Latest / Tech Talks With Kinsoft / Partnered Health – A GP Network Breach, 21 Clinics, and a Court Order Against Criminals

Transcript

Partnered Health – A GP Network Breach, 21 Clinics, and a Court Order Against Criminals · Tech Talks With Kinsoft

• 0:00
  You know, when you walk into your local doctor's
• 0:01
  office, there is there's this very specific,
• 0:06
  almost comforting illusion at play. Oh, absolutely.
• 0:10
  Like you see the familiar receptionist, you notice
• 0:12
  those, you know, slightly outdated magazines
• 0:14
  sitting on the glass table. Usually from about
• 0:17
  five years ago. Yeah, exactly. And you hear the
• 0:19
  quiet hum of the waiting room. It just feels
• 0:21
  small, right? It feels entirely contained. And
• 0:24
  that local feeling. I mean, it's very intentional.
• 0:26
  It creates the intimacy that's really necessary
• 0:29
  for good health care. Right. Because you trust
• 0:31
  that the conversation you're about to have behind
• 0:34
  that closed door stays right there in that room
• 0:37
  or at most inside like. a manila folder in a
• 0:41
  locked metal filing cabinet. But that's the illusion
• 0:43
  right there. Yeah, because behind that reception
• 0:45
  desk, behind that whole friendly neighborhood
• 0:48
  clinic vibe, there is almost always this massive,
• 0:51
  invisible corporate IT system operating in the
• 0:54
  background. Doing all the heavy lifting. Right.
• 0:56
  So welcome to the deep dive. This one is custom
• 1:00
  tailored for the learner. We know you are always
• 1:03
  looking to understand the hidden systems running
• 1:05
  our world. And you know, you want the actionable
• 1:08
  takeaways without getting bogged down in the
• 1:10
  noise, which is exactly what we're going to do
• 1:12
  today. Today, we are relying on this really fascinating
• 1:15
  recent cybersecurity report by the experts at
• 1:18
  Kinsoft. So, OK, let's unpack this because we're
• 1:22
  looking at exactly what happens when that hidden
• 1:24
  corporate layer gets shattered by a major cybersecurity
• 1:27
  breach. Yeah. And the company at the center of
• 1:29
  this Kinsoft report, they're called Partnered
• 1:31
  Health. Partnered Health. Right. And that name
• 1:34
  might not ring a bell for you at all, which is
• 1:36
  by design. Because they're the parent company.
• 1:39
  Exactly. They operate as the corporate engine
• 1:42
  behind, gosh, more than 60 medical centers, skin
• 1:45
  cancer clinics, and allied health practices spread
• 1:48
  all across Australia. 60? Wow. Yeah. And to give
• 1:52
  you a sense of the sheer scale we are dealing
• 1:54
  with here, they state that their services have
• 1:56
  touched more than 5 million people since they
• 1:58
  were founded back in 2013. Wait, 5 million people?
• 2:02
  5 million. That is a massive portion of the population
• 2:05
  just funneling their most sensitive data through
• 2:08
  one single corporate entity, mostly without ever
• 2:11
  knowing the parent company's actual name. It
• 2:14
  is a staggering amount of centralized data. Just
• 2:18
  huge. And in mid -July. Partnered Health confirmed
• 2:22
  basically the worst case scenario. It's a hack.
• 2:25
  Yeah. A malicious actor compromised their systems
• 2:27
  and stole a massive cache of personal and health
• 2:30
  information. Unbelievable. Based on the initial
• 2:33
  reporting, this breach impacts 21 of their clinics.
• 2:36
  This is across New South Wales, Victoria, Queensland,
• 2:40
  Western Australia, and Canberra. So it's basically
• 2:42
  nationwide. Pretty much. Specifically, 16 clinics
• 2:46
  are confirmed to have been affected, with another
• 2:47
  five still under active... Forensic investigation.
