Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Delta Dental says data breach exposed info of 7M people

bleepingcomputer.com

Post reply on HN
Print view View original

21–30 of 152 posts

Re: Delta Dental says data breach exposed info of 7M people

#21

Post by flutas »

bonton89 wrote: post #7
mikece wrote: post #2

At this point I'm willing to bet that every single American -- including the Amish -- have been part of at least one major data breach. And for everyone on HN... probably at least ten.

My understanding is about everyone in America (and bizarrely a lot of people in Europe) got f'ed by the Equifax breech already.

TBH, I know of at least one other breach that everyone got hit by too...afaik it was never made public though.

It's been a while since I was told the story, so bear with me. It was Experian. They shipped tape backups of essentially their entire consumer credit DB, unencrypted, via UPS.

UPS truck got robbed at gunpoint, only one package stolen...

EDIT: Transunion -> Experian

Re: Delta Dental says data breach exposed info of 7M people

#22

Post by sologoub »

It’s pretty sad that after decades of such breaches, these still do damage. We have had tech, such as security keys, for some time. Even basic Authenticator app helps. These should be standard with anything remotely sensitive.

Another sad point is that there is rarely true accountability. Offering 24 months of some service is a pittance and an expense of doing business that could be factored/priced in, continuing the poor security practices.

Re: Delta Dental says data breach exposed info of 7M people

#23

Post by MattGaiser »

tyingq wrote: post #19

When I ask my non-techie friends about stuff like this, they really don't care anymore unless they actually get hacked, scammed, etc. It happens so often that there's now "breach fatigue". Meaning little pressure on companies to do better.

Even as a tech person, I am indifferent. I’ve adapted to a world where cards get stolen, so I never use debit, review my statements, and have spending notifications turned on for my phone. I have the apps so I can instantly lock my card. I have already learned to live in a financial castle.

It is obviously not great, but an additional breach has little marginal impact on my life.

Re: Delta Dental says data breach exposed info of 7M people

#24

Post by paulcole »

coldcode wrote: post #14
hn_throwaway_99 wrote: post #4

> who had their names, financial account numbers, and credit/debit card numbers, including security codes, exposed. Delta Dental should be rightly and truly f'd for that one. Storing security codes at all is totally forbidden by PCI rules. Delta Dental should have their ability to process credit cards completely revoked for this egregious breach.

I assume they kept these in a database, which was sent or exported in some way to use Move-IT to transfer somewhere else. The hack was at Move-IT's servers I think, which allowed people to read the contents. The question I have is was this information encrypted by DD or did they just assume Move-IT was safe? If the latter, it's pretty stupid.

I’ve done a lot of research into HIPAA (I work in a dental-adjacent field) and my guess is that it’s almost certainly the latter – an assumption, maybe based on something they were told. But it’s still on them regardless of whether they were deceived or simply didn’t ask.

There have been very few dental practices who have paid fines for HIPAA violations and one that stands out is one who hired a document shredding firm to destroy old paper patient records. The shredders pick up a bunch of files and just drove around the corner and hucked them into an open dumpster where they were found. The dentist was fined as the result of their assumption that a document shredding firm would, you know, shred documents.

Re: Delta Dental says data breach exposed info of 7M people

#25

Post by sofixa »

highwaylights wrote: post #5

Surely the data breaches we hear about are the tip of the iceberg? Just think of what needs to happen after a hack for you to hear about it: - someone at the company needs to be aware it has happened. - they need to accurately identify what was accessed. - they need to disclose that this has happened. - it needs to be visible enough that it gets picked up and talked about. Each step of that funnel must have some drop…

Well thankfully point #3 is mandatory in places with laws such as the GDPR or California or Brazil's equivalents which mandate disclosure to impacted users and publicly.

Re: Delta Dental says data breach exposed info of 7M people

#27

Post by Dalewyn »

MattGaiser wrote: post #23
tyingq wrote: post #19

When I ask my non-techie friends about stuff like this, they really don't care anymore unless they actually get hacked, scammed, etc. It happens so often that there's now "breach fatigue". Meaning little pressure on companies to do better.

Even as a tech person, I am indifferent. I’ve adapted to a world where cards get stolen, so I never use debit, review my statements, and have spending notifications turned on for my phone. I have the apps so I can instantly lock my card. I have already learned to live in a financial castle. It is obviously not great, but an additional breach has little marginal impact on my life.

>so I never use debit, review my statements,

Even the most Joe of Joe Averages should be doing that, honestly.

The primary reason to use credit cards over debit is for the fraud protection, and reviewing monthly statements is just something everyone should do.

Re: Delta Dental says data breach exposed info of 7M people

#28

Post by gunapologist99 »

gosub100 wrote: post #20
ryandrake wrote: post #18

Earlier quoted context omitted.

> Storing security codes at all is totally forbidden by PCI rules. It's kind of silly though. They are no more "secret" than your credit card number itself or expiration date. Once you give it out once or hand your credit card to literally anyone, it's out. Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers. Our payment system needs something like: struct { string credit_card_number;…

its not silly just because it can't solve all problems. It goes a long way to gas station type skimmers less valuable because you can't print a phony card from them, or the phony card you can print is limited to a subset of possible purchases. perfect-enemy-of-good yadayda.

You're not wrong, but GP is saying that 3 digits is a pretty weak 'security' code and gas station skimmers are on the tail end of the threat model compared to exfil of data at any point in the processing chain.

Re: Delta Dental says data breach exposed info of 7M people

#29

Post by hn_throwaway_99 »

ryandrake wrote: post #18
hn_throwaway_99 wrote: post #4

> who had their names, financial account numbers, and credit/debit card numbers, including security codes, exposed. Delta Dental should be rightly and truly f'd for that one. Storing security codes at all is totally forbidden by PCI rules. Delta Dental should have their ability to process credit cards completely revoked for this egregious breach.

> Storing security codes at all is totally forbidden by PCI rules. It's kind of silly though. They are no more "secret" than your credit card number itself or expiration date. Once you give it out once or hand your credit card to literally anyone, it's out. Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers. Our payment system needs something like: struct { string credit_card_number;…

It's not silly. The point is that security codes are only ever supposed to be sent in transit, and the only place they are ever stored is by the issuing processor.

It's not supposed to solve every potential vulnerability, but there is a whole class of exploits, exactly like the one in the article, that result from stolen storage, that this rule is designed to protect against.

Post reply on HN