj 6y ago
      Maybe. Sounds like their incentive will be primarily to keep _some_ records more safe. Eg i'm skeptical that this would propagate to poor people, without legislation at least. (which isn't to say that they'd purposefully choose two different implementations. Rather, just that if i'm using poor person doctors i'm unsure they'd rise to the new "standard" of security practices)
    • sidlls 6y ago
      You hinted at it but didn't mention it explicitly: greedy. It simply costs more to have somewhat better security practices, and they don't want to pay unless they have to.
      • bigbubba 6y ago
        Lazy indifference probably explains it more than greed I think. If they cared, a doctor could add "burn a CD and put it in the filing cabinet with the other patient records" to the job duties of their secretary without increasing their compensation. It would only take a few more minutes, and would only slightly detract from the time they spend idly chatting with each other. But they simply don't care.
        • ironmagma 6y ago
          Whether the cause is laze or greed, criminal consequences would probably motivate people to actually care about this stuff.
        • novok 6y ago
          More accurately, they are NOT tech professionals, the type of people who do IT for small private practices are not that good either and they really just don't know for the majority of it. You really can't expect these people to understand the full consequences of stuff like encryption, offline vs online media and more. To them, if it has a user name and password, that is safe right? Use the HIPPA lockbox software and it should be good right? In the past before computers they would be putting these in files on a large file folder shelving units with colored folder tabs behind a counter and the only real security was a receptionist that would stop you if you tried to interact with it, and they locked the door to the office when they left. If someone broke into the office back then too, your medical records would've been stolen & unencrypted (beyond the illegibility of most doctor's handwriting) and as a society, we were ok with that security level.
          • bigbubba 6y ago
            You're probably right that ignorance is the root of their apathy. Hopefully with this event making the news, doctors at least in the same specialty will hear about it and do something. Unencrypted offline records physically secured in the office building seems more than adaquate in all but the most exceptional scenarios though. Maybe it wouldn't be good enough for doctors of high-value targets (celebrities, politicians, etc.) Burglars targetting medical records seems uncommon. Harsh fines are probably the best way to make doctors care though. If they know they risk financial ruin for not securing their records, they'll have a strong personal incentive to remediate their ignorance.
            • cratermoon 6y ago
              You'd think that, but... SolarWinds
      • ars 6y ago
        Keeping data on live hard disks costs quite a bit more than archiving it to tape or DVD and sticking it in a file cabinet.
        • jdeibele 6y ago
          There's a one-time purchase of bigger/more disks. Figure 1GB (50 20MB pictures) per customer. Just add another 2TB, then 4TB, now 8TB or bigger drive. That's about $250 or $300 each time. Double that for a sync'd drive somewhere in the office. Now they should be doing 3-2-1 backups. With S3 they'd be paying $160/month (for storage, not counting other costs) for 8TB or $40/month for BackBlaze B2. That's 8,000 customers. They're in England so some variance in pricing. But it would be relatively inexpensive to buy big drives, sync them to a set in the office, and back them up online. Where the doctors or whoever is running the clinics can SEE the data is still there whenever they want. I agree that there should be increasing worry about keeping information that you don't need, whether it's intimate pictures of your surgical clients or people who bought from you 5 years ago and not since. But it seems like keeping things handy will be an impulse that's hard to overcome.
        • novok 6y ago
          TBH DVDs / Blu-Rays are too low density, expensive and labor intensive, and tape drives start at $1000 and most non tech professionals don't know they even exist. 2.5TB of 25 100GB writable BDXL disks cost about $250. A 4TB drive costs $80 and a computer to throw in 3.5" HDDs pretty cheap too.
          • namibj 6y ago
            Blu-Ray (the cheap ones, 25/50 GB) is actually cheaper than tape, if you care for that. But yeah, they are less dense.
        • lmm 6y ago
          Not if you want the same level of access assurance.
  • EvanAnderson 6y ago
    Why does everybody keep data hanging around forever? It's easier. You don't have to think about it. Just keep kicking the files onto new media every few years / at a new server refresh. I did some IT work for a plastic surgery practice in the US many years ago. I was adding some storage to an existing server. I was shocked to see that the practice was keeping all their before / after photos online going back years. Not encrypted. Hanging out in Windows file shares with lax permissions. It certainly gave me pause. Maybe some software providers in this space will think about handling this better.
    • g_p 6y ago
      It seems that Windows SMB file sharing is still the go-to universal storage system in a lot of organisations. I imagine because it's built in, easy to configure, and works out the box with the ability to map drives so it's transparent to users. In contast, anything more secure tends to add inherent friction (since just blindly giving access due to some potentially replayed hash of a user's likely weak password isn't exactly going to be appropriate in a secure setup). And if it adds complexity, people still go for the old solution. I hope they had backups - I've often caught out the same Windows SMB-using orgs out when checking their backups and discovering both of their weekly-cycled drives are empty and devoid of backups, despite having been diligently swapped out according to the schedule!
