An insider sifts through 108,000 client files. What can go wrong?

In a succinct statement, the managing director of Bupa Global, Sheldon Kenton, explains how Bupa Global recently discovered an employee had “inappropriately copied and removed some customer information from the company. Around 108,000 international health insurance policies are affected.”

Bupa has approximately 1.4 million international health insurance policies (16.5 million total policies), so the employee only managed to visit the policiess of approximately 8 percent of Bupa’s international health insurance policy holders. The 108,000 policies affected 547,000 individuals. The client data compromised included:

• Names
• Date of birth
• Nationalities
• Contact information
• “Administrative materials”
• Bupa customer numbers

Kenton continues that while the information was accessed and copied, none of the information was deleted from the system. Furthermore, Bupa believes the compromised information did not include client financial or medical data. 

No accident: Trusted insider acted deliberately

To their credit, Bupa calls it like it is in their statement: This was a trusted insider who broke trust and acted in a deliberate manner:

This was not a cyber attack or external data breach, but a deliberate act by an employee. We have introduced additional security measures and increased our customer identity checks. A thorough investigation is underway and we have informed the FCA and Bupa’s other UK regulators. The employee responsible has been dismissed and we are taking appropriate legal action.

Backups are important

A salient point to Bupa’s statement is the employee’s attempt to remove the data from Bupa. While the employee may have been successful, Bupa is unequiviocal that no client data was deleted. Therefore, we may presume the existence of multiple iterations of backup copies to the data base being harvested.

Trust but verify

An additional indicator that Bupa understands the magnitude of what transpired, as they evolve their internal policies, is this statement, “We have introduced additional security measures and increased our customer identity checks.”

As every CISO knows, trust those who have access to the data, but verify they access only that data to which they have a need.

Least privileged access

The doctrine of need to know or least privileged access serves to reduce the risk that data is being accessed as part of a farming exercise by a curious or malevolent employee. By assuring your employee has access to the information they need to do their job and the ability to audit it is being accessed for bona fide purposes, you project a secure environment. 

Bupa customers should be hyper-alert

The 549,000 individuals whose information was compromised need to remain hyper-alert to criminals attempting to capitalize on the client information. The information can be used to create phishing emails to spoof not only Bupa, but any number of entities, which by including the identifying information taken from Bupa, might induce an individual to “click” a link within an email.