Australia admits cyber defences 'inadequate' as medical hack hits millions

France24 – AFP, 26 October 2022 

Hackers have accessed millions of medical records at Medibank, one of Australia's
largest private insurers SAEED KHAN AFP/File

Sydney (AFP) – Hackers accessed millions of medical records at one of Australia's largest private health insurers, the company said Wednesday, prompting the government to admit the nation's cyber safeguards were "inadequate". 

This was the latest in a series of hacks targeting millions of people that have brought Australian companies' lax approach to cyber security into sharp relief. 

Medibank chief executive David Koczkar said information about each of the company's 3.9 million policy holders -- some 15 percent of Australia's population -- had been compromised. 

"Our investigation has now established that this criminal has accessed all our private health insurance customers' personal data and significant amounts of their health claims data," he said in a statement to the Australian stock exchange. 

"This is a terrible crime. This is a crime designed to cause maximum harm to the most vulnerable members of our community." 

The cyber attack was revealed last week, but it was not known until now how many people were impacted. 

The hackers have previously threatened to leak the data, starting with 1,000 famous Australians, unless Medibank pays a ransom. 

Medibank on Wednesday also confirmed it was not insured against cyber attacks, estimating the hack could cost the company as much as Au$35 million (US$22 million). 

The Medibank hack followed an attack on telecom company Optus last month that exposed the personal information of some nine million Australians -- almost a third of the population. 

The Optus attack was one of the largest data breaches in Australian history. 

'Inadequate'

Australia's Attorney-General Mark Dreyfus has previously accused companies of stockpiling sensitive customer data they did not need. 

Firms currently face paltry fines -- Au$2.2 million -- for failing to protect customer data. 

Dreyfus last week said these fines would be ratcheted up to Au$50 million. 

"Unfortunately, significant privacy breaches in recent weeks have shown existing safeguards are inadequate," he said. 

"It's not enough for a penalty for a major data breach to be seen as the cost of doing business." 

Home Affairs Minister Clare O'Neil on Tuesday said the fallout from the Medibank hack was "potentially irreparable". 

"One of the reasons why the government is so worried about this is because of the nature of the data," she told Australia's parliament. 

"When it comes to the personal health information of Australians, the damage here is potentially irreparable." 

O'Neil has previously described hacking as a "dog act" -- an Australian phrase reserved for something especially shameful or despicable.

Private psychotherapy notes leaked in major Finnish hack

Yahoo – AFP, 26 October 2020

The confidential treatment records of tens of thousands of psychotherapy patients in Finland have been hacked and some leaked online, in what the interior minister said Monday was "a shocking act." 

Many victims of the hack reported receiving emails with a demand for 200 euros
($236) in bitcoin to prevent the contents of their discussions with therapists
being made public. (Nicolas Asfouri)

Distressed patients flooded victim support services over the weekend as Finnish police revealed hackers accessed records belonging to private company Vastaamo, which runs 25 therapy centres across Finland. 

Thousands have filed police complaints over the breach, they added. 

Many patients reported receiving emails with a demand for 200 euros ($236) in bitcoin to prevent the contents of their discussions with therapists being made public. 

"The Vastaamo data breach is a shocking act which hits all of us deep down," Interior Minister Maria Ohisalo wrote on her website on Monday. 

Finland must be a country where "help for mental health issues is available and it can be accessed without fear." 

Ministers met for crisis talks this weekend, with further emergency discussions tabled for the coming week over the unprecedented data breach. 

"We are investigating an aggravated security breach and aggravated extortion, among other charges," Robin Lardot, the director of Finland's National Bureau of Investigation, told a news conference at the weekend. 

Lardot added that they believed the number of patients whose records had been compromised numbered in the tens of thousands. 

On Monday evening, Vastaamo said it had fired its CEO, Ville Tapio, after an internal enquiry discovered that he had concealed a March 2019 data breach from the board and the firm's parent company. 

The firm admitted flaws in the security of its customer data, "which allowed criminals to break into the database up until March 2019," Vastaamo said in a statement. 