• 2:51
  Which means for you listening right now, even
• 2:53
  if you have never heard the words partnered health
• 2:55
  in your life. Which you probably haven't. Right.
• 2:56
  But if you visited one of those local clinics,
• 2:59
  you are tethered to their corporate security
• 3:01
  practices. You're inside their digital vault.
• 3:04
  Whether you realized it or not. Exactly. And
• 3:06
  because that vault held health data, the fallout
• 3:10
  here is entirely different than your standard
• 3:12
  corporate hack. Oh, completely different league.
• 3:15
  So let's look at the actual inventory of what
• 3:17
  was stolen because this gets incredibly invasive
• 3:20
  very quickly. It really does. The compromised
• 3:22
  data escalates in severity pretty fast. First,
• 3:26
  the company confirmed the theft of what we call
• 3:28
  foundational identifiers. Like the basics. Right.
• 3:31
  Names, dates of birth, addresses, contact details.
• 3:34
  Not bad enough, but standard for a breach. Yeah,
• 3:37
  but then it crosses into structural government
• 3:39
  and financial data. We're talking Medicare numbers,
• 3:42
  private health insurance details, Veterans Affairs
• 3:45
  numbers, and concession card numbers. Okay, so
• 3:47
  that's a much bigger deal. It is. But the element
• 3:50
  that crosses a profound line. The one that really
• 3:53
  hurts is the exposure of what they call the clinical
• 3:56
  layer. The clinical layer, meaning the actual
• 3:59
  medical file. Yes. We are talking about consultation
• 4:02
  notes, referral letters and pathology and diagnostic
• 4:05
  results. Wow. The raw reality of people's physical
• 4:09
  and mental lives. Exactly. I mean, I always have
• 4:12
  to draw a contrast here when we talk about cyber
• 4:14
  attacks because people get breach fatigue, you
• 4:16
  know? Oh, for sure. You hear about it every week.
• 4:18
  Right. And if my credit card gets stolen in some
• 4:21
  retail breach, it's like. I don't know. It's
• 4:23
  like someone throwing a brick through my living
• 4:24
  room window. Yeah, it's a huge pain. It is a
• 4:27
  violation. It's highly annoying, yes. But I can
• 4:31
  call my bank. They cancel the card. The window
• 4:33
  gets repaired. And the structural integrity of
• 4:36
  my life is, you know, restored. It's fixable.
• 4:39
  Exactly. But stolen pathology reports. Stolen
• 4:43
  consultation notes. That is like someone stealing
• 4:46
  your actual DNA and your private diary at the
• 4:49
  exact same time. That's a really good way to
• 4:51
  put it. You cannot just call the bank and ask
• 4:52
  them to cancel your medical history. No, you
• 4:55
  definitely can't. And what's fascinating here
• 4:57
  is that the cybersecurity industry classifies
• 5:00
  those two scenarios entirely differently. How
• 5:02
  so? Well, medical records, they're referred to
• 5:05
  as crown jewel data. Crown jewel data. Yeah,
• 5:09
  because they inflict a permanent two -fold harm
• 5:12
  on the victim. The first harm is structural.
• 5:16
  Meaning the identity theft side of things. Exactly.
• 5:19
  This data represents the richest identity theft
• 5:21
  kit possible. A credit card number is just a
• 5:24
  temporary token. But your date of birth, your
• 5:28
  Medicare number, your biological reality, those
• 5:31
  are permanent identifiers. They don't just expire
• 5:33
  after three years. Right. They do not expire.
• 5:36
  Yeah. The hacker now holds a master key to your
• 5:39
  identity that works today, and it will still
• 5:42
  work a decade from now. And then the second harm
• 5:44
  is the diary aspect we talked about. Yes, the
• 5:47
  psychological violation. I mean, think about
• 5:49
  it. A consultation note isn't just a record of
• 5:51
  a flu shot. Right. It's everything. It contains
• 5:53
  details about mental health struggles, maybe
• 5:56
  severe family trauma or complex fertility issues.
