Arrested in Mérida for stealing medical data of over 18,000 patients
The National Police have arrested the alleged perpetrator of a cyber-attack that compromised health data of 18,416 patients of the SES, including Junta President María Guardiola. The attacker attempted to sell the information on illicit forums.
Cyber-attack against SES compromised data of thousands of patients
The National Police have arrested in Mérida the alleged person responsible for a computer intrusion that accessed medical information of 18,416 users of the Extremadura Health Service (SES), according to elperiodicoextremadura.com. Among those affected is María Guardiola, president of the Junta of Extremadura. The attacker intended to commercialise the confidential data on illicit forums.
The attack was detected on 5 October in the Centro de Salud Online application. Investigators determined that the intrusion was carried out in an automated and massive manner from an anonymous virtual server located abroad. The SES notified all affected persons via SMS, the CSOnline platform, email and postal mail.
The stolen data included medical records, documents and a database with medical histories, diseases, diagnoses and treatments, organised by year of birth and patient identification code. In total, investigators located over 334,000 compromised health records, although only 18,416 corresponded to SES patients.
The SES reported the incident to the National Police in early October after detecting the intrusion. During the technical investigation, officers identified and arrested the alleged perpetrator in Mérida and conducted a search of his residence. Personnel seized high-performance computers and identified traces of the connections used in the cyber-attack.
The National Police managed to recover the stolen databases and their copies, thus preventing the confidential information from being commercialised on illicit platforms. According to investigators, the operation has made it possible to identify that other public administrations were also affected, although the SES has not specified which ones or the scope of these additional incidents.
The health body confirmed that it has identified the entry route used by the attacker and has applied corrective measures to strengthen security. Legitimate access to Centro de Salud Online is functioning normally and the incident has caused no disruption to healthcare systems.
In addition to the report to the National Police, the SES informed the Spanish Data Protection Authority (AEPD) and recorded the incident in LUCIA, the cyber-incident notification tool of the National Cryptological Centre. The investigation remains open and agents do not rule out clarifying other attacks or attempted intrusions against different institutions.
The Junta of Extremadura has recommended that patients take extra precautions against suspicious calls, messages or emails requesting passwords, verification codes or personal and health information. It has also advised avoiding links or attachments whose origin cannot be verified. Those affected can contact the SES Data Protection Delegate at [email protected] to resolve queries about the protection of their data.
Source: Google News ES — Crime (es)