Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LifeLabs pays ransom after data breach affecting up to 15M Canadians

theglobeandmail.com

Post reply on HN
Print view View original

41–50 of 53 posts

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#41

Post by aguyfromnb »

chx wrote: post #32
rayhendricks wrote: post #7

“For customers who are concerned, LifeLabs has offered to cover one year of data protection that includes dark web monitoring as well as identity theft insurance.” That’s it? If I was Canadian I’d want to see execs going to jail and or their contract yanked. If they switched over to using a webapp or chromeos on the desktop things would probably be much more secure. But that’s not going to happen, cuz it’s owned by t…

Canadian here. I asked my federal MP why there are no criminal consequences and my provincial MLA why BC is not terminating their contract.

>why BC is not terminating their contract.

To go where? Socialized healthcare creates monopolies. There are few competitors. You trust your data more to some upstart entity that doesn't yet exist?

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#42

Post by slantyyz »

imposterr wrote: post #19

Reading the official news release [1], the cynic in me thinks the wording of just "password" indicates that these were plain text passwords. From my experience, when the passwords are hashed/salted, the companies make it a point to include that. [1] https://www.lifelabs.com/lifelabs-releases-open-letter-to-cu...

I think the big concern is the presumption of a non-techie that a medical company would take good care of their information, because of regulations, etc.

I would not be surprised if a LOT of Lifelabs customers used the same password on their Lifelabs accounts that they use for their email. FWIW, Lifelabs has two sub-sites that use different credentials - one for test results, and one for booking appointments.

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#43

Post by SketchySeaBeast »

aguyfromnb wrote: post #40
guessmyname wrote: post #4

Just a few months ago I had to take a series of tests with LifeLabs (blood, urine, physical, etc) to update my immigration papers. Did you know you cannot choose where to take these tests? You are more or less forced to use LifeLabs because the doctors designated by the IRCC (Immigration, Refugees and Citizenship Canada) only partner with LifeLabs to do these tests, it’s an ugly monopoly that is impossible to fight a…

> Did you know you cannot choose where to take these tests? Welcome to the Canadian Healthcare system. It's free, but not without issue, even ignoring the long wait times and inability to get a doctor in most places in the country. Did you know I'm not allowed to go get my blood tested privately, even if I pay for it? That I require a requisition from a doctor (which I don't have, so I have to go to a walk-in clinic…

What use case is there for getting your blood tested without getting a doctor involved?

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#44

Post by stanski »

aguyfromnb wrote: post #40
guessmyname wrote: post #4

Just a few months ago I had to take a series of tests with LifeLabs (blood, urine, physical, etc) to update my immigration papers. Did you know you cannot choose where to take these tests? You are more or less forced to use LifeLabs because the doctors designated by the IRCC (Immigration, Refugees and Citizenship Canada) only partner with LifeLabs to do these tests, it’s an ugly monopoly that is impossible to fight a…

> Did you know you cannot choose where to take these tests? Welcome to the Canadian Healthcare system. It's free, but not without issue, even ignoring the long wait times and inability to get a doctor in most places in the country. Did you know I'm not allowed to go get my blood tested privately, even if I pay for it? That I require a requisition from a doctor (which I don't have, so I have to go to a walk-in clinic…

Allowing private access to healthcare is a slippery slope. Anyone paying for a service is someone who is also taking the place of someone using that service as a basic right.

I'm not saying it shouldn't be an option for blood tests in particular (as is your example) but there are multiple things to consider when you start opening those up to anyone willing/able to pay.

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#45

Post by endorphone »

aguyfromnb wrote: post #40
guessmyname wrote: post #4

Just a few months ago I had to take a series of tests with LifeLabs (blood, urine, physical, etc) to update my immigration papers. Did you know you cannot choose where to take these tests? You are more or less forced to use LifeLabs because the doctors designated by the IRCC (Immigration, Refugees and Citizenship Canada) only partner with LifeLabs to do these tests, it’s an ugly monopoly that is impossible to fight a…

> Did you know you cannot choose where to take these tests? Welcome to the Canadian Healthcare system. It's free, but not without issue, even ignoring the long wait times and inability to get a doctor in most places in the country. Did you know I'm not allowed to go get my blood tested privately, even if I pay for it? That I require a requisition from a doctor (which I don't have, so I have to go to a walk-in clinic…

No normal user of the system is mandated to use any particular lab provider -- a doctor gives you a requisition form and you bring it wherever you want. There aren't that many options, generally, but there are as many as the market will bear (and as new upstarts grow they get swallowed up by the incumbents). This particular person's issue has to do with immigration.

