5 ms·

Data breach at Kaiser Permanente affects 13.4M people

121 points by kryster 3y ago

waihtis 3y ago
Genuinely think cyber has a massive overengineering problem - I havent worked with Kaiser but am under the impression they run quite a sophisticated op, with a lot of advanced modeling done for vulns & cyber risk in general. Yet they got pounded pretty hard here. Creeping suspicion is too much focus on doing ”smart” things with data, AI and such and not enough on actually worrying about not getting breached.
- deleted 3y ago
  [deleted]
- thephyber 3y ago
  > Yet they got pounded here Huh? Your passive tense suggests this happened to KP’s teams. From what I’m reading, those are the teams who would have had to actively take action to import the tracking code on their pages. My money is on “we imported a thing on the website because our advertising team needed to know when advertised users converted from any of many different advertising channels”. Usually it’s easier to import a script on a common layout, rather than just a single landing page. Ad teams overrule the website / security teams because one is a profit center and the other is a cost center. Then as engineers / product teams turn over, the new employees don’t know the original intention of the old imported code and are wary to remove it (and if they do, the process is long and drawn out).
GraffitiTim 3y ago
This is why we need Freshpaint (YC S19) for analytics and other services for healthcare companies. A primary focus on regulatory compliance, privacy, security.
agnokapathetic 3y ago
this is just from Share Embeds. they now disclose these are used at login.
- roywiggins 3y ago
  [deleted]
throwaway81523 3y ago
Kaiser has had another privacy bug for many years, which is they give out phone numbers of individual doctors in the Kaiser system (of course it goes to voice mail). That sounds great but it's invasive: call a Kaiser oncologist, and your phone carrier sells the number you dialed to data brokers who profile you as a likely cancer patient. Call an AIDS specialist, gender transition therapist, abortion provider, etc.: same idea. Kaiser should instead have a single incoming phone number where you enter an extension of the doctor you are trying to reach. So everyone dials the same outgoing number. I griped to them about this around 10 years ago and they basically said hrmmph.
- lotsofpulp 3y ago
  That’s a crazy solution to a legislative problem. Also, source that call records are sold? I thought even the government (non federal security apparatus) needed a warrant to get access to that information?
  - 01HNNWZ0MV43FF 3y ago
    sounds like I need to start dialing some random businesses to fuck up my ads
  - kevingadd 3y ago
    https://www.popularmechanics.com/technology/security/a23567/att-phone-records-police/ https://www.popularmechanics.com/technology/security/a23567/...
    - lotsofpulp 3y ago
      The source material on page 9 and 10 claims a subpoena is necessary: https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/02/us/hemisphere-project.html?_r=0 https://archive.nytimes.com/www.nytimes.com/interactive/2013... Therefore, I am confused whether or not a warrant is needed. If the phone networks were straight up selling call records, then surely no law enforcement agency would bother with warrants.
ComputerGuru 3y ago
Do you think they still have my records from 30 years ago? Not really kidding, actually curious if that data was ever properly migrated from system to system.
- kevingadd 3y ago
  My historical records were never digitized by KP, they're on paper in a storage bin somewhere.
  - ComputerGuru 3y ago
    Curious how you know and how far back you are referring to? Did you stick with them throughout — if so, I would imagine they would have had extra incentive to import just yours, at the very least (and others like you, obviously). Glad to know they’re a forest fire away from being lost. If you haven’t used your medical records or had them forwarded to another provider in over three decades, I think it’s ok if they go bye-bye.
    - kevingadd 3y ago
      Childhood records. Stuff from my adult years is digitized, but when I was seeing a specialist she said I would have to go visit the hospital where I was born/seen as a child and hope they still had the paper records. I've been with KP most of my life, yeah. And I think you're right that in most cases, it's not really necessary to have the old records. It would have been useful in this case, but it's a niche case.
  - el_benhameen 3y ago
    My visit information wasn’t digitized as far as I know, but my vaccine records and possibly other records from the 1980s are in my kp account.
    - patja 3y ago
      About 10 years ago they dug up all my Group Health Coop (since bought by Kaiser) vaccine records since 1970 and updated the digital record to include them
phone8675309 3y ago
It should be illegal for any private company to hold that much personal information
- hi-v-rocknroll 3y ago
  Every American voter could call and/or write physical letters to their representatives to express their displeasure about the lack of purchase, web, and financial data and telco metadata privacy rights. https://www.commoncause.org/find-your-representative/ https://www.commoncause.org/find-your-representative/
hi-v-rocknroll 3y ago
Ouch. Perhaps they still have records of doctor incompetence when they nearly killed me at birth at their demolished Santa Clara location. KP is a good deal when or if you are healthy but not so great if you aren't.
nikolay 3y ago
It's always the SOC 2 and HIPAA-compliant companies that get breached, but, of course, mostly compliant companies are lucrative targets.
- bearjaws 3y ago
  It's because HIPAA is a joke and SOC2 is basically the bare minimum at this point. Too many little ways to manipulate your artifacts to pass SOC2 and no accountability when it goes wrong.
  - gopher_space 3y ago
