Hundreds of thousands of children’s records are available to buy online, and this personal information could be used to build false identities.

A researcher from discovered that a vendor had been selling pediatric medical records on a Dark Web marketplace. The records, which were being sold for just a few dollars, included identification details and health insurance information.

The leak demonstrated both the risk to patient confidentiality and the significant security challenge in health care. IT decision-makers should work to ensure strong cybersecurity reduces the risk posed by external actors, errant employees and sloppy internal behavior.

Like Stealing Data From a Baby

The marketplace listing was made by an individual known as Skyscraper, who explained to in a private chat how the records came from a range of sources. He estimated that he acquired about 500,000 children’s records from pediatricians’ offices and an additional 200,000 from schools.

Those figures, even if overestimated slightly, are greater than the numbers involved in previous breaches. The records were selling for $3 for “fullz” on a child, although more valuable data such as health insurance account information would probably cost more than the basic records.

Skyscraper provided a small sample of records containing key details such as names, dates of birth, Social Security numbers and telephone numbers. The researcher then contacted the families by phone, and parents confirmed the identity details were correct.

Identity Theft Is Child’s Play

Rather than relying on complex techniques, Skyscraper said he was able to find entire databases by simply searching the web for “patients.” He was surprised how many offices run their systems on cracked, downloaded software or outdated applications.

Skyscraper also noted that many pediatricians’ offices retain inactive patient data. Such practices become a cybersecurity risk when these offices, perhaps unintentionally, amass thousands of patients’ records over many years.

Protecting Personal Information

As Robert Lord, CEO of security specialist Protenus, noted in Compliance Today, electronic health records have become a key target for cybercriminals. Pediatric data is at particularly high risk because the medical records of younger individuals provide a blank slate upon which criminals can build a false identity.

Security leaders must do more to protect information. Although cybercriminals pose a significant risk, too many executives fail to place strong boundaries around data access. Almost half (47 percent) of organizations have at least 1,000 sensitive files open to every employee, according to the “2017 Varonis Data Risk Report.”

Health care organizations face a particularly big challenge. According to Protenus, only 28 percent of hospital employees demonstrated the necessary awareness to prevent incidents that could lead to exposure of personal information.

Following security best practices can help protect personal information. A strong security program is a crucial starting point, but executives should look beyond tools and services. IT managers need to reward good behavior, and develop protection and resilience plans that recognize both the value of data and the costs of a personal information leak.

More from

BlackCat (ALPHV) Ransomware Levels Up for Stealth, Speed and Exfiltration

9 min read - This blog was made possible through contributions from Kat Metrick, Kevin Henson, Agnes Ramos-Beauchamp, Thanassis Diogos, Diego Matos Martins and Joseph Spero. BlackCat ransomware, which was among the top ransomware families observed by IBM Security X-Force in 2022, according to the 2023 X-Force Threat Intelligence Index, continues to wreak havoc across organizations globally this year. BlackCat (a.k.a. ALPHV) ransomware affiliates' more recent attacks include targeting organizations in the healthcare, government, education, manufacturing and hospitality sectors. Reportedly, several of these incidents resulted…

9 min read

Now Social Engineering Attackers Have AI. Do You? 

4 min read - Everybody in tech is talking about ChatGPT, the AI-based chatbot from Open AI that writes convincing prose and usable code. The trouble is malicious cyber attackers can use generative AI tools like ChatGPT to craft convincing prose and usable code just like everybody else. How does this powerful new category of tools affect the ability of criminals to launch cyberattacks, including social engineering attacks? When Every Social Engineering Attack Uses Perfect English ChatGPT is a public tool based on a…

4 min read

Despite Tech Layoffs, Cybersecurity Positions are Hiring

4 min read - It’s easy to read today’s headlines and think that now isn’t the best time to look for a job in the tech industry. However, that’s not necessarily true. When you read deeper into the stories and numbers, cybersecurity positions are still very much in demand. Cybersecurity professionals are landing jobs every day, and IT professionals from other roles may be able to transfer their skills into cybersecurity relatively easily. As cybersecurity continues to remain a top business priority, organizations will…

4 min read

How I Got Started: White Hat Hacker

3 min read - White hat hackers serve as a crucial line of cyber defense, working to identify and mitigate potential threats before malicious actors can exploit them. These ethical hackers harness their skills to assess the security of networks and systems, ultimately helping organizations bolster their digital defenses. But what drives someone to pursue a career as a white hat hacker, and how do you get started in leveraging so-called “evil” skills for the greater good?? In this exclusive Q&A, we spoke with…

3 min read