An increasingly common and relatively easy way for hackers to access sensitive data is through “phishing,” where unwitting recipients of email or texts (SMS phishing or “smishing”) trust the sender with the sought after information. According to Verizon’s new 2016 Data Breach Investigations Report, about 90% of security incidents stem from some form of phishing. Verizon reports that phishing continues to trend upward and is found in the most opportunistic attacks as well as “sophisticated nation-state tomfoolery.” But president of the Olympia School District chuckles (yes, that’s right, chuckles) at its recent breach resulting from phishing because, according to what he told MyNorthwest reporter, Sara Lerner:
“It happens…it’s an opportunity to have that conversation and move forward with it. You could call it a teachable moment if you want to,” he said, with a chuckle.
That kind of cavalier attitude is exactly the problem that we have with so many school districts and government agencies. One cannot be careless, when it comes to sensitive data, whether it is at a school district or at the Health Care Authority/Apple Health Data Breach, where an employee’s mishandling and HCA’s insufficient privacy protocols allowed the medical records of 91,000 individuals to get sent to an unauthorized recipient
As we continue our class action litigation regarding the Anthem data breach as well as the Amerigroup Washington data breach, I learn more about how stolen protected health information (PHI) is marketed on the dark net. To those who want to toss caution to the wind, feel free to do so with your own data. Just not everyone else’s.
BTW: If you were one of those who received a data breach notification from HCA or the Olympia School District, please contact me at Catherine@Stritmatter.com or 206.448.1777. I would like to learn your perspective and story, as well as share the details of how we’re trying to hold these organizations accountable to prevent future data breaches.