    Sat in a hospital room with a relative for two weeks and saw staff repeatedly violate compliance directives in order to provide timely care. They clearly weren't being provided the resources needed to do so. Also, for the entrepreneurs out there, they seem to really need some kind of tubing that won't collect air bubbles. Something with a hydrophobic interior? I don't know. There's a related area regarding flushing IV systems that could use attention as well.
  - nikolay 3y ago
    Just the fact that SOC 2 auditors are CPAs speaks enough. I remember working at a large e-commerce company, and the InfoSec offers told me that we didn't care about PCI compliance as we could only get fined, but we could get into orange jumpsuits for mishandling PII. And that was over a decade ago, talking only about names, addresses, emails, and phone numbers. With HIPAA leaks, it's tons more than just that, and I'm not sure what the consequences are, but back then, we didn't want to sell prescription eyewear only due to the HIPAA burden.
xyst 3y ago
Anyone that has worked in a sector where technology is often a second tier citizen or after thought knows these types of breaches are inevitable. Hospitals. Banks. Airline industry. The shit I have seen in just these industries made me think twice about having my private information held here. Of course, the “IT” is often outsourced or “in sourced” (often juniors fresh out of college). Thus simple shit such as network segmenting production and development environments; and limiting access to production databases/assets is nonexistent. I remember working in an airline where the backend systems were still running on outdated mainframe systems. Nobody had a clue how the existing mainframe systems worked. No documentation. Only poorly maintained support docs on how to keep it running. I ended up silent quitting after 3 months because management kept shutting down all of my initiatives to improve ops and quality. This company later had a massive meltdown. I wasn’t surprised and just glad I wasn’t subpoenaed.
cnj 3y ago
> The data exposure was discovered following an internal investigation conducted voluntarily by Kaiser Permanente. The company discovered that online trackers used on its websites and mobile applications were transmitting certain types of personal data when users interacted with its services. I have respect for the individuals that started this investigation, and the ones that made sure this is publicly disclosed. This could have easily been swept under the carpet. Actually, that they uncovered this on their own and publicly disclosed it sounds like they have an above-average privacy culture in place. I know the odds that the person(s) who kicked off this investigation are reading this comment are very low, but if so: Kudos, well done!
shreezus 3y ago
None of this surprises me one bit. I have worked in the health space for several years, and I have personally seen the inner workings of several insurers and the manmade horrors within. It blows my mind that these multibillion dollar institutions are so poorly managed on the technology/IT front. I think most people will have their health data likely leaked at some point.
- peteradio 3y ago
  > I think most people will have their health data likely leaked at some point. Just don't go to the hospital or in any other way involve your system with the InsuroServo complex. Problem solved!
mleonhard 3y ago
I reported this to Kaiser on 2021-11-22, in support case number 53710772. Below is the content of the ticket I filed. I didn't follow-through on disclosure. Now I wish I had, since they could have fixed this problem faster instead of taking 2.5 years. I am still a satisfied Kaiser customer. ---- Hi KP.org Team, Just now, I logged into KP.org. Something was loading slowly, so I viewed the network requests the website was making. I was surprised to see requests to Google, Adobe, Bing, Qualtrics, BTTag.com, and Unpkg.com. A request to Google includes info intended to de-anonymize my computer: time, IP addr, device type, display size, browser window size, timezone, and others. These requests occur even while reading messages with my doctor! The page loads JavaScript from Adobe, Bing, Google, and Qualtrics. People who control those companies' servers can read my confidential messages. Adobe has a track record of incompetence in IT security. Please review your decision to make KP.org load external code and trackers. If you do not respond by 2022-01-14 (90 days), I will disclose this information to privacy-oriented media organizations and HHS.gov. I saved screenshots for this purpose. Sincerely, Michael
- khana 3y ago
  [dead]
- ewhanley 3y ago
  That's pretty gross. Why would a hospital/healthcare system even need all that tracking? They don't make enough from their primary business that they also need to sell patient data for advertising? I would guess some dev just slapped on a bunch of boilerplate that so many other projects use and called it a day.
  - mistrial9 3y ago
    someone wanted ad revenue and it leads to this.. source: personal exposure to "ad markets in hospitals" here in the SF Bay Area
- adolph 3y ago
  Login page still loads up Adobe and Qualtrics. Maybe KP has BAA with those services? URL (gets redirected): https://healthy.kaiserpermanente.org/consumer-sign-on https://healthy.kaiserpermanente.org/consumer-sign-on If one had a list of patient portals[0], what would be the simplest way to check each for 3rd party trackers? Use Selenium? 0. curl -s "https://www.mychart.org/LoginSignup" | grep 'JSON.par' | sed -e 's;^.*JSON.parse('\'';;' -e 's;'\'').*$;;' | jq '.Customers[].LoginUrl' | tr -d '"'
jmholla 3y ago
Is this a HIPPA violation?
nextworddev 3y ago
So much for hipaa
wahoo324 3y ago
I wonder if they had CSP and intentionally bypassed or they didn't have CSP at all.
slater 3y ago
There's something seriously wrong with the KP web department. Their current site is a slow, buggy mess that regularly locks up for no discernible reason on my system (M2 Air, latest Firefox and macOS). Just the other day I had to nuke all the cookies to log in again, because the site got itself in a login loop ("the website isn't redirecting properly").
_akhe 3y ago
Literally 1 month ago: Kaiser lays off IT workers for a second time in 4 months Maybe they kept the wrong ones haha