• 6:00
  Stuff you haven't even told your best friends.
• 6:02
  Exactly. Exposing that goes far beyond financial
• 6:04
  fraud. It is weaponized humiliation and just
• 6:08
  a profound loss of privacy. Yeah, that's just
• 6:11
  devastating. Which is why crown jewel data requires
• 6:13
  crown jewel protection. It is absolutely not
• 6:16
  enough to just slap a password on a database
• 6:18
  and call it a day. So what does crown jewel protection
• 6:21
  actually look like in practice for a medical
• 6:24
  network of this size? It requires deep structural
• 6:28
  defenses. We are talking about rigorous encryption.
• 6:32
  Making it unreadable. Right. But not just when
• 6:35
  the data is being sent over the Internet. I mean
• 6:38
  encryption at rest. What does that mean, at rest?
• 6:41
  It means if a hacker manages to download the
• 6:44
  actual database file, it just looks like absolute
• 6:46
  gibberish without the decryption key. Ah, okay.
• 6:49
  So it's useless to them even if they steal it.
• 6:52
  Exactly. It also requires incredibly tight access
• 6:54
  controls. So a receptionist at one clinic in,
• 6:58
  say, Sydney, cannot magically access the pathology
• 7:01
  results of a patient at a completely different
• 7:04
  clinic in Perth. Which makes sense. They shouldn't
• 7:06
  need to. Right. And critically, it requires honest
• 7:08
  retention policies. Meaning how long they keep
• 7:11
  the data. Yeah. If a clinic does not have a strict
• 7:13
  medical or legal need to hold a decade -old record,
• 7:16
  they should delete it. Yeah. Why are they holding
• 7:18
  on to something from 2014? Exactly. It's just
• 7:20
  a liability at that point. And that is a lesson
• 7:23
  that extends way beyond just the doctor's office.
• 7:26
  I mean, if you run a local gym and you have new
• 7:29
  members fill out medical intake forms or, you
• 7:32
  know, if you're an employer collecting pre -employment
• 7:34
  medical screens, you are holding health data.
• 7:37
  Yes, you are. You are holding crown jewel. You
• 7:40
  absolutely are. And the moment those jewels are
• 7:42
  compromised, the clock starts ticking on how
• 7:45
  you handle the fallout. Which brings us to the
• 7:47
  timeline. Because the nature of this incredibly
• 7:50
  sensitive data really dictates the urgency of
• 7:52
  the response. It does. And the timeline in the
• 7:55
  Kensoft report is something we really need to
• 7:57
  dig into here. The initial intrusion into partnered
• 8:00
  health systems was detected on June 23rd. Right.
• 8:03
  However. The public disclosure, along with the
• 8:07
  direct SMS and email notifications that were
• 8:09
  sent to the patients, did not happen until around
• 8:11
  July 15th and 16th. Yeah, so that creates a 22
• 8:14
  -day gap. A 22 -day gap. Between the company
• 8:17
  realizing they had a major problem and the patients
• 8:20
  actually finding out their data was at risk.
• 8:22
  Wait, 22 days. If my most private medical notes
• 8:26
  and my Medicare number are floating around the
• 8:28
  dark web, I mean every single hour counts. Oh,
• 8:31
  people were furious. I can't help but look at
• 8:33
  a three -week delay and wonder if that is just
• 8:35
  corporate foot dragging. Like, are they just
• 8:38
  sitting in boardrooms trying to manage PR and
• 8:41
  get their spin right? That's usually the first
• 8:43
  thought people have, yeah. Or is there an actual
• 8:45
  legitimate technical reason it takes almost a
• 8:48
  month to send a text message to the people who
• 8:50
  are in danger? Look, it is a very natural reaction
• 8:53
  to view that gap with deep suspicion. Totally
• 8:57
  get it. But to understand the delay, we have
• 9:00
  to look at the actual mechanics of a forensic
• 9:03
  cyber investigation. Okay, walk me through it.
