r/technology • u/chrisdh79 • 1d ago
Human error to blame in Ascension data breach that impacted 5.6 million patients | An "honest" mistake exposed a wealth of sensitive information Security
https://www.techspot.com/news/106119-employee-error-blame-ascension-data-breach-impacting-56.html21
u/isdanetworkdown 1d ago
I took a screenshot of a malicious email and sent it out company wide as an example with and explanation of what to look for. I received 10 emails telling me they weren't able to click the link in the screenshot. Users are dumb
4
124
u/an-interest-of-mine 1d ago
I am going to chalk this up to a failure in training on the part of the company. The person making the “honest mistake” obviously did not receive enough training on attack vectors used by malicious actors.
The company should be fined within an inch of its life.
145
u/No_Accident2331 1d ago
I’m in IT—there’s no such thing as “enough training” for end users. You could have an email or website that literally said “Clicking here will steal your credentials and infect the computer!” and people will still click it.
77
u/notnotbrowsing 1d ago
my favorite was when I got a fake phishing email from IT to test whether we click links, and I forwarded it to the IT department like we're supposed to do.
the IT guy clicked the link and I got "hit" with failing the test and they tried to force me to take the anti-phishing class.
24
u/No_Accident2331 1d ago edited 1d ago
Maybe they wanted you to use the Report Phishing function? I don’t know what email platform you use but with Outlook when our security team sends out a test, when you click the Report Phishing button it will respond with something like “Good job. This was a test sent out by your security department.”
EDIT: I missed that your IT guy fell for it! 🤣😂 Not all IT guys are cut out for it.
2
u/notnotbrowsing 1d ago edited 1d ago
they do that now, not that I've received a test in years. at that time we were instructed to forward to a specific email.
edit: for your edit I was pretty mad because it took months and the IT director calling me before they agreed to unenroll me from the class.
4
u/Greydusk1324 1d ago
I hate my IT dept for the phishing tests. I work in a position that exclusively uses email internally. My work computer is in a facility with limited access to the outside through multiple firewalls. My computer uses a stripped down web version of outlook that initially didn’t have the “report phishing” button until I complained to IT. I was getting marked down for not reporting the multiple test emails each week and they would assign remedial training. I got caught by a phishing email this week and written up by IT for more remedial training. The email that got me: I just had my yearly review with my boss and he told me he was going to send me the review for approval. That afternoon I got an email labeled from my boss with a link labeled employee evaluation but it was phishing by the IT dept. Fuck those guys.
5
2
-1
u/Probably_a_Shitpost 23h ago
Hey fuck you buddy. It's not IT's fault blame yourself and idiot coworkers for doing dumb shit that makes regulatory bodies require we do that shit. We don't like phishing tests either.
2
u/Greydusk1324 17h ago
My IT dept does not come on site unless a major system goes down. They don’t get us the peripherals we need to do our jobs. They send remote training but don’t accept feedback on it. Their training specifically says verbal acknowledgment with a team member about emailed links is the preferred method. They send us software patches and explicitly state in the emails it’s not phishing just click the link. They can bugger off.
2
u/Probably_a_Shitpost 14h ago
Forgive me. I was drinking. I forget sometimes not everyone has a dedicated IT dept with folks who care. I'm sorry about your shitt IT situation and if there is anything I can help with, i'll give you a one time I will look into something for you provided you give a vague enough description of what's going on and I will solve it for you.
(Vague so I don't dox or know anything about you. Just say I'm trying to do x and x doesn't work.)
7
u/frenchtoaster 1d ago
To be fair, a qualified IT person opens the link on a fully patched Linux to see what the site (and knowing it's a probably phishing scam) is not really risking anything and is a good idea for them to decide next steps in case other people in the organization got the same email and probably clicked it.
1
u/ClickAndMortar 15h ago
Our IT has a “report phishing” button in outlook. We have to watch these stupid 20 minute videos of a series called “The Inside Man,” which based on the production value, must have cost a fortune. If you report an actual phishing email, you’ll get a message that the email was legit, since the report phishing button is intended to only be used to report fake phishing emails from the security consulting company.
For a company trying to teach employees to watch out for phishing attempts, they could at least send the phishing emails from different servers. I set up a rule in outlook to just look at the email header, then route everything from the consulting company into a single folder. I get my training reminders there as well as the fake phishing emails so I can watch for actual phishing attempts that IT will ignore.
