Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

7/16/2013
04:48 PM
50%
50%

Hackers Hawk Stolen Health Insurance Information In Detailed Dossiers

Stolen identity "kitz" come complete with health insurance info, banking information, physical copies of credit cards, and more

The phrase "health insurance" may conjure up images of medical bills for some people, but for hackers it leads only to visions of dollar signs.

According to Dell SecureWorks, health insurance information ranging from contract numbers to the type of plan a customer has purchased is increasingly making its way into detailed dossiers of hacking victims that are being assembled and given to identity thieves in underground cyberforums. These packages of data on individual people, which also include verified bank account numbers and credentials, Social Security numbers, and other personally identifiable information, are known in the underground as "fullz."

When further packaged with custom manufactured or counterfeit physical documents, such as credit cards and driver's licenses, the hacker merchandise is referred to as "kitz," each of which sells for between $1,200 and $1,300 apiece.

"Selling fullz and kitz aren't new, but the selling of kitz, which is focused on health insurance credentials and all the other supporting credentials and documents needed to use those stolen health insurance credentials, is a new trend," says Don Jackson, senior security research for Dell SecureWorks' Counter Threat Unit. "Selling health insurance credentials by themselves does not have enough value, as those other credentials are needed to obtain medical services."

The fullz tend to go for less, about $500 each based on what is included -- full names, addresses, phone numbers, email addresses with passwords, and so on. Health insurance credentials are $20 each, with an additional $20 added whenever there is a dental, vision, or chiropractic plan associated with the health plan. Other fees include $1 to $2 for a U.S. credit card with CVV code, or $20 to $200 for a PayPal account with a verified balance.

The health insurance information, says Jackson, is being used to get free medical services. Theft of medical services, including doctor visits, drugs, and surgeries, are the primary goal for buying these stolen credentials, he says.

"We have seen the cost of health insurance and the cost of medical services continue to rise," Jackson says. "As such, we have seen more demand for stolen health insurance data and the associated credentials needed to use the health insurance, such as physical documents like the insurance card, the driver's license, the SSN, address, payment card, etc. There is definitely an increase in the buying and selling of information like health insurance contracts. So the selling of kitz with this type of information, like health insurance credentials, is on the rise, and that is a new trend."

Additionally, the cost of obtaining the stolen health insurance information and related financial and PII data has not increased, which is a big benefit for the hackers stealing the data, he adds.

The biggest jump in value among stolen credentials involved gaming accounts. Those credentials are valued from between $5 and $1,000, according to Dell SecureWorks. In recent weeks, both Konami and Nintendo revealed that attackers had compromised tens of thousands of user accounts.

"When a seller says their stolen credentials have been validated, they usually charge more for them," he says. "If, for example, the hackers' primary job is to sell stolen credit cards, then they will give the potential buyer contact info for a third party who will validate that the credit cards are good and available to use. And if the stolen data does not end up being what the seller says it is ... then there are numerous hacker forums where sellers are rated and reviewed. Most of the validation comes through the forums and what others say about the seller."

Though Jackson did not identify specifically who was behind the underground marketplaces hawking the data, he suspects the criminals involved in one major operation are located in the U.S.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jaysimmons
50%
50%
jaysimmons,
User Rank: Apprentice
8/1/2013 | 3:07:14 AM
re: Hackers Hawk Stolen Health Insurance Information In Detailed Dossiers
This seems like a scene that could come straight from a movie. I knew there was a huge amount of personal data being stolen daily, but the hacker underground with a full market and price ranges for specific information seems pretty surreal. It makes you realize why there is such a movement against having centralized medical records and why providers prefer to shun interoperability in favor of keeping their patient records secure.

Jay Simmons
Information Week Contributor
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.