Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

7/16/2013
04:48 PM
50%
50%

Hackers Hawk Stolen Health Insurance Information In Detailed Dossiers

Stolen identity "kitz" come complete with health insurance info, banking information, physical copies of credit cards, and more

The phrase "health insurance" may conjure up images of medical bills for some people, but for hackers it leads only to visions of dollar signs.

According to Dell SecureWorks, health insurance information ranging from contract numbers to the type of plan a customer has purchased is increasingly making its way into detailed dossiers of hacking victims that are being assembled and given to identity thieves in underground cyberforums. These packages of data on individual people, which also include verified bank account numbers and credentials, Social Security numbers, and other personally identifiable information, are known in the underground as "fullz."

When further packaged with custom manufactured or counterfeit physical documents, such as credit cards and driver's licenses, the hacker merchandise is referred to as "kitz," each of which sells for between $1,200 and $1,300 apiece.

"Selling fullz and kitz aren't new, but the selling of kitz, which is focused on health insurance credentials and all the other supporting credentials and documents needed to use those stolen health insurance credentials, is a new trend," says Don Jackson, senior security research for Dell SecureWorks' Counter Threat Unit. "Selling health insurance credentials by themselves does not have enough value, as those other credentials are needed to obtain medical services."

The fullz tend to go for less, about $500 each based on what is included -- full names, addresses, phone numbers, email addresses with passwords, and so on. Health insurance credentials are $20 each, with an additional $20 added whenever there is a dental, vision, or chiropractic plan associated with the health plan. Other fees include $1 to $2 for a U.S. credit card with CVV code, or $20 to $200 for a PayPal account with a verified balance.

The health insurance information, says Jackson, is being used to get free medical services. Theft of medical services, including doctor visits, drugs, and surgeries, are the primary goal for buying these stolen credentials, he says.

"We have seen the cost of health insurance and the cost of medical services continue to rise," Jackson says. "As such, we have seen more demand for stolen health insurance data and the associated credentials needed to use the health insurance, such as physical documents like the insurance card, the driver's license, the SSN, address, payment card, etc. There is definitely an increase in the buying and selling of information like health insurance contracts. So the selling of kitz with this type of information, like health insurance credentials, is on the rise, and that is a new trend."

Additionally, the cost of obtaining the stolen health insurance information and related financial and PII data has not increased, which is a big benefit for the hackers stealing the data, he adds.

The biggest jump in value among stolen credentials involved gaming accounts. Those credentials are valued from between $5 and $1,000, according to Dell SecureWorks. In recent weeks, both Konami and Nintendo revealed that attackers had compromised tens of thousands of user accounts.

"When a seller says their stolen credentials have been validated, they usually charge more for them," he says. "If, for example, the hackers' primary job is to sell stolen credit cards, then they will give the potential buyer contact info for a third party who will validate that the credit cards are good and available to use. And if the stolen data does not end up being what the seller says it is ... then there are numerous hacker forums where sellers are rated and reviewed. Most of the validation comes through the forums and what others say about the seller."

Though Jackson did not identify specifically who was behind the underground marketplaces hawking the data, he suspects the criminals involved in one major operation are located in the U.S.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jaysimmons
50%
50%
jaysimmons,
User Rank: Apprentice
8/1/2013 | 3:07:14 AM
re: Hackers Hawk Stolen Health Insurance Information In Detailed Dossiers
This seems like a scene that could come straight from a movie. I knew there was a huge amount of personal data being stolen daily, but the hacker underground with a full market and price ranges for specific information seems pretty surreal. It makes you realize why there is such a movement against having centralized medical records and why providers prefer to shun interoperability in favor of keeping their patient records secure.

Jay Simmons
Information Week Contributor
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-30481
PUBLISHED: 2021-04-10
Valve Steam through 2021-04-10, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click.
CVE-2021-20020
PUBLISHED: 2021-04-10
A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root.
CVE-2021-30480
PUBLISHED: 2021-04-09
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat softw...
CVE-2021-21194
PUBLISHED: 2021-04-09
Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-21195
PUBLISHED: 2021-04-09
Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.