May 23, 2017 By Mark Samuels 2 min read

Hundreds of thousands of children’s records are available to buy online, and this personal information could be used to build false identities.

A researcher from discovered that a vendor had been selling pediatric medical records on a Dark Web marketplace. The records, which were being sold for just a few dollars, included identification details and health insurance information.

The leak demonstrated both the risk to patient confidentiality and the significant security challenge in health care. IT decision-makers should work to ensure strong cybersecurity reduces the risk posed by external actors, errant employees and sloppy internal behavior.

Like Stealing Data From a Baby

The marketplace listing was made by an individual known as Skyscraper, who explained to in a private chat how the records came from a range of sources. He estimated that he acquired about 500,000 children’s records from pediatricians’ offices and an additional 200,000 from schools.

Those figures, even if overestimated slightly, are greater than the numbers involved in previous breaches. The records were selling for $3 for “fullz” on a child, although more valuable data such as health insurance account information would probably cost more than the basic records.

Skyscraper provided a small sample of records containing key details such as names, dates of birth, Social Security numbers and telephone numbers. The researcher then contacted the families by phone, and parents confirmed the identity details were correct.

Identity Theft Is Child’s Play

Rather than relying on complex techniques, Skyscraper said he was able to find entire databases by simply searching the web for “patients.” He was surprised how many offices run their systems on cracked, downloaded software or outdated applications.

Skyscraper also noted that many pediatricians’ offices retain inactive patient data. Such practices become a cybersecurity risk when these offices, perhaps unintentionally, amass thousands of patients’ records over many years.

Protecting Personal Information

As Robert Lord, CEO of security specialist Protenus, noted in Compliance Today, electronic health records have become a key target for cybercriminals. Pediatric data is at particularly high risk because the medical records of younger individuals provide a blank slate upon which criminals can build a false identity.

Security leaders must do more to protect information. Although cybercriminals pose a significant risk, too many executives fail to place strong boundaries around data access. Almost half (47 percent) of organizations have at least 1,000 sensitive files open to every employee, according to the “2017 Varonis Data Risk Report.”

Health care organizations face a particularly big challenge. According to Protenus, only 28 percent of hospital employees demonstrated the necessary awareness to prevent incidents that could lead to exposure of personal information.

Following security best practices can help protect personal information. A strong security program is a crucial starting point, but executives should look beyond tools and services. IT managers need to reward good behavior, and develop protection and resilience plans that recognize both the value of data and the costs of a personal information leak.

More from

DHS establishes Artificial Intelligence Safety and Security Board

3 min read - As part of its commitment to addressing the rapid growth and adoption of AI technology across all industries and sectors, the Department of Homeland Security (DHS) announced the establishment of the Artificial Intelligence Safety and Security Board in late April. The Board’s first meeting is planned for early May when they will begin the task of focusing on how to develop and deploy AI technology within the United States’ critical infrastructure safely and securely. Based on the DHS Homeland Threat…

Working in the security clearance world: How security clearances impact jobs

2 min read - We recently published an article about the importance of security clearances for roles across various sectors, particularly those associated with national security and defense.But obtaining a clearance is only part of the journey. Maintaining and potentially expanding your clearance over time requires continued diligence and adherence to stringent guidelines.This brief explainer discusses the duration of security clearances, the recurring processes involved in maintaining them and possibilities for expansion, as well as the economic benefits of these credentialed positions.Duration of security…

White House cements CISA’s role as national coordinator for cybersecurity

2 min read - In 2013, the Obama Administration rolled out "The Presidential Policy Directive (PPD) on Critical Infrastructure Security and Resilience", a forerunner to the Cybersecurity and Infrastructure Security Agency (CISA), created "to strengthen and maintain secure, functioning and resilient critical infrastructure." The directive was groundbreaking in 2013, noting the importance of the rising risk of cyberattacks against critical infrastructure. But as cyber risks are constantly shifting, every cybersecurity program needs to be re-evaluated, and CISA is no exception. That’s why, in April 2024,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today