9 ms·
Delta Dental says data breach exposed info of 7M people
- dreamcompiler 3y agoAt this point any company still using the MOVEit service should probably be considered criminally negligent. That service has been the source of a number of high-profile breaches in 2023.
- mikece 3y agoAt this point I'm willing to bet that every single American -- including the Amish -- have been part of at least one major data breach. And for everyone on HN... probably at least ten.
- fatnoah 3y agoI've been part of four or five breaches. My favorite part is the complete lack of value in the mitigations for me. I was part of the OPM data breach, and the data included was literally everything, since it was everything collected as part of my application for a security clearance. A result of that was 10 years of credit monitoring, so every new breach's offer of 12 or 24 months of monitoring is useless. Until there are statutory damages for data breaches, and even steeper ones for failure to report breaches, companies aren't going to properly safeguard data.
- phatskat 3y ago> statutory damages for data breaches, and even steeper ones for failure to report breaches If say an engineer becomes aware of a breech, would going public if their company didn’t do so within the legal timeframes to report be covered by whistleblower protections?
- bonton89 3y agoMy understanding is about everyone in America (and bizarrely a lot of people in Europe) got f'ed by the Equifax breech already.
- flutas 3y agoTBH, I know of at least one other breach that everyone got hit by too...afaik it was never made public though. It's been a while since I was told the story, so bear with me. It was Experian. They shipped tape backups of essentially their entire consumer credit DB, unencrypted, via UPS. UPS truck got robbed at gunpoint, only one package stolen... EDIT: Transunion -> Experian
- michaelcampbell 3y agoBack when people got physical checks for payroll, I worked at a company that did this, and gave physical stubs to those of use who did direct deposit which was still kind of new. Biweekly, the person handing them out would take them home to sort by floor/area/whatever to ease their work the next day. You guessed it, one day their car was stolen, with ALL of our checks/stubs in them. And our SSN's were printed on them too. We were given a year of credit monitoring at the credit unions, paid for by the company. And they stopped printing the SSN's on them.
- shnock 3y agoCould you please share some online references or sources for this? "It was never made public" - do you mean to imply that this is otherwise unverifiable
- ffpip 3y agoMight be this - https://www.nytimes.com/2005/06/07/business/personal-data-for-39-million-lost-in-transit.html https://www.nytimes.com/2005/06/07/business/personal-data-fo... First result for "experian ups truck stolen"
- eli 3y agoWow that MoveIT hack sure was bad. How did they manage to keep from becoming a punching bag like SolarWinds? Also the title should probably clarify this is Delta Dental of California.
- hn_throwaway_99 3y ago> who had their names, financial account numbers, and credit/debit card numbers, including security codes, exposed. Delta Dental should be rightly and truly f'd for that one. Storing security codes at all is totally forbidden by PCI rules. Delta Dental should have their ability to process credit cards completely revoked for this egregious breach.
- vaxman 3y agoYep, that vendor is a major HMO for Defense workers with Top Secret clearances. Does SiteLink have issues too? I think they do.
- robertlagrant 3y agoWhy they are doing their own payments processing is beyond me. Is it just too expensive to use someone like Stripe?
- packetlost 3y agoStripe? Oh yeah. At their scale, they'd likely be talking to Fidelity or some other big player directly.
- mrweasel 3y agoI was going to ask something similar. Especially US companies seems rather fond of storing credit card information, but I never seem it done in Denmark, regardless of the size of the company. The most common solution is to let your payment processor deal with those sorts of things, you just have a token, which can only be used to deposit money into your account. So even if it's stolen or leaked, you can transfer the money back, they can't be transferred to a third party. Why on earth you'd want to deal with credit card information and the attacks it attracts is beyond me. It's not like you're locked to the your provider, the tokens can be transferred... Not easily, but it can be done. And no, companies would never pay Stripes asking price. You can negotiate much much lower rates with companies like Valitor/Rapyd or certain banks.
- 3y ago
- highwaylights 3y agoSurely the data breaches we hear about are the tip of the iceberg? Just think of what needs to happen after a hack for you to hear about it: - someone at the company needs to be aware it has happened. - they need to accurately identify what was accessed. - they need to disclose that this has happened. - it needs to be visible enough that it gets picked up and talked about. Each step of that funnel must have some drop-off that is non-zero. Do we hear about 80% of breaches? 5%? Honestly I’ve no idea.
- sofixa 3y agoWell thankfully point #3 is mandatory in places with laws such as the GDPR or California or Brazil's equivalents which mandate disclosure to impacted users and publicly.
- willcipriano 3y agoMurder is similarly forbidden. Still happens.