Do you really think a walk-in doctor "could care less"? What a ridiculous statement. They're just as professionally governed and concerned as any doctor.

"Did you know I'm not allowed to go get my blood tested privately"

There are private blood testing services in Canada, though it's a small market given that the workflow of labs is overwhelmingly geared towards the public market. Most labs will happily provide you your own blood test results (a cursory search of both LifeLabs and Dynacare, two of the most common, show their patient portals).

"I often see Americans pointing to Canada's system as a shining example"

Canada is almost always the punching bag for the US -- usually based upon lies or the singular complainer, for instance I and my family have had a family doctor everywhere we've lived, have always had a great experience, etc -- and of course -- like every complex system in the world -- it has flaws. But it isn't as good as France's system, or a couple of others.

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#46

Post by endorphone »

SketchySeaBeast wrote: post #43
aguyfromnb wrote: post #40

Earlier quoted context omitted.

> Did you know you cannot choose where to take these tests? Welcome to the Canadian Healthcare system. It's free, but not without issue, even ignoring the long wait times and inability to get a doctor in most places in the country. Did you know I'm not allowed to go get my blood tested privately, even if I pay for it? That I require a requisition from a doctor (which I don't have, so I have to go to a walk-in clinic…

What use case is there for getting your blood tested without getting a doctor involved?

If you're bio-hacking, taking steroids for `recreation' and monitoring testosterone, just curious, etc, it does seem reasonable that you should be able to pay for and get your own tests. There are options that facilitate that, though it's a burgeoning market given that the overwhelming majority are ordered, and paid for, through the public system.

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#47

Post by motohagiography »

This breach seems to be downplayed because it affects the integrity of the entire health system. If medical blood test result data ends up on the dark web, people may likely be able to look up the following about us:

- if you have a condition that puts you at higher risk for receiving disability or workers compensation.

- if you have been pregnant and when.

- if you got tested for an STD because you thought you needed to, and the frequency of your testing.

- if you have an STD and around when you contracted it.

That's without getting into specifics around medications, and the greater harm of people not getting tests done because they do not trust the privacy and security of the health system. These are typical threat model use cases in health information privacy assessment and systems design.

In terms of consequences, the disclosure risk of this information can break up families and households, and silently disqualify people from jobs, both of which put their kids at a long term disadvantage, destroys familial wealth and assets, and in effect impoverishes everyone involved.

Once the gravity of this sinks in, I'd be concerned for the mental health of the CEO.

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#48

Post by coralreef »

SketchySeaBeast wrote: post #43
aguyfromnb wrote: post #40

Earlier quoted context omitted.

> Did you know you cannot choose where to take these tests? Welcome to the Canadian Healthcare system. It's free, but not without issue, even ignoring the long wait times and inability to get a doctor in most places in the country. Did you know I'm not allowed to go get my blood tested privately, even if I pay for it? That I require a requisition from a doctor (which I don't have, so I have to go to a walk-in clinic…

What use case is there for getting your blood tested without getting a doctor involved?

Tracking your own health metrics when your curious to see how your diet, excercises, etc change

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#49

Post by ChrisArchitect »

interested in more info about them actually paying the ransom. Not that common a reaction in these corporate/public sector breaches I don't think. How much did they pay? Was it brokered or direct?

Is anyone surprised they actually got the data back? Why are they convinced the 'hackers' won't still do anything with it.

Reporting is weak on this as it doesn't say straight out ransomware that encrypted machine with data. That it likely came from any random email that someone opened. Not that there's some evil hacker person on the other end targetting LifeLabs and it could and does happen to anyone.

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#50

Post by jiveturkey »

ajlburke wrote: post #39
afthonos wrote: post #15

Earlier quoted context omitted.

“One must imagine Sisyphus happy.” —Albert Camus, The Myth of Sisyphus

I like to think of Sisyphus a bit like someone waiting in line for a rollercoaster or a ski lift. The pushing is a slog, but then you reach the top and WOW BOOOM the rock cascades down the hill and it's AWESOME! Time to start pushing it back up again. Yes yes I know Sisyphus is a metaphor for the pointlessness of life - but that doesn't mean you have to take it at face value.

> pointlessness

or perhaps that the work itself is the reward

Post reply on HN