Florida Realtors Warn to be on the Alert for Bogus Emails.

The Florida Department of Business and Professional Regulation is warning Realtors and other professionals with state licenses to watch out for emails supposedly coming from the Department. The scam is an email informing the recipient that they are subject of a pending disciplinary action. The target is directed to contact an investigator at a toll free phone number. During this interview the scammers collect a variety of personal and business information.

Sandi Poreda, communications director for the department, said that the scammers have managed to copy “the banner on our website and created an email signature that looks very much like ours.”

This scam should be a concern for any business person that has been licensed by the State. This scam will most likely be travelling across the country in the next few months. Every business person should think twice before providing information based on an email request.  

DNS Changer Day is Coming

In April the FBI made numerous arrests of a cyber-criminal group that created and operated a malware scam called DNS Changer. The core of the scam was to trap consumers into using a fraudulent DNS Server and there by getting directed to fraudulent websites. When the FBI made their arrests in April, to prevent the loss of internet services to around 500,000 consumers, the bureau chose to operate the DNS servers until all of the affected computers could be patched. On July 9^th 2012 the FBI will shut down the fraudulent DNS Servers.

Computer users are strongly suggested to follow the steps below to insure that their computers will not loose internet access on the 9^th.

To tell if your computer is infected. Go to http://dns-ok.us and wait for the page to load. If it comes up "green" then you are ok. On the other hand, if it detects a problem you need to visit another website; www.dcwg.org. This is an industry run website with all of the information you need to remove this malware from your computer.

Please take the time and make sure you are not going to be affected when the FBI pulls the plug.

Nationwide Study on Medical Identity Theft

I read an article today about a study commissioned by Nationwide Insurance and conducted by Harris Interactive.  The topic of the study was the question of medical identity theft. The results only confirm what I have seen for the past 10 years or so. The public still does not understand that Identity theft in the medical field occurs.

The survey conducted by telephone, of only of people with health insurance, showed that 1 out of 6 (15%) respondents stated that they knew about Medical identity theft. When asked only 38%, of those who said they knew what medical identity theft was, were able to define it.

The depth of medical identity theft is growing each year. In 2010 there were 1.5 million persons victimized to a tune of $30 Billion dollars. The damage is clearly felt in the higher costs of medical services and insurance. The worse news is that there is no real solution in sight.

The various forms of medical identity theft manifest different problems and concerns. We have all heard the warning about what will happen should someone receives the wrong blood because of mixed files. So how about the victim who is denied medical equipment because his or her information was used by imposter to scam Medicare. There is the victim who has to defend himself in a court of law because of collection actions resulting from medical services provided to the thief. There is the problem of the medical issues of the imposter affecting the livelihood of the victim. There certain medical conditions that when reported make the wheels spin regardless of any other information. Imagine losing your pilot license when you are a flight school owner and training instructor.

I don’t want to be the voice in the wilderness calling out the danger but how much more will the medical system take before it collapses under the barrage of fraud?

Cyber Data Breaches What Is Coming

The news for the last few days has talked about the Linked-in and the E-harmony password breaches as though it was a super threat. In the realm of data breaches you need to understand the issue. What is breached and what information is exposed. If I have your password I can get into your account right? What if I don’t know your login ID? If all I have is your password I may not be able to do much unless there is a way to identify you or the account. If I can identify you, I can contact you to scam you out of additional information to commit my crimes. If I can identify the account then I can login and take over the account. The type of account will determine the damage that I can create.

When there is a breach of date the concern is three fold.

1.       Was the information enough to supply me with the data I need to create new accounts?

2.       Was there enough information to allow me to sucker you into giving up more information?

3.       Was it enough for me to take over the account and drain it, max it out or use it to scam others?

When a company has a data breach and does not clearly indicate what was exposed it leaves the recipients to try and guess what to do. It also leaves the company somewhat exposed to legal reprisals. The time frame in a breach should be discovery, investigation, informed notice, and then proceed with your business. The investigation should involve law enforcement and they should be called before any repair or system fixes are started. The notice needs to be clear and concise and complete. The better these steps are done the better for all involved.   

Data Breach Warning of Lawsuits

Last Monday an article by Jay Singleton published in the Connecticut Law Tribune cast some very ominous warnings for every medical or financial organization across the country. Trial lawyers are setting their sights on you for the data you have and how well you protect it.