- kossTKR 3y agoYes, i'm pretty sure no more than 5% of breches and leaks gets public press. There's so many internal company filters a breach has to go through to become public all the way from some engineer messing up and "just closing the terminal" with a beating heart hoping no one will notice - to a long chain of managers who has to send the message upwards, then the leadership approving public disclosure, all with negative pressure to not disclose because of career, stress, extra work, penalties, all the way to stakeholder value.
- lofaszvanitt 3y agoJust get into the proper forums and see all the data offered for sale.
- rightbyte 3y agoI would honestly guess about 0.1% of bad leaks (e.g. not just email and user name or whatever) are disclosed in the end. It has to be really hard for the police or card providers to correlate frauds with customer databases. And like, how do you even notice you are hacked? Unless the hacker sends you extortion messages, which I guess is the main reason for disclosure. Otherwise the hacker can tip off the an attorney and 'pwn' corporate lawyers for real. A risk the lawyers won't take even if the company wanted to. I sometimes feel lawyers are the only group of workers with real agency ...
- jimmygrapes 3y agoCool, Delta Dental is one of the few dental insurance providers the VA recommends and offers plans with. Nothing says "we support veterans" like a good old fashioned sell-off of data.
- nickthegreek 3y agoThe data was siphoned from Delta Dental, not sold by Delta Dental.
- sokoloff 3y agoIf I have three simultaneous/overlapping years of free credit monitoring from various breaches, am I triple-protected?
- tyingq 3y agoWhen I ask my non-techie friends about stuff like this, they really don't care anymore unless they actually get hacked, scammed, etc. It happens so often that there's now "breach fatigue". Meaning little pressure on companies to do better.
- MattGaiser 3y agoEven as a tech person, I am indifferent. I’ve adapted to a world where cards get stolen, so I never use debit, review my statements, and have spending notifications turned on for my phone. I have the apps so I can instantly lock my card. I have already learned to live in a financial castle. It is obviously not great, but an additional breach has little marginal impact on my life.
- Dalewyn 3y ago>so I never use debit, review my statements, Even the most Joe of Joe Averages should be doing that, honestly. The primary reason to use credit cards over debit is for the fraud protection, and reviewing monthly statements is just something everyone should do.
- pants2 3y agoThe real question is why online credit card payments still involve using the whole card number, as opposed to some message signed by the card's private key authorizing certain spending limits for a retailer.
- sokoloff 3y agoOnline retailers almost surely do better by allowing easy use of credit cards by even the least technical 5% of Americans than they would from a lower fraud system that required a moderate or higher level of technical acumen to operate. Suppose I'm at a computer ready to buy a PS5 on BestBuy's site. What's the complexity now vs under a proposed private-key system? What's the loss in conversion rate on the latter?
- 3y ago
- sologoub 3y agoIt’s pretty sad that after decades of such breaches, these still do damage. We have had tech, such as security keys, for some time. Even basic Authenticator app helps. These should be standard with anything remotely sensitive. Another sad point is that there is rarely true accountability. Offering 24 months of some service is a pittance and an expense of doing business that could be factored/priced in, continuing the poor security practices.
- vladgur 3y agoDoes this only impact people who purchase individual coverage through Delta Dental? I’m assuming employees with employer-sponsored Delta Dental plans have no reason to provide Delta with their credit cards
- jebarker 3y agoI have Delta Dental through employer and I'm pretty sure I've never had to give them any CC info. Any copays go directly to the dentist.
- fn-mote 3y agoThey knew about the breach June 1, confirmed June 6, but the information is only made public after almost five months, November 27? (After a "second, more lengthy investigation".) This is better than nothing, but it seems absurd.
- oasisbob 3y agoIt is absurd, and it violates the mandatory timely notification laws which are in place in many states, including Washington. Umpqua bank was also affected by MoveIt by way of one of their fintech vendors (FIS), they didn't even bother to notify my state's AG, as required by law, nor did they provide timely or accurate notifications. Maybe companies feel a diffusion of responsibility when there are so many others affected.
- vkou 3y agoThey feel a diffusion of responsibility because they are never held responsible for it.
- gunapologist99 3y agoAccording to the article, this applies mostly or only to Delta Dental of California. Slightly OT: Delta Dental was the company that Costco used to sell Dental Insurance through. (unfortunately, that partnership has ended with no replacement.) Careington and Thrive both offer overlapping discount plans that (especially combined) can more than offset the much higher monthly (not low annual) prices that Delta Dental is now charging, especially for a family.
- Podgajski 3y agoWhen are they going to be consequences for the companies that let these data breaches happen?
- teeray 3y agoIt’s lamentable that any of this information still has value to fraudsters. Once it became clear that companies cannot safely control this data, it should have been stripped of any value by having some security token under user control provide the actual payment authorization.