The company's owner, PTK Midco Oy, on Monday launched court proceedings "in relation to its May 2019 purchase of Vastaamo," the statement added. 

'Justifiably worried' 

Security experts reported that a 10-gigabyte data file containing private notes between at least 2,000 patients and their therapists had appeared on websites on the so-called dark web. 

The hack, which targeted some of society's most vulnerable including children, has caused widespread shock in the Nordic country of 5.5 million, with ministers gathering on Sunday to discuss how to support the patients whose sensitive data had been leaked. 

"It is absolutely clear that people are justifiably worried not only about their own security and health but that of their close ones, too," Ohisalo told reporters late on Sunday. 

On Monday, authorities launched a website for victims of the cyberattack, offering advice and telling them not to pay the ransom demand. 

"Do not communicate with the extortionist, the data have most likely already been leaked elsewhere," the "Data Leak Help" site said. 

Mental health and victim support charities reported being overwhelmed with calls from distressed people fearing that their intimate conversations with their therapists would be publicly released. 

Nothing 'to be ashamed of' 

One of the recipients of a blackmail threat, the former MP Kirsi Piha, tweeted a screenshot of the ransom message along with a defiant reply to the hackers. 

"Up yours! Seeking help is never something to be ashamed of," Piha wrote. 

"I've seen a lot, but I haven't seen this," Mikko Hypponen, chief research officer at data security firm F-Secure said in a statement. 

"I don't think there's a crime in our criminal history which would have more victims than this one." 

Hypponen, an internationally renowned cybersecurity specialist, said the perpetrator used the alias "ransom_man", and said he was only aware of one other patient blackmail case, where a cosmetic surgery clinic in Florida had a smaller amount of data stolen in 2019. 

On Monday, Finland's social care regulator said in a statement it was investigating Vastaamo's practices, including how well patients were kept informed of the breach. 

Meanwhile, the head of the state digital services agency DVV, Kimmo Rousku, said that the cyberattack could have been avoided if Vastaamo had used better encryption. 

DVV published a checklist on Monday for firms to make sure their digital security is in order. 

"Management needs to wake up," Rousku told public broadcaster Yle. 

A phone line offering legal advice had also been set up, the country's consumer authority announced.

Dutch privacy watchdog fines Uber for keeping quiet about hack

DutchNews, November 27, 2018

Photo: DutchNews.nl

The Dutch data protection agency (DPA) has fined taxi company Uber €600,000 for failing to report a data leak which took place in 2016. 

Uber was hacked in 2016 and the email addresses, names and phone numbers of 57 million users came into the hands of hackers. In the Netherlands, 174,000 clients and drivers were affected. 

Uber paid the hackers €100,000 to keep quiet about the hack and did not go public with the news, which only emerged a year later. By law the company should have informed the DPA within 72 hours. 

The taxi company reached an out of court settlement in the US equivalent to some €130m and was also fined €434,000 in Britain.

'Hacky hack hack': Australia teen breaches Apple's secure network

Yahoo - AFP, August 17, 2018

Police reportedly raided the boy's home last year and found hacking files and
 instructions saved in a folder called 'hacky hack hack' (AFP Photo/Josh Edelson)

Sydney (AFP) - A schoolboy who "dreamed" of working for Apple hacked the firm's computer systems, Australian media has reported, although the tech giant said Friday no customer data was compromised.

The Children's Court of Victoria was told the teenager broke into Apple's mainframe -- a large, powerful data processing system -- from his home in the suburbs of Melbourne and downloaded 90GB of secure files, The Age reported late Thursday.

The boy, then aged 16, accessed the system multiple times over a year as he was a fan of Apple and had "dreamed of" working for the US firm, the newspaper said, citing his lawyer.

Apple said in a statement Friday that its teams "discovered the unauthorised access, contained it, and reported the incident to law enforcement".

The firm, which earlier this month became the first private-sector company to surpass US$1 trillion in market value, said it wanted "to assure our customers that at no point during this incident was their personal data compromised".