  • Aeronwen 6y ago
    "I'm a doctor, not a computer security expert, Jim!"
  • nwatson 6y ago
    Why does a software engineer keep old git-repo branches around, including their history? The engineer can compare the before-and-after especially as they relate to experiments, successful, and failed approaches. A plastic surgeon might want to look at before-and-after for a few of their "branches" (specific plastic surgeries or repeated applications of a technique). "When I did celebrity-A I notice they sag too much in location-X, whereas for celebrity-B where I changed the procedure location-X looks much better." "Celebrity-P has the same odd nose Celebrity-K had ... let me consult my notes and the before/after for Celebrity-K."
    • deleted 6y ago
      [deleted]
  • zimpenfish 6y ago
    Perhaps they bring them out to show people who are considering the same surgeries but haven't yet comitted? (Although I'd hope they obscure identifying details and get permission from the original patients...)
  • tompazourek 6y ago
    The patient can come for a checkup or a related thing and they want to be able to easily retrieve these if they want to check something (or in case there's an issue of sorts). Having it all in a single system is the easiest way to do that.
  • elliekelly 6y ago
    I didn’t let my plastic surgeon take before and after photos for this exact reason. I asked him whether it was necessary for the procedure and what they were used for and he couldn’t really give me an answer beyond it’s nice to be able to compare the finished product. So I told him when I came back in for my post-op I’d be more than happy to pull up a before picture on my phone for him to use to admire his work. I even let him take the “before” photo on my phone. I’m sure he thought I was a paranoid tinfoil hat type but he really didn’t seem to mind.
    • MeinBlutIstBlau 6y ago
      This is one of the rare pieces of advice few people get. You can tell the professional in the room "Your idea is stupid and I as a paying customer do not want that." It's amazing how many people concede to the request. The only place I can't get away with it is a dentist. They love giving x-rays...because apparently that helps with scaling.
      • deleted 6y ago
        [deleted]
      • ghufran_syed 6y ago
        if its in the US, its probably that once you have the machine, and the tech, the cost of time and materials is probably less than 5 dollars, but they can bill the insurance $50-100. So they do it as often as they can, which under most insurance is covered one or twice a year. I could imagine it helping plan treatment for cavities, but for scaling? I doubt it...
        • MeinBlutIstBlau 6y ago
          They can feel cavities with their scaling tools. That's like half the reason why they train in school. They don't need a damn x-ray to do that. And they all say "We will not continue unless we do an x-ray" which just floors me. How is shooting x-rays in my skull even remotely healthy for my brain? I get we can tolerate x-rays, but jesus every damn time I switch dental practices or minimum once per year?
• reiderrider 6y ago
  Do hacker groups have positive track records of not sharing their stolen data? It’s ironic to pay and then rely on trusting them.
  • Miner49er 6y ago
    Yes, otherwise people would stop paying them. However, I wouldn't be surprised if once they make enough money, they do a type of exit scam: sell anything they can, then leave the business. It happens often in dark net markets.
    • ryanlol 6y ago
      Most stolen data is very hard to sell for meaningful amounts. Such an “exit scam” would be a waste of time, you’d make more money by just ransoming one more company. When you’re earning (tens of) millions by extorting companies you aren’t going to be very interested in selling their data for tens or hundreds of thousands.
      • Miner49er 6y ago
        True, it's probably not worth the time unless they've stolen some very valuable data. Obviously things like plastic surgery pics wouldn't be worth much of anything.
        • LinuxBender 6y ago
          Exception would likely be pictures of celebrities. Their managers would not want those being distributed and would sue whoever they could.
          • ryanlol 6y ago
            Again, that’s only good for extortion. Only worth tens of thousands if you’re going to sell them.
• hprotagonist 6y ago
  Paging King Roland of Druidia...
• Timpy 6y ago
  > The Hospital Group, which has a long list of celebrity endorsements, has confirmed the ransomware attack. This isn't a ransomware attack, they're not encrypting the company's drives and demanding a ransom to unencrypt them. Not every "I hacked you now pay me or bad things happen" situation is ransomware.
  • bigbubba 6y ago
    They're not using cryptography, but aren't they demanding ransom? Is the use of cryptography an essential part of what it means for something to be ransomware, or is it merely a common implementation detail?
    • derivagral 6y ago
      To me, ransomware attacks are specifically "the malware got in and turned all my data to mush; the attacker doesn't care about my data, just that I'll pay to un-mush it." This is "the malware got in and sent copies back home; now home base is threatening release and expecting payment to prevent it." To me, this is blackmail done via hacking, not ransomware.
      • Godel_unicode 6y ago
        Fwiw, many actors doing the former are also doing the latter. If someone paid you once to unencrypt, presumably they'll pay you again to not disclose the data. The line between those two business models is pretty blurry.