- bradgessler 3y agoI’ll never forget when a Citibank employee that processes mortgage applications asked me for my credit card over email. They also had a “secure messaging center” that would take your message, put it in a PDF, password protect the PDF, and then send it to the email address along with instructions for them to login to the website to get the PDF password. The list goes on of bad things banks do with security and is a blatant reminder, “rules for thee but not for me”
- chrbr 3y agoThe entire home-buying process (in the US, at least) seems to be built on shady-looking ways to nickel and dime people. I remember telling friends when going through it that it'd be easy to scam me because I got so used to urgent requests to pay some fee for inspections or legal stuff or whatever that I'd just shell out the money without asking questions.
- wharvle 3y agoIt's got nothing on medical billing. Seemingly random bills from entities you may never have heard of showing up months later even when you paid a shitload (thousands) up-front. [EDIT] Oh and they may not put enough info on the bill to figure out WTF it's even for, without calling them. It'll have some uselessly-generic single-line item for what was probably multiple things, but you'll have to spend an hour on hold to find out what you're supposed to be paying for.
- deepsquirrelnet 3y agoSidebar, but does anybody else get incensed by the fact that Delta frequently uses customer’s SSN as their account number? My dentist looked at me like I was crazy when I told them I didn’t want my account information being stored on their computers for that reason. But maybe in this moronic system, resistance is futile.
- excerionsforte 3y agoReally basic security practices weren't followed. I cancelled my plan now and switching to my new primary health insurance dental plan which I should've looked at. I don't know why these companies wait for a breach before looking at their systems after all these data breaches. I mean storing credit cards is Do Not Do 101.
- vlod 3y agoIf you've been putting it off, a friendly reminder to freeze your account at the credit card agencies. Make sure you do all 3! Here's details from NerdWallet: https://www.nerdwallet.com/article/finance/how-to-freeze-credit https://www.nerdwallet.com/article/finance/how-to-freeze-cre...
- laweijfmvo 3y agoGood tip! It's awful what this entails: 1) Creating accounts with the major credit reporters, presumably subject to hacks or social engineering 2) Accounts that require answering an easily guessed "secret question" 3) Password "rules" that restrict both the length and special characters of your password 4) After all that, creating the account results in a "Congratulation!" NOT FROZEN account. You have to go through an extra step to actually feeze it. 5) "Sorry, we can't freeze your account right now!"
- vlod 3y agoYeah... it's a complete PITA. I also had the 'we can't freeze right now' and it took a few days of verification and eventually having to call them to get it all sorted. My reasoning is it's better to do this before a bad person has your account rather than during.
- wharvle 3y agoOne wonders, at times, how much modern "efficiency" is just shifting costs to places they're less well-observed.
- callalex 3y agoIt’s super fun and cool that dentistry is controlled by a cartel and we just let it happen out in the open. It is NOT insurance, because there is no risk pooling or coverage for adverse events. It’s just a payment plan that sets prices unilaterally.
- shnock 3y agoAre acute and not universal dental operations like a root canal, crown, abscess op not adverse events for which there can be risk pooling?
- callalex 3y agoThey are, and that is not what Delta “insurance” covers.
- deleted 3y ago[deleted]
- quacker 3y agoI’m not sure why you say this. Maybe I don’t understand what you mean. I have Delta Dental through my employer’s benefits and it covers all the types of operations that I’d expect: preventive, endodontic, periodontic, orthodontic, prosthodontic, etc. If I need a root canal, it’s covered by Delta Dental (up to a point, given the deductible). If I chip a tooth, and get an inlay or onlay, that is covered. Is this not insurance? Why not?
- calfuris 3y agoWhere I live, Delta offers a plan that essentially provides a set price list for various procedures as long as you are in network. Perhaps the person you're replying to has run into that plan and didn't realize that they also have more conventional plans.
- daft_pink 3y agoAs someone that used Dental Insurance heavily after I didn't take good care of my teeth in my 20's and previously negotiated many different Dental policies as an agent for a large employer this really isn't true. 1. I found that different Dental Insurance companies have wildly different negotiated rates and there is no real standard. Delta Dental tends to have better negotiated rates in my experience and United Healthcare's dental plans seem like they don't negotiate at all and using a specialized Dental company results in the lowest rates overall as the large health insurers are simply profiting off the insurance and don't seem to care how much they pay, which sucks when you pay a percentage for a procedure. 2. The totally covered population for dental insurance is not big enough to control the market. Generally, I found that when I wasn't covered by dental insurance, dental costs were a lot higher and you do generally receive a savings from dental insurance and they really don't have enough market share to control the market. 3. The coverage for adverse events is mostly just limited, because if you go to the dentist regularly, you generally don't have tons of adverse events within one year. I think most people will find a decent dental insurance plan will mostly cover them. Even if you exceed the negotiated rate, I just find that in general having dental insurance is beneficial to me as a person and not a scam like vision insurance where you are generally better off finding a coupon or deal, or ridiculous like health insurance where they have manipulated the networks and deductibles so that the average person has no idea what they are buying or how to evaluate it. My criticism of dental insurance would simply be that I think that policy holders should benefit from company negotiated rates under a policy even when a particular item isn't covered under their policy. I find that is the one area where dental insurance in general is lacking, because dental insurance takes the negotiation out of pricing and gives you the benefit of the companies negotiated rates.
