US Med Data Held Hostage by Hackers; Ransom: $10M

Over 8 million medical patients' drug prescription records from the Virginia Prescription Monitoring Program (PMP) have been stolen by hackers, who are demanding $10 million to return them.

The PMP medical records being held for ransom include drug prescription information, social security numbers, and driver's license details for over 8 million Virginia patients. (Source: com.au)

Secure Site Replaced with Ransom Demand

On April 30, 2009, the secure site for the Virginia PMP was replaced with this ransom demand:

"I have your s**t! In *my* possession, right now, are 8,257,378 patient records and a total of 35,548,087 prescriptions. Also, I made an encrypted backup and deleted the original. Unfortunately for Virginia, their backups seem to have gone missing, too. Uhoh :(For $10 million, I will gladly send along the password."

At the time of this writing, the Virginia PMP site has been disabled. (Source: wikileaks.org)

Ransom Demanded Payment Within 7 Days

The ransom message from the hackers also stated that if payment was not received within seven days, the information would go to the highest bidder.

PMP representatives are not returning requests for information from the media. The FBI and State police are reportedly investigating. (Source: itnews.com.au)

The complete text of the ransom message (caution: adult language) can be found from Sunshine Press.

Several Protection Layers Failed at the PMP

In a blog post from the SANS Internet Security Center, Bojan Zdrnja, notes that while this hasn't yet been verified, it's reported that several protection layers failed at the PMP.

This isn't the first time medical records have been held for ransom. If it turns out to be true, questions will be raised over businesses holding large amounts of data on customers.

Visit Bill's Links and More for more great tips, just like this one!