-5
u/Illlogik1 1d ago
Forwarding phishing emails to anyone is akin to purposely sleeping with people knowing you have hiv ….
10
6
15
u/codinginacrown 1d ago
Also in IT - users at my company are so scared to click on links because of the possibility that it might be a phishing exercise that they've stopped clicking on any links at all...and now other departments are complaining that people aren't doing surveys about IT service requests and employee engagement. Even if they put "This is not a phishing exercise" people still refuse to click links. It's kinda comical.
14
u/stevebr0 1d ago
As an end user, it’s actually kind of funny how often legit emails almost seem to go out of their way to emulate phishing emails. Our IT group sends an email when our passwords are about to expire including a “click here to change your password” link. And of course IT has its own subdomain email so at a quick glance (bc we don’t have time to pick apart emails like this) it’s a slam dunk “report phishing”.
6
u/codinginacrown 1d ago
That's the thing right? No one has the time to decipher whether something is legit or not, so it's easiest to just assume it's bad. Delete or report email and move on.
3
u/Alaira314 1d ago
And sharepoint has been going out of its way to train users to re-enter their credentials after following links in e-mails to shared documents. Eventually, people crunched for time stop doing all the checks, because it's been 50 times this month and they were all legit...and then that's the one that isn't.
0
u/No_Accident2331 1d ago
When you say company do you mean “government agency?” Because it sounds exactly the same at my office!😆 (DOI)
2
3
u/ralphanzo 1d ago
As a nurse you aren’t wrong. I had a coworker who was written up and had to do a lot of retraining because she kept clicking on those test phishing emails. She became so nervous she asked me to look at her work email with her every time to make sure she didn’t click the phishing emails again.
5
u/badgersruse 1d ago edited 21h ago
See. There’s where you are wrong. There are some things that it just shouldn’t be possible for end users to do. Then no amount of user error would allow it. You (as a business) are thinking about this wrong, and that’s why a business that allows this should be fined within an inch of its life.
2
u/Masterofunlocking1 1d ago
Same here. It's insane the amount of stuff we see in our firewall logs that get blocked throughout the day, granted some of it could be legit and the firewall has it categorized wrong but still.
2
u/gbobeck 22h ago
I’m a former IT guy who moved over to infosec - you are 100% correct. My team in the past sent out phishing tests right which literally said “This is a phishing test. Click here for a surprise.” and we had end users click the link instead of reporting it using the Phish alert button. That campaign was sent out a week after the annual phishing training.
1
u/Illlogik1 1d ago
It’s true , especially in healthcare where the users are more concerned with saving lives and healing the sick over Internet boogeymen
3
1d ago edited 1d ago
[removed] — view removed comment
6
u/ChuckMcA 1d ago
Yeah. If a single user mistake can blow up your network, it’s a security problem not a user problem. Flat networks, untracked privilege and access are all too common.
4
u/Wistephens 1d ago
Agreed. You need to implement Zero Trust, where you automatically assume that everything is compromised and trust no user, device or request.
Trust No One Least Privilege Access Constant verification Treat every access as potentially compromised
Also, these healthcare orgs should be following HITRUST (45 CFR) to encrypt everywhere.
2
u/OnlineParacosm 20h ago
This is actually a cop out that hospitals use to avoid paying for security budgets.
They place the onus on workers to avoid being phished and it never works because there is always a threat actor more computer savvy than your hospital worker.
They need to invest an endpoint protection and it’s incredibly expenses
1
u/tdasnowman 16h ago
I don’t work for this company but I do work in healthcare. I’d say the problem might be too much training. People are probably being bombarded with low effort attacks and the obvious it phishing tests the really sophisticated ones can squeeze by. We just had an issue at work where an annual email was mass reported as phishing cause the company changed the domain. They had to resend that email, and at the same time we got some actual phishing attacks using that vendor’s template. Caused a lot of confusion largely because all the training we’ve had to do has people being hyper vigilant which also generally means you wind up missing something.
8
u/alwaysfatigued8787 1d ago
I think I would have been more satisfied if they had just said that it was a dishonest mistake.
6
u/spreadthaseed 1d ago
Honest mistake is stepping on someone’s shoe in a dark movie theatre.
