Skip to main content
ad info

 
CNN.com technology > computing
    Editions | myCNN | Video | Audio | Headline News Brief | Feedback  

 

  Search
 
 

 
TECHNOLOGY
TOP STORIES

Consumer group: Online privacy protections fall short

Guide to a wired Super Bowl

Debate opens on making e-commerce law consistent

(MORE)

TOP STORIES

More than 11,000 killed in India quake

Mideast negotiators want to continue talks after Israeli elections

(MORE)

MARKETS
4:30pm ET, 4/16
144.70
8257.60
3.71
1394.72
10.90
879.91
 


WORLD

U.S.

POLITICS

LAW

ENTERTAINMENT

HEALTH

TRAVEL

FOOD

ARTS & STYLE



(MORE HEADLINES)
*
 
CNN Websites
Networks image


Hospital confirms copying of patient files by hacker

Computerworld

(IDG) -- A major university hospital in Seattle Thursday confirmed that a hacker penetrated its computer network last summer and made off with files containing information about 5,000 patients.

Officials at the University of Washington Medical Center said the hacker -- who calls himself "Kane" -- stole user passwords and copied thousands of files while he had access to the hospital's systems. The hacker slipped into the network through a server in the hospital's pathology department, said medical center CIO Tom Martin.

The medical center suspected at the time that its network had been infiltrated and took steps to cut off the hacker's access, Martin said. But, he added, the hospital was unaware that the files had been pilfered until Kane provided information about the intrusion to SecurityFocus.com, a San Mateo, Calif.-based Web site that focuses on security issues.

  MESSAGE BOARD
 

Kane, who said he lives in the Netherlands, shared some of the copied files with SecurityFocus.com to verify that he had accessed the sensitive data. SecurityFocus.com staffer Kevin Poulsen said Kane views himself as an ethical hacker and indicated that he simply wanted to expose the vulnerability of the hospital's network. "He portrays himself as more of a whistle-blower than as an outlaw," Poulsen said.

But after being informed of the file copying, officials at the medical center reported the hacking incident to the FBI for investigation, Martin said. The hospital also beefed up its firewalls in an effort to better protect its network, and it began notifying all of the patients whose personal information was in the files copied by Kane.

IDG.net INFOCENTER
IDG.net
Related IDG.net Stories
Features
Visit an IDG site


IDG.net search



In a statement, the hospital said the copied information wasn't directly related to the delivery of care to its patients. Instead, it added, the information was stored in administrative databases and was used for patient tracking and for following up on research studies.

"There is no evidence that anyone has breached our main electronic medical records system," the hospital said. "We assure patients and the public that this system remains fully protected by the highest levels of security possible."

Martin said Kane used sniffer software to steal the electronic identifications of a number of hospital employees from an exposed server and then used those credentials to access thousands of files related to patients in the medical center's cardiology and rehabilitation departments. Martin added that the hospital plans to comply with the Health Insurance Portability and Accountability Act (HIPAA), a set of privacy and security guidelines that the federal government is close to finalizing.

The hacking incident wasn't that unusual and appears to have been relatively minor compared with the amount of damage that a malicious attacker could have inflicted, said Wes Rishel, an analyst at Gartner Group Inc. in Stamford, Conn. Rishel described Kane's intrusion as "a classic penetration of a secondary system" that was running a personal application with collected data, rather than an attack on the hospital's main database server.

"Academic medical centers are prone to this, as part of the spirit of academic freedom that creates pressure for open access," Rishel said. The only major impact from the hacking incident might be to get policymakers in Washington to push through the HIPAA as quickly as possible, he added.




RELATED STORIES:
Hacker steals huge credit card database
December 13, 2000
NASA hacker pleads guilty
December 6, 2000
MS, hacker secretive about meeting
November 22, 2000
Was hack attack Microsoft's own fault?
October 31, 2000
Senate committee approves watered-down anti-hacker bill
October 10, 2000

RELATED IDG.net STORIES:
Cyberattacks against Pentagon on the rise
(Computerworld)
U.S. could face 'Pearl Harbor' in cyberspace
(PCWorld.com)
FTC, FBI sites leave opening for hacker access
(IDG.net)
Feds warn about e-commerce site attacks
(Computerworld)
Virus writers send holiday greetings
(PCWorld.com)
Meet the hackers
(Darwin)
How to prevent one-click hack attacks
(PCWorld.com)
A hacker with a cause
(The Industry Standard)

RELATED SITES:
SecurityFocus.com

Note: Pages will open in a new browser window
External sites are not endorsed by CNN Interactive.

 Search   

Back to the top  © 2001 Cable News Network. All Rights Reserved.
Terms under which this service is provided to you.
Read our privacy guidelines.