Hundreds of thousands of children’s records are available to buy online, and this personal information could be used to build false identities.

A researcher from DataBreaches.net discovered that a vendor had been selling pediatric medical records on a Dark Web marketplace. The records, which were being sold for just a few dollars, included identification details and health insurance information.

The leak demonstrated both the risk to patient confidentiality and the significant security challenge in health care. IT decision-makers should work to ensure strong cybersecurity reduces the risk posed by external actors, errant employees and sloppy internal behavior.

Like Stealing Data From a Baby

The marketplace listing was made by an individual known as Skyscraper, who explained to DataBreaches.net in a private chat how the records came from a range of sources. He estimated that he acquired about 500,000 children’s records from pediatricians’ offices and an additional 200,000 from schools.

Those figures, even if overestimated slightly, are greater than the numbers involved in previous breaches. The records were selling for $3 for “fullz” on a child, although more valuable data such as health insurance account information would probably cost more than the basic records.

Skyscraper provided a small sample of records containing key details such as names, dates of birth, Social Security numbers and telephone numbers. The researcher then contacted the families by phone, and parents confirmed the identity details were correct.

Identity Theft Is Child’s Play

Rather than relying on complex techniques, Skyscraper said he was able to find entire databases by simply searching the web for “patients.” He was surprised how many offices run their systems on cracked, downloaded software or outdated applications.

Skyscraper also noted that many pediatricians’ offices retain inactive patient data. Such practices become a cybersecurity risk when these offices, perhaps unintentionally, amass thousands of patients’ records over many years.

Protecting Personal Information

As Robert Lord, CEO of security specialist Protenus, noted in Compliance Today, electronic health records have become a key target for cybercriminals. Pediatric data is at particularly high risk because the medical records of younger individuals provide a blank slate upon which criminals can build a false identity.

Security leaders must do more to protect information. Although cybercriminals pose a significant risk, too many executives fail to place strong boundaries around data access. Almost half (47 percent) of organizations have at least 1,000 sensitive files open to every employee, according to the “2017 Varonis Data Risk Report.”

Health care organizations face a particularly big challenge. According to Protenus, only 28 percent of hospital employees demonstrated the necessary awareness to prevent incidents that could lead to exposure of personal information.

Following security best practices can help protect personal information. A strong security program is a crucial starting point, but executives should look beyond tools and services. IT managers need to reward good behavior, and develop protection and resilience plans that recognize both the value of data and the costs of a personal information leak.