A data breach this big isn’t honest or a mistake.
11
u/skerinks 1d ago
I was a network manager a couple years ago for Ascension at a hospital system in another state than this one. But all hospital systems are the same. The user base is the same. There was sooooo much training over this stuff. And always failures. The consequences of clicking a link were to simply retake a CBT (again).
This is a problem of accountability, not necessarily training. I can’t tell you how many people will just click anything you put in front of them if it seems anywhere remotely legit, and something they need. I will bet you even now within Ascension that clicking on a link in a phishing exercise does not lead to anyone getting fired or reprimanded in anyway. While I would love to say that it was nurses over a certain age, I’ve seen plenty of people fresh out of college who will click on anything they think will make their job easier.
If you’re looking to get into data breaching, a surefire way is to simply put some malware on 10 thumb drives and place them around the hospital with stickers on them labeled “Nurses station 5 West” or something like that. I would bet my next paycheck, someone will plug them in.
3
u/reflekt- 21h ago edited 21h ago
Phishthreat was like this at every single company I ever worked at. Huge percentages of people failed the simulated emails. One person claimed to open them on purpose and take the required quiz simply to print the award certificates for their cube as a joke. One email was titled “lost puppy in the parking lot” and 80% of people opened the attachment. This was at a Fortune 500 and the CEO actually sent an email scolding the entire building. People are fucking morons and the only thing that will fix that is the threat of firing.
2
u/Alaira314 1d ago
I can’t tell you how many people will just click anything you put in front of them if it seems anywhere remotely legit, and something they need.
As someone who's been punished at work for challenging something that seemed very suspicious but turned out to be legit...you bet I click. :
I'm not sure what world IT operates in, but it's not the one I'm in where we constantly get legitimate e-mails asking us to follow links and perform tasks, mostly for HR but sometimes for other departments, originating from external addresses. Or that are only in plaintext, with no salutation or signature. Or that are sharing a document with you, only to demand you authenticate with your e-mail and password, despite already being logged in to your account on that browser. These are all legitimate things I see regularly, and the one time I naively followed my shiny new training to report it I was very swiftly shown the error of my ways.
1
u/skerinks 22h ago
I get it, I really do. I was not always an IT guy. What you wrote is a failure of your company’s leadership. Within the story we see the consequences of not having a security-first mindset. I get that ‘operations’ is the whole point of being in business. I also say it’s criminal at this point in technology to not put security on the same level of operations. Aside from people’s personal information now on the dark web from this instance (we’ll just leave alone the argument that it was probably already there anyway), can you imagine the cost to remediate and the millions, maybe even billions, lost in revenue at Ascension because of this scenario?
8
u/cwpreston 1d ago
Ascension has outsourced most of it’s IT infrastructure, I’m amazed breaches haven’t happened more often.
3
u/dsgoose 1d ago
Can confirm.
7
u/cwpreston 1d ago
It's criminal how badly reimbursed the stateside contract workers they switched to are. Ten days PTO a year with no paid holidays? I still remember how some were panicking when they were told they had a week furlough for thanksgiving and two weeks for Christmas. Sure, some of the upper admins that came over from that org in California are making bank in bonuses because costs are down but overall the organization is really suffering, and they have sold off so many hospitals. Every time I went to a ministry for a project go live I got blasted by providers and staff saying they just didn't want to call the help desk anymore.
5
u/dojo2020 1d ago
Do they even care?? Canada 🇨🇦 here, where is the legal accountability for your data?? Hmmm?
2
u/sea_stomp_shanty 16h ago
Americans love to talk about legality until they realize they’ve broken laws 😂🫡
4
4
u/Hanky_Adula_1102 19h ago
Posting this again to provide a comparison of Ascension's highest paid personnel vs how little time or money they invest in protecting their customer's info:
In 2022, Ascension Health Alliance reported total revenue of $3.7 billion (compared to $4.2 billion in 2021, $2.4 billion in 2020 and $2.3 billion in 2019) with the decrease primarily attributable to lower investment income.