• 9:05
  When a breach is detected on June 23rd, The company
• 9:08
  isn't just sitting around writing press releases.
• 9:10
  They have to bring in digital forensic investigators
• 9:12
  to parse through literally terabytes of server
• 9:16
  logs. Trying to find the digital footprints.
• 9:18
  Right. They have to figure out if the hackers
• 9:20
  just looked at the data or if they actually exfiltrated,
• 9:23
  meaning they downloaded the data. Because looking
• 9:25
  at it and downloading it are two very different
• 9:27
  legal problems. Exactly. So they are trying to
• 9:30
  figure out the actual blast radius before they
• 9:32
  pull the fire alarm. That's the piece that takes
• 9:35
  time. During those 22 days, Partnered Health
• 9:38
  also formally reported the breach to the privacy
• 9:40
  regulator, the OAIC. Okay, so they were talking
• 9:44
  to the government. Yes. They brought in the Australian
• 9:46
  Cybersecurity Centre, law enforcement, and crucially,
• 9:50
  they had to notify Services Australia. Why Services
• 9:54
  Australia? That final step is vital so that the
• 9:58
  compromised Medicare card numbers can be flagged
• 10:01
  and actively monitored for fraud at a federal
• 10:03
  level. Ah. Okay, I understand they are coordinating
• 10:06
  with the authorities, which is good. But why
• 10:09
  not tell the patients immediately? It's tricky.
• 10:11
  Like, let the people inside the burning building
• 10:13
  know there is a fire, even if you don't know
• 10:15
  which specific rooms are burning yet. It sounds
• 10:18
  like the right thing to do, but because we're
• 10:19
  in the cybersecurity world, telling patients
• 10:22
  too early often causes more harm than good. Really?
• 10:25
  How so? Think about it. If you send a panic text
• 10:28
  on day two saying, hey... We have been hacked.
• 10:31
  Your data might be stolen. People will freak
• 10:34
  out. Thousands of patients will immediately call
• 10:36
  the clinics, jam the phone lines, and ask, was
• 10:39
  my specific pathology report taken? And the clinic
• 10:42
  won't know. Right. If the clinic cannot answer
• 10:44
  that question because the forensic log analysis
• 10:46
  isn't finished yet, you've just created mass
• 10:49
  panic without providing any actionable solution.
• 10:52
  Oh, I see. So you are saying a 22 -day turnaround
• 10:55
  is actually reasonable? Well, in the current
• 10:59
  landscape, 22 days from detection to notification
• 11:02
  is considered middle of the road. Middle of the
• 11:03
  road, okay. Yeah. It is significantly faster
• 11:06
  than the multi -month gaps we've seen in other
• 11:08
  major corporate breaches. Oh, yeah. Some take
• 11:10
  half a year. Right. Though it is still slower
• 11:12
  than the absolute gold standard of best practice.
• 11:15
  But your frustration is completely valid because
• 11:18
  every day of delay is a day that patients cannot
• 11:21
  put a freeze on their credit or, you know, watch
• 11:23
  out for targeted scams. Which means the real
• 11:26
  lesson here for any business is that you cannot
• 11:28
  wait for the breach to figure out how to communicate.
• 11:31
  That is the crucial takeaway. Companies need
• 11:34
  a fully baked notification playbook built well
• 11:37
  in advance. Like a fire drill. Exactly. Before
• 11:40
  a crisis ever hits, you need to know exactly
• 11:43
  who has the authority to draft the message. what
• 11:47
  channels you're going to use, like SMS, email,
• 11:50
  website banners, and what you are legally and
• 11:52
  ethically prepared to say on day one, day seven,
• 11:55
  and day 20. So when the clock starts ticking,
• 11:58
  you're just executing a highly rehearsed plan,
• 12:00
  not improvising in a state of panic. Exactly.
