Utah Health Department Breach May Number Up To 750,000 Individuals
April 10, 2012

Utah Health Department Breach May Number Up To 750,000 Individuals

Utah state health officials in Salt Lake City said Friday that hackers who broke into state computers last weekend stole more medical records than originally believed and the data most likely included Social Security numbers of children, reports Josh Loftin for the Associated Press.

Approximately 182,000 beneficiaries of Medicaid and the Children´s Health Insurance Program had their personal information stolen, and about 25,000 Social Security numbers were compromised, Utah Department of Health officials said.

Stephanie Weiss, spokeswoman for the Utah Department of Technology Services originally reported that an estimated 24,000 people had their records stolen after someone attacked a server beginning March 30. The culprit actually downloaded 24,000 files, with each file containing hundreds of records.

The hacking is believed to have occurred when a technician installed a password with a “configuration error occurred at the password authentication level, allowing the hacker to circumvent DTS´s security system.”

Officials first believed that the data theft, which occurred on April 1, involved only 24,000 Medicaid payment claims or eligibility inquiries. That estimate grew to more than 182,000 and included people covered by CHIP, among others.

A hacker traced to Eastern Europe first accessed a weakly protected computer server at the Utah Department of Health on March 30, writes Michael Winter for USA Today. The thief downloaded about 224,000 files, some of which contained hundreds of records, said health department spokesman Tom Huduchko, the Associated Press says.

Huduchko is recommending that every Medicaid client monitor credit reports, bank accounts and other areas the hackers could target with the information.

“Monitoring financial accounts and credit reports is an important first step, but somebody who knows their identity has been stolen should also alert the three credit bureaus about potential fraud,” said Kirk Torgensen, a chief deputy with the Utah attorney general´s office who specializes in identity theft.

Protecting children can be more difficult, since they will normally not have a credit report, credit cards or bank accounts to monitor. To assist parents, the state has partnered with the credit bureau TransUnion to provide a way for a child´s Social Security number to be registered and their credit essentially frozen until they are old enough to need it.

The website also allows victims of fraud to file an affidavit that will reduce the amount of time – sometimes hundreds of hours – that identity theft victims have to spend fixing their credit.