    • flyGuyOnTheSly 6y ago
      They are demanding a ransom, but Ransomware has a commonly accepted definition which requires encrypting files and demanding payment to decrypt them. [0] [0] https://en.wikipedia.org/wiki/Ransomware https://en.wikipedia.org/wiki/Ransomware
      • zimpenfish 6y ago
        The very first sentence of that link would include this under "ransomware" > Ransomware is a type of malware from cryptovirology that threatens to publish the victim's data or perpetually block access to it unless a ransom is paid. (added emphasis)
• fabianhjr 6y ago
  What always amazes me is that credit card data is almost always safe since VISA/MasterCard and others have very stringent security requirements. (PCI DSS) There are some regulations regarding medical data (Eg, HIPAA) but security seems like an afterthought in most hospitals at best.
  • hahamrfunnyguy 6y ago
    I've done work in the medical industry, both for hospitals and private software companies developing medical software. In my experience; security, stability and compliance with HIPAA and other regulations are taken very seriously.
    • speedgoose 6y ago
      Same. And we have external audits and experts checking what we do.
    • xxs 6y ago
      That's UK, no HIPPA per se. Funny enough, the infamous GDPR applies and data leaks are quite punishable. The Hospital Group is in a quite bad position: 1) the blackmail, in no definition that's ransom. 2) The data leak has to be reported and potentially they will get fined by the state. As for taking regulation seriously, I guess it does depend on the industry. Where I work GDPR and regulatory breaches are treated more seriously than downtime.
      • lotsofpulp 6y ago
        I assume UK business won’t have to worry about GDPR for clients in the UK going forward due to Brexit?
        • xxs 6y ago
          Not really. The UK has its own[0]. [0]: https://www.gov.uk/data-protection https://www.gov.uk/data-protection
    • 6y ago
• underseacables 6y ago
  Are these photos really of interest to anyone? I think for most people you can tell if they’ve had work done. I guess the elephant in the room is breast augmentation, but I think it’s pretty easy to tell the difference between natural and bolt-on.
  • draw_down 6y ago
    This is just denial
  • tompazourek 6y ago
    Lot of the photos might show private parts, and I think people will feel violated when these are shared without their consent.
    • underseacables 6y ago
      But is it enough that the company should worry? It’s not the Fappening. I just think so what, it’s tragic and Blackeye on the company, but it’s like stealing something with no value.
      • motoxpro 6y ago
        Pretty sure the company makes money by people going to get plastic surgery. I'm not going to buy from a company where my private pictures are leaked. Reputation is valuable. The pictures might not be valuable to you, but a lot of people pay for "leaked" celebrity photos, of which the company has a lot of.
      • traceddd 6y ago
        Should the celebs worry? Probably not. Should the company worry? Yes, they’ll have a name for that surgeon who leaks your medical documents and doesn’t really care enough to pay to keep your privacy. There are other good surgeons out there, probably right next door. Customers will be more likely to choose someone else.
• 29athrowaway 6y ago
  They can collect the money and leak the information anyways.
  • tompazourek 6y ago
    If they leak the photos after they get the money, they might have less chance of getting the money next time. They probably don't care for the photos. They care about making money and want to keep making money in the future.
    • powersnail 6y ago
      They might not want to keep making money in the future. Sometimes, they score something big and leave the business.
      • tompazourek 6y ago
        Maybe you're right, but it still feels to me that leaking the pictures will not benefit the scammers much. They might have connections to other people that are still in the business and they'd harm them indirectly by leaking after getting paid. Why make more enemies? Also, why put more attention onto themselves after they already succeeded? Some people have very strange reasons they do things, but I still don't think it's likely. I think these things are organized with the top priority of minimizing the risk of getting caught.
    • anigbrowl 6y ago
      You're assuming they're rational in this regard, but not rational enough to change their identity or select a different class of target in the future.
      • tompazourek 6y ago
        Even if they change both the identity and the target, it's less likely they are going to succeed next time if the photos were leaked. People can read about the story in the news and it can affect the perception of this entire type of extortion in general.
• breck 6y ago
  > "None of our patients' payment card details have been compromised but at this stage, we understand that some of our patients' personal data may have been accessed." Reminds me of a statement put out by White Star Lines in 1912: "None of our passengers payment card details have been compromised but at this stage, we understand that some of our passengers personal lives may have been affected."
  • function_seven 6y ago
    The deck chairs appear to be arranged optimally at this time, but we understand that other circumstances may reduce demand for them.
• sib 6y ago
  "It's understood that many before and after pictures will not include the patients' faces." What kind of pointless statement is this? What is "many"? And does that imply that "many," "most," or "only a few" pictures will include the patients' faces?
