An insider sifts through 108,000 client files. What can go wrong?

Credit:
Thinkstock

In a succinct statement, the managing director of Bupa Global, Sheldon Kenton, explains how Bupa Global recently discovered an employee had “inappropriately copied and removed some customer information from the company. Around 108,000 international health insurance policies are affected.”

Bupa has approximately 1.4 million international health insurance policies (16.5 million total policies), so the employee only managed to visit the policiess of approximately 8 percent of Bupa’s international health insurance policy holders. The 108,000 policies affected 547,000 individuals . The client data compromised included:

  • Names
  • Date of birth
  • Nationalities
  • Contact information
  • “Administrative materials”
  • Bupa customer numbers

Kenton continues that while the information was accessed and copied, none of the information was deleted from the system. Furthermore, Bupa believes the compromised information did not include client financial or medical data.

No accident: Trusted insider acted deliberately

To their credit, Bupa calls it like it is in their statement: This was a trusted insider who broke trust and acted in a deliberate manner:

This was not a cyber attack or external data breach, but a deliberate act by an employee. We have introduced additional security measures and increased our customer identity checks. A thorough investigation is underway and we have informed the FCA and Bupa’s other UK regulators. The employee responsible has been dismissed and we are taking appropriate legal action.

Backups are important

A salient point to Bupa’s statement is the employee’s attempt to remove the data from Bupa. While the employee may have been successful, Bupa is unequiviocal that no client data was deleted. Therefore, we may presume the existence of multiple iterations of backup copies to the data base being harvested.

Trust but verify

An additional indicator that Bupa understands the magnitude of what transpired, as they evolve their internal policies, is this statement, “We have introduced additional security measures and increased our customer identity checks.”

As every CISO knows, trust those who have access to the data, but verify they access only that data to which they have a need.

Least privileged access

The doctrine of need to know or least privileged access serves to reduce the risk that data is being accessed as part of a farming exercise by a curious or malevolent employee. By assuring your employee has access to the information they need to do their job and the ability to audit it is being accessed for bona fide purposes, you project a secure environment.

Bupa customers should be hyper-alert

The 549,000 individuals whose information was compromised need to remain hyper-alert to criminals attempting to capitalize on the client information. The information can be used to create phishing emails to spoof not only Bupa, but any number of entities, which by including the identifying information taken from Bupa, might induce an individual to “click” a link within an email.

Related:

Christopher Burgess is an advocate for effective security strategies, be they at the office or home for you and your family. Christopher, served 30+ years within the Central Intelligence Agency. He co-authored the book Secrets Stolen, Fortunes Lost, Preventing Intellectual Property Theft and Economic Espionage in the 21st Century .

Follow

Cybersecurity market research: Top 15 statistics for 2017

You Might Like

CSOONLINE稿源:CSOONLINE (源链) | 关于 | 阅读提示

本站遵循[CC BY-NC-SA 4.0]。如您有版权、意见投诉等问题,请通过eMail联系我们处理。
酷辣虫 » 创业投资 » An insider sifts through 108,000 client files. What can go wrong?

喜欢 (0)or分享给?

专业 x 专注 x 聚合 x 分享 CC BY-NC-SA 4.0

使用声明 | 英豪名录