121 points by kryster 3y ago

Genuinely think cyber has a massive overengineering problem - I havent worked with Kaiser but am under the impression they run quite a sophisticated op, with a lot of advanced modeling done for vulns & cyber risk in general. Yet they got pounded pretty hard here. Creeping suspicion is too much focus on doing ”smart” things with data, AI and such and not enough on actually worrying about not getting breached.

deleted 3y ago
[deleted]
thephyber 3y ago
> Yet they got pounded here Huh? Your passive tense suggests this happened to KP’s teams. From what I’m reading, those are the teams who would have had to actively take action to import the tracking code on their pages. My money is on “we imported a thing on the website because our advertising team needed to know when advertised users converted from any of many different advertising channels”. Usually it’s easier to import a script on a common layout, rather than just a single landing page. Ad teams overrule the website / security teams because one is a profit center and the other is a cost center. Then as engineers / product teams turn over, the new employees don’t know the original intention of the old imported code and are wary to remove it (and if they do, the process is long and drawn out).

GraffitiTim 3y ago

This is why we need Freshpaint (YC S19) for analytics and other services for healthcare companies. A primary focus on regulatory compliance, privacy, security.

agnokapathetic 3y ago

this is just from Share Embeds. they now disclose these are used at login.

roywiggins 3y ago
[deleted]

throwaway81523 3y ago

Kaiser has had another privacy bug for many years, which is they give out phone numbers of individual doctors in the Kaiser system (of course it goes to voice mail). That sounds great but it's invasive: call a Kaiser oncologist, and your phone carrier sells the number you dialed to data brokers who profile you as a likely cancer patient. Call an AIDS specialist, gender transition therapist, abortion provider, etc.: same idea. Kaiser should instead have a single incoming phone number where you enter an extension of the doctor you are trying to reach. So everyone dials the same outgoing number. I griped to them about this around 10 years ago and they basically said hrmmph.

