Hackers Access Government Health Servers

On Friday, April 28, the Defense Department announced that hackers gained access to TRICARE, the Pentagon’s health insurance information system, and compromised the personal information of more than 14,000 people.

An article on GovExec.com reports that the hacked information included names, Social Security numbers, the last four digits of credit cards, personal phone numbers, work and personal e-mail addresses, and home addresses.

It is not known when the intrusion, detected on April 5, originally occurred. Additionally, a department official said the delay in reporting the breach took more than four weeks because time was needed to determine the extent of the hack.

Assistant Defense Secretary for Health Affairs William Winkenwerder said the department responded quickly to the intrusion using enhanced security controls and installing additional monitoring tools. The story also reports that the Defense Criminal Investigative Service is participating in an investigation.

Information on what the Defense Department is doing to prevent another hacking incident is confidential, Winkenwerder told GovExec.com. It does not want to alert criminals on countermeasures. He also said that official medical records were not touched.

Bruce Brody, former Energy Department chief information security officer and now vice president for information security at the government market analysis firm INPUT, also credited the Defense Department for the quick fix and for going public.

Lynn McNulty, the government affairs director and member of the Information Security and Privacy Advisory Board, said it will be interesting to see further details.

“A security problem of this magnitude on this level underscores the need to address security as a fundamental issue on the development and implementation of any national electronic health care record initiative,” McNulty told GovExec.com.

Keep checking in at our Security Feed page, or subscribe via RSS, for updated news coverage.

By Paul Kerstein