Data Security: The Safeguard of Patient Health Information and Consumer Information

The Target Corporation was exploited in December 2013 and then again in 2015. These breaches included customer’s personal identifying information and retailer’s data. This credit card data breach is a prime example of weak security and infrastructure. This breach happened over the course of one of the United States’ major holiday seasons, Christmas. The security issue involved hackers accessing Target’s customer 's credit and debit cards by the machines that were being used to swipe the cards. These hackers accessed Target’s network with a stolen username and password from a company that was providing refrigeration and HVAC services. This company could access Target’s network `remotely to monitor energy consumption and temperatures. With that, the hackers uploaded malware software on the Target’s credit card machines. The customer data hack happened across the nation, and it was performed in stores and not an online breach of Target customer information.

On Dec 19, 2013 Target Corporation announced to the world that they had suffered a major data security breach. Due to Target Corporations poor stance on network security, hackers were able to steal over 40 million payment card records, encrypted PINs and 70 million customer records during the Black Friday sales week. Initial reports indicated that it was malware placed on their Point of Sales (POS) system, but that was just the tip of the iceberg of the breach. If there had been better security from the start this breach could have been avoided or greatly reduced.

In January 2007, TJX Companies Inc. released a statement to the press that an estimated 40 million of their customer’s credit card accounts had been compromised (although final reports state that over 94 million accounts were affected) (Berg 2008). Through the company’s POS (Point of Sales) system, credit card information was stolen by a ring of hackers and approximately $4.5 billion spent on these cards (Berg 2008). What the hackers did was intercepted the credit card information from customers who swiped their cards at the store and then created their own physical cards using this information. Then they sold the credit cards to people, who turned around and used these cards at retail stores, like Walmart (Agrawal 2011). Three areas of weakness within the company’s IT systems that allowed for an attack of this scale were: inadequate wireless security, improper storage of customer data and failure to encrypt customer account data (Berg 2008).

This case study will examine how Bon Secours Mary Immaculate Hospital identified a security breach in their facility and the course of action taken in an attempt to eradicate the problem. Security breaches are a major subject that must be addressed in the healthcare facility. With healthcare becoming more technology driven it is much easier to access data related to patients, specifically personal health information (PHI). Clearance is also a concern, not everyone in the healthcare facility should have access to a patient’s medical record. In order to protect PHIs, each facility must implement a policy and procedure related to internal, external, and third party security breaches. Security breaches can be detrimental to a healthcare facility and its patients, which is why breaches must be identified quickly for intervention and to minimize harmful outcomes to patients.

(April 2015) today our financial and personal information is everywhere. It is in our phones for mobile payments, in our wallets on our credit cards and in the data centers and clouds of the companies and third parties that complete transactions on our behalf. With so much personal information—quite literally—floating around various access points, it has never been more lucrative or easy for cyber-criminals to access and mine private information to sell on the black market.The Target data breach at the end of 2013, which affected the card payment information of more than 40 million shoppers and the personal data of almost 70 million consumers, kick-started a continuous barrage of point-of-sale (POS) attacks affecting consumers, businesses and banks throughout 2014. Between the breaches at Dairy Queen, Home Depot and Neiman Marcus, it seemed like cyber-criminals were always one step ahead of the game, using malware and card-skimming techniques to gain access to confidential

In the midst of the holiday season, Target shoppers were shocked in December 2013 when the news came out, 40 million Target credit cards had been stolen (Krebs, 2013f) by accessing data on point of sale (POS) systems (Krebs, 2014b). Target later revised that number to include private data for 70 million customers (Target, 2014). The breach transpired between November 27 and December 15th 2014 (Clark, 2014). Over 11 GB of data was stolen (Poulin, 2014). Target missed internal alerts and found out about the breach when they were contacted by the Department of Justice (Riley, Elgin, Lawrence & Matlack, 2014).