An international investigation was launched after the discovery involving the FBI and the Australian Federal Police, The Age reported.

The federal police said it could not comment on the case as it is still before the court.

The Age said police raided the boy's home last year and found hacking files and instructions saved in a folder called "hacky hack hack".

"Two Apple laptops were seized and the serial numbers matched the serial numbers of the devices which accessed the internal systems," a prosecutor was reported as saying.

A mobile phone and hard drive were also seized whose IP address matched those detected in the breaches, he added.

The teen has pleaded guilty and the case is due to return to court for his sentencing next month.

New security flaw detected in Intel hardware

Finnish cybersecurity specialist F-Secure has reported another serious flaw in Intel hardware. It has nothing to do with the Spectre and Meltdown vulnerabilities, but has a huge "destructive potential" too.

Deutsche Welle, 12 January 2018

F-Secure said Friday it had found a serious flaw in Intel hardware which could enable hackers to access corporate laptops remotely.

It said it detected an issue within Intel's Active Management Technology (AMT) "which is commonly found in most corporate laptops and allows attackers to take complete control over a user's device in a matter of seconds."

"The issue potentially affects millions of laptops globally," said F-Secure consultant Harry Sintonen, who discovered the flaw. "It's of an almost shocking simplicity, but its destructive potential is unbelievable."

Loss of confidentiality

F-Secure said once an attacker had the chance to reconfigure AMT (for which he would initially need physical access to the device in question), the device could be fully controlled remotely by connecting to the same wireless or wired network as the user.

"No other security measures like full-disk encryption, local firewall, anti-malware software or VPN technology are able to prevent exploitation of this issue," Sintonen warned.

A successful attack would lead to complete loss of confidentiality, integrity and availability, with the attacker able to read and modify all of the data and applications users have access to on their computers, even at the firmware level.

Related Article:

Flawed computer chips and how to fix them

Teenagers Hack Into Tiket.com, Steal Over $300,000 Worth of Airline Tickets

Jakarta Globe, Iman Rahman Cahyadi and Farouk Arnaz, April 05, 2017

A group of teenagers and one 27-year-old hacked into Tiket.com — one of the
 largest online travel agents in Indonesia — and siphoned Rp 4.1 billion ($308,000)
 worth of airline tickets from the website, the National Police said in Jakarta on
Tuesday (04/04). (BeritaSatu Photo).

Jakarta. A group of teenagers and one 27-year-old hacked into Tiket.com — one of the largest online travel agents in Indonesia — and siphoned Rp 4.1 billion ($308,000) worth of airline tickets from the website, the National Police said in Jakarta on Tuesday (04/04).

The alleged perpetrators were identified only by their initials. SH, who is 19-years-old and identified by the police as the mastermind of the crime, admitted that he made around Rp 600 million in proceeds from the act.

His partner, MKU, also 19-years-old, admitted to making Rp 600 million. Two other alleged perpetrators have also been identified: AI, 19 and NTM, 27.

SH admitted to using the loot to buy expensive motorcycles.

"I bought a Ducati motorcycle [...]. None of the money was used for investment [purposes]," SH said at the National Police headquarters on Tuesday.

The police said they may face up to 12 years in prison under Indonesia's Law on Electronic Information and Transactions (ITE) revised in 2013.

Global Network, the company behind Tiket.com, reported the case to the police in November when it suspected someone hacked into Tiket.com and stole tickets allotted for the budget airline Citilink Indonesia.

Airlines usually set aside a ticket quota for each travel agent, and are usually paid for the tickets in advance. In this case, the teenagers hacked into the website and accessed Citilink's ticket pool.

"The perpetrators had illegal access to Citilink Indonesia's server, using an account owned by Global Network from Oct. 11 to 27, 2016," Brig. Gen. Fadil Imran, the director of cyber crime at National Police's Criminal Investigation Unit (Bareskrim) said on Tuesday.

The perpetrators then sold the stolen tickets on Facebook, Fadil added.

