May 23, 2017 By Mark Samuels 2 min read

Hundreds of thousands of children’s records are available to buy online, and this personal information could be used to build false identities.

A researcher from DataBreaches.net discovered that a vendor had been selling pediatric medical records on a Dark Web marketplace. The records, which were being sold for just a few dollars, included identification details and health insurance information.

The leak demonstrated both the risk to patient confidentiality and the significant security challenge in health care. IT decision-makers should work to ensure strong cybersecurity reduces the risk posed by external actors, errant employees and sloppy internal behavior.

Like Stealing Data From a Baby

The marketplace listing was made by an individual known as Skyscraper, who explained to DataBreaches.net in a private chat how the records came from a range of sources. He estimated that he acquired about 500,000 children’s records from pediatricians’ offices and an additional 200,000 from schools.

Those figures, even if overestimated slightly, are greater than the numbers involved in previous breaches. The records were selling for $3 for “fullz” on a child, although more valuable data such as health insurance account information would probably cost more than the basic records.

Skyscraper provided a small sample of records containing key details such as names, dates of birth, Social Security numbers and telephone numbers. The researcher then contacted the families by phone, and parents confirmed the identity details were correct.

Identity Theft Is Child’s Play

Rather than relying on complex techniques, Skyscraper said he was able to find entire databases by simply searching the web for “patients.” He was surprised how many offices run their systems on cracked, downloaded software or outdated applications.

Skyscraper also noted that many pediatricians’ offices retain inactive patient data. Such practices become a cybersecurity risk when these offices, perhaps unintentionally, amass thousands of patients’ records over many years.

Protecting Personal Information

As Robert Lord, CEO of security specialist Protenus, noted in Compliance Today, electronic health records have become a key target for cybercriminals. Pediatric data is at particularly high risk because the medical records of younger individuals provide a blank slate upon which criminals can build a false identity.

Security leaders must do more to protect information. Although cybercriminals pose a significant risk, too many executives fail to place strong boundaries around data access. Almost half (47 percent) of organizations have at least 1,000 sensitive files open to every employee, according to the “2017 Varonis Data Risk Report.”

Health care organizations face a particularly big challenge. According to Protenus, only 28 percent of hospital employees demonstrated the necessary awareness to prevent incidents that could lead to exposure of personal information.

Following security best practices can help protect personal information. A strong security program is a crucial starting point, but executives should look beyond tools and services. IT managers need to reward good behavior, and develop protection and resilience plans that recognize both the value of data and the costs of a personal information leak.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today