In December 2013, Target announced that massive amounts of credit and debit card information they collected over the years might be in the danger of theft. The credit card breach could affect as many as 70 million customers who swept cards in the retail stores or linked their cards with the membership card, the RedCard. Each card information contains a card number, holder’s name, address, phone number and etc. The more information the thieves got, the more conveniently the thieves could use them to get benefits from the card holders. Jia Lynn Yang and Amrita Jayakumar, the authors of “Target says up to 70 million more customers were hit by December data breach”, write about how bad people will use customers’ information to crime. These thieves possibly shop online by inserting the card information. They could also contact with the victims to gather more sensitive information, and even hack into their computers. This event forces us to seriously consider the crisis in how retails protect customers’ data (Yang &

In December 2013, Target was attacked by a cyber-attack due to a data breach. Target is a widely known retailer that has millions of consumers flocking every day to the retailer to partake in the stores wonders. The Target Data Breach is now known as the largest data breach/attack surpassing the TJX data breach in 2007. “The second-biggest attack struck TJX Companies, the parent company of TJMaxx and Marshall’s, which said in 2007 that about 45 million credit cards and debit cards had been compromised.” (Timberg, Yang, & Tsukayama, 2013) The data breach occurred to Target was a strong swift kick to the guts to not only the retailer/corporation, but to employees and consumers. The December 2013 data breach, exposed Target in a way that many

On January 2007 a press release was issued according to CPA journal article “Analyzing the TJ Maxx Data Security Fiasco” that TJX Companies, Inc. the parent company to retail stores like TJ Maxx, Marshalls, HomeGoods, and A.J Wright stores; computer systems had been breached and that customers’ information had been stolen. (Berg, G. 2008, August) This data breach became the largest one of it’s kind because during the investigation there was reported that approximately 94 million Visa and MasterCard accounts had been compromised (Berg, G. 2008, August).

Target, one of the nation’s largest retailers, had a data breach that had up to 40 million consumers have their credit card and debit card data stolen, while up to 70 million had their personal information stolen such as their addresses and phone numbers. Information from the credit and debit cards stolen was the names, the card numbers, expiration date and the CVV (card verification value). The consumer information that was stolen such as names, mailing addresses, phone numbers, and even email addresses. The breach took place during the holiday shopping rush of 2013. This breach damaged Target’s sales during the holiday season, and remains one of the largest data breaches in history.

Health care systems must deal with a recurrent battle to improve regulation in order to safeguard the patient health information. However, data breaches continue in the everyday common industry and it is the duty of the health care advisors to make data security the highest importance. According to the NIST standard, the key purposes of risk assessments are to identify "relevant threats" to the organization, including "vulnerabilities, both internal and external," and the "likelihood that harm will occur, (Kaner, 2015).”

Announced in September 2014, Home Depot had one of the largest data breaches in the United States; Over 53 million credit cards and email addresses were stolen as reported by Bloomberg.com. Even though Home Depot claims the information stolen did not include any password or any highly classified information, the company suffered immensely. Their stocks fell by 2.4% and cost the company $62 million dollars according to USATODAY. In a case study published by Sans.org, author Brett Hawkins reveals that “memory scraping malware has been the key component in stealing payment card information in the large retail data breaches of 2014”. It is believed that similar strategy has been used in previous hacking

In recent years, there have been a number of big name companies that have fallen victim to security breaches. In 2011, Sony’s PlayStation Network suffered a massive breach and as a result some 77 million user’s accounts, containing names, addresses, e-mail addresses, birth dates, usernames, passwords, and possibly credit card numbers, were compromised (Baker & Finkle, 2011). Another, more recent, breach took place earlier this year. JP Morgan Chase had a similar breach this summer in which over 76 million retail clients and over 7 million business clients saw their personal information compromised (Avoyan, 2014). While there was no evidence of account numbers or other financial data being compromised, the mere fact that a bank this size could be

On May 10, 2011, Citigroup, a 200-year-old U.S. financial institution, discovered a breach in their credit card information systems (Lawrence & Weber, 2014). Upon the discovery, Citigroup acted immediately and started an internal investigation 24 hours later. The internal investigation took Citigroup 12 days to complete. On June 3rd, a notification letter was mailed to customers notifying them of the breach, and informing them that they would not be held liable for fraudulent charges. Public notification followed on June 9th, almost a month after the breach took place.

However, in early September, The Home Depot found itself making headlines for a lack of effective control measures when its credit card security was breached. On September 2nd, a reporter from Krebs on Security noticed that a trove of purported stolen data had appeared on black market sites known for selling hacked credit and debit card data. Home Depot quickly responded to the report, saying it was investigating the claims. By September 8th, Home Depot had confirmed the data breach and issued a statement offering credit monitoring to any customer who used a credit or debit card at a Home Depot store from April onward.