MKU, AI and NTM were arrested on March, 28 in Balikpapan, East Kalimantan. The police nabbed SH in Ciputat, Banten two days later.

The case shed light on security issues on Indonesia's booming online services industry.

"He [SH] is quite sophisticated and the website was also not that hard to hack," Adj. Comr. Idam Wasiadi of the cyber crime unit at Bareskrim said last week.

Idam said SH, who only finished middle school, taught himself using materials available online to hack into various websites.

He honed his skill by hacking into 4,237 foreign and local websites and defacing their homepage. Among his victims are the National Police's website and app-based ride-hailing service Go-Jek, Idam added.

Citilink Indonesia, a low-cost subsidiary of Garuda Indonesia, said that the integrity of its ticket security and customer's information was not compromised by the hackers and the breach was only limited to the online agent, Tiket.com, Ageng W. Leksono, corporate communication manager of Citilink told news outlet detik.com.

Tawdry tale of wine, fraud and spying grips Switzerland

Yahoo – AFP, Nina Larson, 15 June 2014

A bizarre scandal is swirling around one of Switzerland's leading wine producers

 after he was arrested last week along with a computer hacker, a detective and

a spy (AFP Photo/Jeff Pachoud)

Geneva (AFP) - A bizarre scandal is swirling around one of Switzerland's leading wine producers after he was arrested last week along with a computer hacker, a detective and a spy.

Dominique Giroud, 43, was taken into custody on Wednesday on suspicion of ordering the hacking of computers belonging to journalists who were investigating him over allegations of fraud.

He has been remanded in custody until July 14. If found guilty, he could be sentenced to up to five years behind bars.

A professional hacker, private detective and Swiss intelligence agent have also been arrested in connection with the case, the Geneva prosecutor's office said Friday.

Giroud, whose company Giroud Vins is based in the southwestern canton of Valais -- Switzerland's largest wine-growing region -- has been dogged by scandals for years.

His reputation has been so tarnished that he has even tried to change the business's name to Chateau Constellation, although it was rejected by regional authorities.

Giroud opened a small-scale business in 1995 with reportedly just 1.5 hectares of vineyards to his name and saw that swell to an estate of around 50 hectares over the next 20 years.

His castle-like winery on the outskirts of Sion, Valais' largest town, opened its doors in 2008 and is reportedly valued at around 15 million Swiss francs ($17 million, 12 million euros).

Giroud claims to sell up to nine million litres of wine each year, and is estimated to rake in around 50 million francs in sales, according to Swiss weekly Le Matin Dimanche.

With his ballooning fortune he sponsored numerous sports clubs across Switzerland, open a restaurant in Singapore and start a chain of Wine Universe stores, the paper reported on Sunday.

'Giroud is Scarface'

The wine producer is also said to be renowned for his ruthless tactics.

"Giroud is Scarface," one unnamed Valais wine industry source told the paper, referring to Al Pacino's hubristic mob boss character in the 1983 movie.

"He thought he was God. He thought he was above everyone," another said, while a third recalled how Giroud liked to brag that he alone could bring down both Switzerland's banking and wine industries if he wanted to.

Swiss authorities opened a tax fraud probe against him in 2011, and two years later demanded he pay 9.54 million Swiss francs in back taxes.

In February this year, national broadcaster RTS reported that he had illegally blended some 350,000 litres of wine between 2006 and 2009, passing it off as pure.

He also tried -- and failed -- to stop two RTS documentaries about his business from being aired last month.

The arrests last week centre on alleged attempts to hack the accounts of journalists at RTS and the Le Temps daily in an apparent bid to find the sources for their reporting on Giroud.

The private detective and the hacker say they carried out the spying on orders from their long-time business associate, the intelligence agent -- also a childhood friend of Giroud -- Le Matin Dimanche reported.

Both the private detective and the hacker reportedly attempted the operation thinking they were acting for the government.

The wine producer's lawyers insist he never gave his blessing to the hacking, while the agent has claimed through his lawyer that he had warned the group it was illegal.