lotsofpulp 3y ago
That’s a crazy solution to a legislative problem. Also, source that call records are sold? I thought even the government (non federal security apparatus) needed a warrant to get access to that information?
- 01HNNWZ0MV43FF 3y ago
  sounds like I need to start dialing some random businesses to fuck up my ads
- kevingadd 3y ago
  https://www.popularmechanics.com/technology/security/a23567/att-phone-records-police/ https://www.popularmechanics.com/technology/security/a23567/...
  - lotsofpulp 3y ago
    The source material on page 9 and 10 claims a subpoena is necessary: https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/02/us/hemisphere-project.html?_r=0 https://archive.nytimes.com/www.nytimes.com/interactive/2013... Therefore, I am confused whether or not a warrant is needed. If the phone networks were straight up selling call records, then surely no law enforcement agency would bother with warrants.

ComputerGuru 3y ago

Do you think they still have my records from 30 years ago? Not really kidding, actually curious if that data was ever properly migrated from system to system.

kevingadd 3y ago
My historical records were never digitized by KP, they're on paper in a storage bin somewhere.
- ComputerGuru 3y ago
  Curious how you know and how far back you are referring to? Did you stick with them throughout — if so, I would imagine they would have had extra incentive to import just yours, at the very least (and others like you, obviously). Glad to know they’re a forest fire away from being lost. If you haven’t used your medical records or had them forwarded to another provider in over three decades, I think it’s ok if they go bye-bye.
  - kevingadd 3y ago
    Childhood records. Stuff from my adult years is digitized, but when I was seeing a specialist she said I would have to go visit the hospital where I was born/seen as a child and hope they still had the paper records. I've been with KP most of my life, yeah. And I think you're right that in most cases, it's not really necessary to have the old records. It would have been useful in this case, but it's a niche case.
- el_benhameen 3y ago
  My visit information wasn’t digitized as far as I know, but my vaccine records and possibly other records from the 1980s are in my kp account.
  - patja 3y ago
    About 10 years ago they dug up all my Group Health Coop (since bought by Kaiser) vaccine records since 1970 and updated the digital record to include them

phone8675309 3y ago

It should be illegal for any private company to hold that much personal information

hi-v-rocknroll 3y ago
Every American voter could call and/or write physical letters to their representatives to express their displeasure about the lack of purchase, web, and financial data and telco metadata privacy rights. https://www.commoncause.org/find-your-representative/ https://www.commoncause.org/find-your-representative/

hi-v-rocknroll 3y ago

Ouch. Perhaps they still have records of doctor incompetence when they nearly killed me at birth at their demolished Santa Clara location. KP is a good deal when or if you are healthy but not so great if you aren't.

nikolay 3y ago

It's always the SOC 2 and HIPAA-compliant companies that get breached, but, of course, mostly compliant companies are lucrative targets.

bearjaws 3y ago
It's because HIPAA is a joke and SOC2 is basically the bare minimum at this point. Too many little ways to manipulate your artifacts to pass SOC2 and no accountability when it goes wrong.
- gopher_space 3y ago
  Sat in a hospital room with a relative for two weeks and saw staff repeatedly violate compliance directives in order to provide timely care. They clearly weren't being provided the resources needed to do so. Also, for the entrepreneurs out there, they seem to really need some kind of tubing that won't collect air bubbles. Something with a hydrophobic interior? I don't know. There's a related area regarding flushing IV systems that could use attention as well.
- nikolay 3y ago
  Just the fact that SOC 2 auditors are CPAs speaks enough. I remember working at a large e-commerce company, and the InfoSec offers told me that we didn't care about PCI compliance as we could only get fined, but we could get into orange jumpsuits for mishandling PII. And that was over a decade ago, talking only about names, addresses, emails, and phone numbers. With HIPAA leaks, it's tons more than just that, and I'm not sure what the consequences are, but back then, we didn't want to sell prescription eyewear only due to the HIPAA burden.

