State of Utah Exposes 780,000 Records

Sheila Walsh-McDonald, new Health Data Security Ombudsman, will assist victims of the Medicaid data breach, which put 780,000 people at risk.

Hardly a week goes by without a major data breach fiasco that could have been prevented. This week the Governor of Utah announced the resignation of Stephen Fletcher, the executive director of Utah’s Department of Technology Services, for failure of oversight and leadership (See IT World). On March 30, hackers exploited a default password on the user authentication layer of system and managed to bypass multiple security controls. 500,000 records containing names, birth dates and addresses were exposed. On a more serious level, 280,000 social security numbers may have been exposed.

So far an investigation has resulted in the resignation of Fletcher and the firing of a contractor who provided software withut encryption safeguards. At least, two other IT employees are under investigation as well.

In addition to the resignation and firing, the State of Utah is addressing this breach by hiring a new health data security ombudsman (Sheila Walsh-McDonald) and conducting an independent audit through the services of Deloitte & Touche consultants.

Just last week, I mentioned that hackers often infiltrate networks via dynamic multi-staged attacks that include exploiting authentication vulnerabilities (See Preparing for Multi-Staged Attacks and Hackers Exploit Vulnerabilities). Changing default passwords is a simple process but easily and often overlooked.

Even though attacks are becoming more dynamic and breaches are happening regularly, most attacks could be easily avoided with proper (and thorough oversight). Appointing proper security oversight and conducting regular audits are two helpful steps that can expose oversights that could haunt a company (and a CTO) at a later date.