- daft_pink 3y agoScary thing about this is that Delta Dental is multi-state entity, but Delta Dental of California is the entity that handles federal employee benefits, so it likely leaked sensitive details about many federal employees if it contained their entire subscriber base.
- thrillgore 3y agoYou know what will make this stop? Actual consequences for not preventing data breaches, like jail time.
- yieldcrv 3y agoweb2isgoinggreat
- pests 3y agoYall know not every lives in CA?
- markhahn 3y agowe need to flip the conversation on this. journalists don't seem to grok the fact that breaches are totally the fault of the breached site. sure, the attackers are bad people, but that's a different crime. we need something close to a death sentence for sites that allow themselves to be breached. mandatory $10k per exposed SSN, $10 per exposed email, that sort of thing. what would be the result? only good: sites should not be storing this data themselves. the real conversation-flip is that we need to put people in charge of their own data, and make it radioactive for data-users (like Delta Dental) to store it. this kind of data should only live in facilities that are solely run for the purpose, and which provide the data-subject with full control. who pays? not really that hard - some combination of the data-subject, data-users (transaction fees), perhaps just a governmental single payer (since we're talking tiny cost). imagine if you could look at your data (you can't today!) and could explicitly share out bits to particular data-users. all your records (dental, tax, CC, banking).
- toywinder 3y agoMOVEit has been a vector for several high profile bank and government breaches in the last few months. I really have to wonder why anyone is still using their services after yet another security incident.
- ramesh31 3y agoGreat example of why you should never ever ever give out a debit card number for anything. Just about every credit card company has virtual numbers now. And even still, there's a massive difference between disputing a credit charge and replacing lost funds in a checking account.
- purpleblue 3y agoDelta Dental is one of the worst dental insurance companies out there. I hope it goes bankrupt. They have cut benefits so much that most dentists I know have dropped them completely and refuse to take them. It has caused a bunch of headaches for us and for most families I know.
- anonuser123456 3y agoMy wife’s dentist dropped them this year. My dentist is considering it in the near future.
- anonym0us88 3y ago[dead]
- snakeyjake 3y agoYay. I can expect yet another $7.35 settlement check sent to my Venmo in 18 months...
- hedora 3y agoPeople say that delta shouldn’t have been storing CVC numbers (fair point), but note that the breach was upstream of them at MoveIT, which supplies an on-prem file transfer program and cloud offerings specifically for managing PCI environments. The real WTF is that the PCI compliance vendor’s solution led to them storing that data. “It’s your only job,” and all that…
- 2OEH8eoCRo0 3y agoCL0P (Russia) is known to target MOVEit but I can't find any confirmation of which threat actor is believed to be implicated. https://en.wikipedia.org/wiki/Clop_(cyber_gang) https://en.wikipedia.org/wiki/Clop_(cyber_gang) https://www.cisa.gov/news-events/news/cisa-and-fbi-release-advisory-cl0p-ransomware-gang-exploiting-moveit-vulnerability https://www.cisa.gov/news-events/news/cisa-and-fbi-release-a...
- keep_reading 3y agoAhh ok I'll change my privacy.com card for Delta Dental then
- marcod 3y agoIf I say "this AC is on its last legs" I'm likely talking about acceptance criteria ;)
- dreamcompiler 3y agoWe need regulations that fine companies in the neighborhood of $10,000 per violation (i.e. per person whose info was compromised) plus potential prison time for company officers in cases of egregious violations, which this appears to be. Until prison time is on the table, companies will continue to collect, store, and sell personal information and will continue to fail to implement best practices for protecting it.
- mikegabriel 3y agoUnder PCI-DSS v4.0, the card verification code, which is the three- or four-digit number printed on the front or back of a payment card, must not be retained after the completion of the authorization process. This rule is in place to prevent fraudulent activities, such as Internet and mail-order/telephone-order transactions, which can occur if card verification code data is stolen .
- Complain 3y agoWhy did DD wait so long to inform customers about the breach? It occurred in May, more than half a year ago.
- Complain 3y ago[dead]