xyst 3y ago

Anyone that has worked in a sector where technology is often a second tier citizen or after thought knows these types of breaches are inevitable. Hospitals. Banks. Airline industry. The shit I have seen in just these industries made me think twice about having my private information held here. Of course, the “IT” is often outsourced or “in sourced” (often juniors fresh out of college). Thus simple shit such as network segmenting production and development environments; and limiting access to production databases/assets is nonexistent. I remember working in an airline where the backend systems were still running on outdated mainframe systems. Nobody had a clue how the existing mainframe systems worked. No documentation. Only poorly maintained support docs on how to keep it running. I ended up silent quitting after 3 months because management kept shutting down all of my initiatives to improve ops and quality. This company later had a massive meltdown. I wasn’t surprised and just glad I wasn’t subpoenaed.

cnj 3y ago

> The data exposure was discovered following an internal investigation conducted voluntarily by Kaiser Permanente. The company discovered that online trackers used on its websites and mobile applications were transmitting certain types of personal data when users interacted with its services. I have respect for the individuals that started this investigation, and the ones that made sure this is publicly disclosed. This could have easily been swept under the carpet. Actually, that they uncovered this on their own and publicly disclosed it sounds like they have an above-average privacy culture in place. I know the odds that the person(s) who kicked off this investigation are reading this comment are very low, but if so: Kudos, well done!

shreezus 3y ago

None of this surprises me one bit. I have worked in the health space for several years, and I have personally seen the inner workings of several insurers and the manmade horrors within. It blows my mind that these multibillion dollar institutions are so poorly managed on the technology/IT front. I think most people will have their health data likely leaked at some point.

peteradio 3y ago
> I think most people will have their health data likely leaked at some point. Just don't go to the hospital or in any other way involve your system with the InsuroServo complex. Problem solved!

mleonhard 3y ago

I reported this to Kaiser on 2021-11-22, in support case number 53710772. Below is the content of the ticket I filed. I didn't follow-through on disclosure. Now I wish I had, since they could have fixed this problem faster instead of taking 2.5 years. I am still a satisfied Kaiser customer. ---- Hi KP.org Team, Just now, I logged into KP.org. Something was loading slowly, so I viewed the network requests the website was making. I was surprised to see requests to Google, Adobe, Bing, Qualtrics, BTTag.com, and Unpkg.com. A request to Google includes info intended to de-anonymize my computer: time, IP addr, device type, display size, browser window size, timezone, and others. These requests occur even while reading messages with my doctor! The page loads JavaScript from Adobe, Bing, Google, and Qualtrics. People who control those companies' servers can read my confidential messages. Adobe has a track record of incompetence in IT security. Please review your decision to make KP.org load external code and trackers. If you do not respond by 2022-01-14 (90 days), I will disclose this information to privacy-oriented media organizations and HHS.gov. I saved screenshots for this purpose. Sincerely, Michael

khana 3y ago
[dead]
ewhanley 3y ago
That's pretty gross. Why would a hospital/healthcare system even need all that tracking? They don't make enough from their primary business that they also need to sell patient data for advertising? I would guess some dev just slapped on a bunch of boilerplate that so many other projects use and called it a day.
- mistrial9 3y ago
  someone wanted ad revenue and it leads to this.. source: personal exposure to "ad markets in hospitals" here in the SF Bay Area
adolph 3y ago
Login page still loads up Adobe and Qualtrics. Maybe KP has BAA with those services? URL (gets redirected): https://healthy.kaiserpermanente.org/consumer-sign-on https://healthy.kaiserpermanente.org/consumer-sign-on If one had a list of patient portals[0], what would be the simplest way to check each for 3rd party trackers? Use Selenium? 0. curl -s "https://www.mychart.org/LoginSignup" | grep 'JSON.par' | sed -e 's;^.*JSON.parse('\'';;' -e 's;'\'').*$;;' | jq '.Customers[].LoginUrl' | tr -d '"'

jmholla 3y ago

Is this a HIPPA violation?

nextworddev 3y ago

So much for hipaa

wahoo324 3y ago

I wonder if they had CSP and intentionally bypassed or they didn't have CSP at all.

slater 3y ago

There's something seriously wrong with the KP web department. Their current site is a slow, buggy mess that regularly locks up for no discernible reason on my system (M2 Air, latest Firefox and macOS). Just the other day I had to nuke all the cookies to log in again, because the site got itself in a login loop ("the website isn't redirecting properly").

_akhe 3y ago

Literally 1 month ago: Kaiser lays off IT workers for a second time in 4 months Maybe they kept the wrong ones haha