Tuesday, May 12, 2009
Hacker investigation like "looking for a needle in a haystack," says state official
A probe continues of the incident involving a state prescription monitoring program
RICHMOND — Virginia officials have yet to determine how severely a hacker compromised the state’s prescription monitoring database, but say they are taking steps to restore other online services for health professionals.
The FBI and the Virginia State Police continue to investigate a security breach involving the prescription monitoring program maintained by the Department of Health Professions, which licenses health care providers in the state. State officials said a hacker penetrated the program’s Web site, accessed millions of prescription records and reportedly posted a note demanding $10 million for the data’s return. The department recognized the unauthorized message on April 30 and shut down its computer systems to protect its data.
The criminal probe could take "a couple more weeks," state Secretary of Health and Human Resources Marilyn Tavenner said today, when she appeared before the House Appropriations Committee. Tavenner said the FBI likened the investigation to "looking for a needle in a haystack."
"But they do have the ability to find the needle and they will," Tavenner said.
Meanwhile, VDHP is gradually restoring other online services such as license renewals, Tavenner said. The department has no evidence that any information other than the prescription database was compromised, she said.
Lawmakers on the committee questioned whether the department had adequate computer security measures in place, and one member said state government should launch a comprehensive review of all of its information systems to protect against similar threats.
"We had all the safeguards in place, but we still got hacked," said Del. Joe May, R-Leesburg. "Would it be safe to say, or fair to say, that we underestimated the value of the data you’re sitting on?"
But lawmakers were told that the Department of Health Professions ranked in the top 5 percent of state agencies in an audit of information security. All of the department’s data had been properly backed up and that back-up files had been properly secured, officials said.
The FBI and the Virginia State Police continue to investigate a security breach involving the prescription monitoring program maintained by the Department of Health Professions, which licenses health care providers in the state. State officials said a hacker penetrated the program’s Web site, accessed millions of prescription records and reportedly posted a note demanding $10 million for the data’s return. The department recognized the unauthorized message on April 30 and shut down its computer systems to protect its data.
The criminal probe could take "a couple more weeks," state Secretary of Health and Human Resources Marilyn Tavenner said today, when she appeared before the House Appropriations Committee. Tavenner said the FBI likened the investigation to "looking for a needle in a haystack."
"But they do have the ability to find the needle and they will," Tavenner said.
Meanwhile, VDHP is gradually restoring other online services such as license renewals, Tavenner said. The department has no evidence that any information other than the prescription database was compromised, she said.
Lawmakers on the committee questioned whether the department had adequate computer security measures in place, and one member said state government should launch a comprehensive review of all of its information systems to protect against similar threats.
"We had all the safeguards in place, but we still got hacked," said Del. Joe May, R-Leesburg. "Would it be safe to say, or fair to say, that we underestimated the value of the data you’re sitting on?"
But lawmakers were told that the Department of Health Professions ranked in the top 5 percent of state agencies in an audit of information security. All of the department’s data had been properly backed up and that back-up files had been properly secured, officials said.