  • elliekelly 6y ago
    Photos of facial surgery are more likely to be identifiable (nose, cheeks, chin, lips, eyes/eyebrows) while photos of bodily surgery (breasts, arms, stomach, etc.) won’t include the patient’s face. Its probably up to the doctor’s photograph preference what types of facial photographs are identifiable and how close/far the zoom is when they take the picture.
  • anonymfus 6y ago
    > It has 11 clinics specialising in bariatric weight loss surgery, breast enlargements, nipple corrections and nose adjustments. I guess pictures of nose adjustment patients most certainly include faces, and pictures of nipple corrections probably don't.
• Waterluvian 6y ago
  Until these breaches result in lawsuits and maybe even criminal charges that result in complete dissolution of the corporation to pay out, these events will never stop happening.
• ajay-b 6y ago
  The payoff for hackers seems too low here, why was this even a target? Kids and too much free time?
  • aaron695 6y ago
    REvil are a well established hacking firm. They normally ask in the millions. Generally anyone can pay for it. You could buy it instead if you want. (There is an Auction section, but it's not open for TheHospitalGroup atm) The amounts they ask from even small websites I find way too high. Perhaps their website asks high so when they go lower they get paid. If you don't pay and no one else wants to pay, it goes public. REvil .onion - "At the beginning of next week we will post the first batch of files, namely: Pacient Personal - 20гб TMG OFFICIAL Documents - 50гб" > why was this even a target? I assume like almost all hacks, even at the nation level, it's opportunity more than targeted. This website had a sploit, then they found real data behind it.
• ashishb 6y ago
  Private data is a toxic asset. Businesses should learn to purge it regularly to minimize such damages.
  • jessaustin 6y ago
    One would think that if anyone had seen enough breasts, it would have been a plastic surgeon. Maybe they preserved these images for use in malpractice suits, but that's not a reason to keep the images online.
    • HenryBemis 6y ago
      Yes, insurance, malpractice. I talked to a friend who is CTO in a private hospital that has a clinic for plastic surgeries (but mostly for non-vanity purposes aka burns, acid attacks, etc.). One main reason for the pre-during-post photos is for medical studies, progress monitoring, training, etc. They keep these photos on a server on a separate network (and photos are not accesible to the typical workstation, but on locked-down ipads). For the famous people, it's a 'nice' extortion, for some 'glossy magazine babe' who claims she is all natural, to come up with evidence of implants, etc. would be devastating to her number of followers, and thus sponsors/payments.
      • crx07 6y ago
        If the data is sensitive, keeping it on a locked down iPad is nowhere near enough to protect it. I can understand if they're using the images for machine learning or something, but if it's truly just to prevent future malpractice, data like this should only be kept on air-gapped systems or offline media. That said, let's hope we're beyond the point of anyone caring about pictures of the human body or whether someone's had plastic surgery. If I were threatened with something like this, which could be pretty embarrassing since I lost so much weight and have loose skin, I'd tell the hackers that I'll release even more if they leak mine and then attempt to find dirt on them.
        • g_p 6y ago
• imgabe 6y ago
  This sort of thing just shouldn't even be a viable threat. The response should be "go ahead and publish it, who cares?" If you heard tomorrow that there were a bunch of plastic surgery before and after photos online, would you even go look? What is the threat here - that people will search the data for people they know and...make fun of them? Really?
  • SirSavary 6y ago
    People who have gone through gender affirmation surgery may want that to remain hidden knowledge
    • imgabe 6y ago
      > It has 11 clinics specialising in bariatric weight loss surgery, breast enlargements, nipple corrections and nose adjustments. It doesn't seem like that was done at these clinics.
  • draw_down 6y ago
    More denial
• hackinthebochs 6y ago
  It's funny how these articles are always so quick to reassure "no payment details have been compromised", as if that is a significant concern. How did we get to the point where the private data that can be rendered obsolete with one phone call is treated much more securely than private data that will follow us for the rest of our lives? We need a lobbying group that will strong-arm lawmakers into crafting regulation so that our personal information will be treated with at least as much care as ephemeral credit card numbers.
  • sdenton4 6y ago
    Seems like the payment data is just handled by the credit card companies, so it's a matter of targeting random businesses vs Visa.... So, seems like you're ultimately advocating for all data to be handled by credit card companies, or similarly hardened targets. In the end this may not gain much; a company with compromised api access is still a good target. Which helps demonstrate another difference: Companies need ongoing access to their data, where payments are 'fire and forget' and thus are easier to protect.
  • koheripbal 6y ago
    I suspect it is mentioned specifically because payment data falls under PCI regulations and thus adds response requirements. So stating that such data was not leaked is meant to prevent that additional PCI response step.
  • deleted 6y ago
    [deleted]
• LockAndLol 6y ago
  I guess we'll see whether those people spouting "I have nothing to hide" really mean it.