8,438 employees were compensated $1.1 billion which equates to an average compensation of $130,000. However, only 1,663 employees received more than $100,000 in compensation which suggests that the most highly compensated received significantly higher compensation. The 9 most highly compensated individuals are listed below:
$13,707,694: Joseph R Impicciche,President and CEO
$ 5,289,938: Herbert J Vallier, EVP and CHRO
$ 5,542,344: Anthony J Speranzo, CEO, Chair Ascension Cap
$ 5,702,000: Joseph G Cacchione EVP, Clinical and Network Services
$ 4,697,662: Karen Springer, EVP and CNE
$ 5,686,074: Craig Cordolo, EVP and COO
$ 3,694,461: Elizabeth Foshage, EVP and CFO
$ 4,958,373: Eduardo F Conrado, Former Board Member (end 6/18)
$ 1,598,786: Anthony R Tersigni, CFO (end 6/19), Chair, Ascension Cap (start 7/19)
Source: https://paddockpost.com/2024/05/27/executive-compensation-at-ascension-health-2022/
Comment by a physician: "Another way or looking at it: if Joseph Impicciche worked 100 hours a week (a generous estimate) 47 weeks a year, he made $2916.53 per hour. He made 146 times what an experienced hospital housekeeper made, who may be forced to work part-time so she doesn’t get full-time benefits. And he isn’t exposed to dangerous chemicals or biological hazards.
Greed is killing U.S. health care."
9
u/NootHawg 1d ago
Well since it was an “honest” mistake they should face absolutely no consequences for exposing all of those people’s sensitive information /s.
8
u/ekkidee 1d ago
I'll just put this out here:
As for how a massive healthcare system fell victim to such a severe hack, it came down to a classic error: an employee accidentally downloaded a malicious file disguised as legitimate. The healthcare provider admitted in June that it was "an honest mistake."
2
u/ryan0988 1d ago
Honestly I have just come to terms that all my shit is out there now days. With the amount of data breaches there is no such thing as privacy.
2
u/2-wheels 1d ago edited 1d ago
Time to honestly pay up. How much did this ceo make in 2024?
Update: despite being a non-profit, ceo Joseph Impicciche made over $13,000,000 in 2021. Time to honestly give some back.
2
u/the_drunk_drummer 23h ago
There's no such thing as a "mistake". The word mistake is used instead of saying they were careless, not paying attention or distracted, sleep deprived, negligent, sloppy, the list goes on. But using the word mistake, is admitting you learned nothing from what happened and have no plan to prevent what happened. Just my thought.
2
u/steedandpeelship 23h ago
Whoops, shouldn't a opened that "link" in that email! Sorry, my bad y'all. We good now??
2
u/Monkfich 21h ago
“Honest” mistakes are the best. They confirm that the company believes their current system of manual control is adequate and nothing can be improved. As such, any issues that arise are always an employee’s fault.
“Poor old Sally - she made an honest mistake! Not us though, not us who didn’t want to spend money on IT security controls this year, not us!”
2
2
2
2
u/eliblack 14h ago
These guys are one of our biggest clients. We work directly with patient data and financials. They were down for an entire month when this happened. Took us another month to get their data loaded back up to date and reconciling again. It’s crazy to read it went undetected for that long. Wild. Nice people though lol.
2
u/pecheckler 7h ago
Ascension IT was outsourced to India and has gotten far worse since that cost cutting endeavor began and all the knowledgeable US IT staff were let go.
2
u/Logical_Parameters 1d ago
In the endless pursuit of pushing quarterly profit margins that is peak Capitalism, security is not a top expense.
1
1
u/bedbathandbebored 12h ago
If one mistake was all it took then the security measures they have are garbage.
1
u/BrewKazma 6h ago
Ascension can eat a bag of dicks. They wouldn’t give my sister in law a new IUD, because of religious reasons.
1
0
u/sea_stomp_shanty 1d ago
an “honest” mistake
Oh, so now we get to start saying some mistakes are better than others, okay
0
0
u/dumbassname45 14h ago
Can “honest mistake” be used as a defence for Luigi Mangione ? I was just walking down the street and bang my gun just went off and Brian Thompson got shot.. honest mistake. Human error, no big deal. I said sorry can I go now?
-1
u/gumheaded1 1d ago
The phrase “human error” is idiotic. No such thing as an error that is not “human”.
177
u/XDon_TacoX 1d ago
How curious, people would pay a huge load of money for that info, and there should be a huge as fine and jail time; but if you confess a mistake nothing happens.
Imagine killing your neighbor, and then just making a post saying it was an accident and suddenly nothing happened... Legally I mean.