With medical organizations pressing to put patient records into electronic format, all it takes is one lost laptop or a single data security lapse and you become to focus of a number of law firms. One loss of personal information and any of the people whose information you held could take legal action against you. According to the federal Department of Health and Human Services, the personal medical data for more than 11 million people may have been exposed during the past two years.

Financial institutions already have similar problems. Attorney Michael A. Stratton, of New Haven’s Stratton Faxon, is involved in two class actions filed in New Haven seeking damages from banks accused of mishandling personal information of customers. One case involves the Bank of New York Mellon, which lost data tapes containing personal information for about 4.5 million people, including 500,000 customers of People’s United Bank of Bridgeport.

While these lawsuits are in their early stages and there is no clear examples of loss or damages to be presented. There are plaintiffs lawyers who concede that valuation of these cases is still a big unknown. This does not mean that they will not search until they find it.

The health-related privacy cases as class actions is still untested territory, attorneys believe new law will be made in the next few years. That means attorneys and the courts will be addressing these issues in the not too distant future. It would be best if your company or organization is not the test case for this type of new action.

IRS and TIGTA Testify on Identity Theft before Congress

Last week J. Russell George, the Treasury Inspector General for Tax Administration and IRS Deputy Commissioner Steven Miller appeared before Congress to report on the issue of Identity Theft and tax fraud. From Georges testimony a laundry list of issues were presented to the oversight Committee.

Issues included had to do with timely resolution, IRS and Victim communications, process steps for victims returns are not a priority, guidelines for identity theft cases are inconsistent and incomplete. The biggest failing appears to be that the IRS does not use the data from identity theft cases to identify trends.

The issues that US Citizens face, when dealing with an identity theft tax problem, are formidable to say the least.  I have for many years studied these problems from a variety angles, seeking the best way to guide the victim through what is for them a nightmare. The best path is still not always clear because of the different parties involved in resolving the problem. For the victim they have the burden of proving that they are a victim. The IRS employee has the task of evaluating the statements and documents of the victim, trying find the truth from the fiction that maybe assumed facts, erroneous conclusions and just plain confusion on the part of the victim. It is all too easy for someone jump to a wrong conclusion when trying to unravel the different elements of the case, which leads to mistakes by both the victim and the Government.

For more than ten years I worked with victims trying to create a path through the maze of issues that would put the victim and the Government on the same side. That has not come to pass yet. There are a number of ways to address the issues and then format the steps so that they work for both the victims and the IRS, but that will require both groups working together. For the past five years, I have wanted, to sit down with the policy makers from the IRS, to create a program that will help the victim of identity theft, and not be able to be gamed by the perpetrators.

To J. Russell George, the Treasury Inspector General for Tax Administration and IRS Deputy Commissioner Steven Miller, I have been hoping to work with the IRS so you would not have to go before Congress and report the ugly state of the problem. The issue of identity theft will not be going away anytime soon. From the stories in the press about the thieves playing the system is only the surface of what is really going on. There is no time like now to put an end to it.

Data In-Security in the Healthcare Industry

I am seeing more and more stories about the breaches in the healthcare industry. What I am not seeing is a strategic push to fix the problem. 

From the Verizon breach report we get to see that most of the breaches are due to the human element.  The hactivists seemed to be responsible for about 58% of the documented attacks.  Just 4% were attributed to insiders which means that 1/3 of the breaches were due to the acts of cybercriminals.  The report states that 97% of the breaches could have been avoided by simple “basic or intermediate” security controls.  Or the fact that 69% of the attacks used malware for access. More than a little sad was the stat of 92% of the breaches were discovered by a third party. There is the stat of 94% involved compromised servers. When you couple that with the stat of 85% took more than two weeks to be discovered.

With the additional information from the breach report it paints a clear picture that most of the businesses have not started to make data security priority it needs to be.  You need to look at what the data is and how you need to use it.  Then you design the system to protect it and you. Once the system is built and running, you test it and then retest it to make sure it works for what you need it to do. Then you monitor the system on a daily basis looking for the clues that someone is trying to attack you. 

It is not as hard as you might think and I firmly believe it will more cost effective to do than say paying for a breach of data.