Johns Hopkins tells patients: Employee stole data for fraud
IDG News Service - Baltimore's Johns Hopkins Hospital is warning more than 10,000 patients about a data theft after linking a woman working in the hospital's patient registration area to fraud.
"Beginning around January 20, 2009, Johns Hopkins received reports, some from individuals themselves, and some through various local law enforcement agencies, that some individuals had determined that they were victims of identity theft and that the theft activities focused in the Baltimore area," the hospital said in an April 3, 2009, letter sent to patients whose data was accessed. The letter was published Monday on the Maryland attorney general's Web site.
After the U.S. Secret Service and U.S. Postal Service got involved, investigators began suspecting that the Johns Hopkins employee was linked to a fraud that involved fake Virginia drivers' licenses, although officials declined to provide more information regarding that alleged scheme.
Law enforcement has identified 46 victims of the scam, 31 of whom were linked to Johns Hopkins. The hospital is offering them credit protection services, and it is also offering similar services to another 526 Virginia patients who may have been targeted by the fraud.
However, most of the 10,200 patients and former patients being notified are thought to be at "extremely low risk" of fraud, according to hospital spokesman Gary Stephenson. "We just contacted them to do due diligence," he said.
The employee had access to the Social Security numbers, names, addresses, dates of birth, telephone numbers, parents' names and medical insurance information of current and former patients. She was not able to learn about the patients' medical conditions, however.
News of the incident was first reported Monday on Databreaches.net, which noted that former Johns Hopkins employee Michelle Johnson had been indicted in January on fraud charges for allegedly using patient data to open fraudulent credit card accounts.
Stephenson said that the Johnson case was separate from this latest incident, but he declined to comment further on the matter, citing an ongoing investigation.
In its notification letter, Johns Hopkins said it has fired the employee it suspects of this latest fraud and expects that she will be indicted. However, the letter warns, "There is no absolute certainty, at this time, that she was the source of the information."
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Ponemon 2014 SSH Security Vulnerability Report According to research by the Ponemon Institute, 3 out of 4 enterprises have no security controls in place for SSH which leaves organizations...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!