• 12:03
  And that forensic timeline and the massive scale
• 12:06
  of the investigation required actually reveals
• 12:08
  the structural flaw that caused this whole mess
• 12:11
  to begin with. It really does. Here's where it
• 12:13
  gets really interesting, because we have to talk
• 12:14
  about the mechanics of Data aggregation. The
• 12:17
  concentration problem. This is arguably the most
• 12:20
  systemic issue in modern IT architecture today.
• 12:23
  Right, because patients thought they were trusting
• 12:25
  their little local clinic down the street. The
• 12:27
  one with the outdated magazines? Exactly. But
• 12:29
  the breach didn't happen at the clinic on the
• 12:31
  corner. It happened at the giant network operator
• 12:33
  behind it. One single break -in compromised up
• 12:37
  to 21 different clinics. It's massive. I mean,
• 12:40
  imagine you think your money is locked inside
• 12:42
  a thick steel vault at your secure... small town
• 12:45
  bank. Sounds safe. Right. But what you don't
• 12:48
  know is that every single night, the bank secretly
• 12:51
  ships everyone's cash To a giant centralized
• 12:55
  warehouse out in the desert where 60 other banks
• 12:59
  also keep their money. And that giant warehouse
• 13:01
  only has one padlock on the front door. Yes.
• 13:04
  The convenience of putting everything in one
• 13:06
  shared platform creates this massive glowing
• 13:09
  bullseye for criminals. It really does. And if
• 13:12
  we connect this to the bigger picture, you are
• 13:14
  describing the vulnerability of cloud migration
• 13:16
  and shared infrastructure. Right. When a parent
• 13:19
  company like Partner Health acquires a local
• 13:20
  clinic, they rarely leave that clinic. independent,
• 13:23
  isolated IT system in place. They want it all
• 13:26
  integrated. Exactly. They migrate all that patient
• 13:29
  data into a centralized shared cloud tenant or
• 13:32
  a unified active directory. So all the local
• 13:35
  clinics are suddenly just swimming in the same
• 13:37
  digital pool. Yes. And that creates a vulnerability
• 13:40
  known as lateral movement. It's a lateral movement.
• 13:43
  Right. So if a hacker successfully fishes a receptionist's
• 13:46
  password at a single clinic in Perth, they don't
• 13:50
  just get the Perth data. They can move sideways?
• 13:52
  They can use those credentials to move laterally
• 13:55
  through the centralized corporate network and
• 13:57
  access database tables for clinics in Sydney
• 13:59
  or Brisbane. Wow. From a hacker's perspective,
• 14:03
  why even bother trying to pick the digital locks
• 14:06
  of 21 individual clinics when you can just breach
• 14:09
  the parent company's shared infrastructure once
• 14:12
  and get all of it? Exactly. It's an economy of
• 14:14
  scale for the bad guys. That's terrifying. And
• 14:17
  it poses critical questions that any business
• 14:19
  owner, practice manager, or really any consumer
• 14:22
  needs to ask. Absolutely. If you are handing
• 14:25
  your data up the chain to a group platform, you
• 14:27
  must ask who actually holds our data right now.
• 14:31
  Where does it physically live? Right. How exactly
• 14:33
  is it secured at that centralized warehouse level?
• 14:37
  And tying it back to our timeline discussion,
• 14:40
  how fast will they actually tell us if that central
• 14:43
  warehouse gets breached? Because once that central
• 14:46
  warehouse is breached, the data cannot be unstolen.
• 14:50
  the company is backed into a very, very difficult
• 14:53
  corner. Which perfectly explains how Partnered
• 14:55
  Health actually responded to the criminals in
• 14:58
  this case. Because the data was out, they couldn't
• 15:00
  put the genie back in the bottle, which led them
• 15:03
  to deploy the most unusual aspect of this entire
• 15:05
  story. Oh yeah, the legal response. The legal
• 15:08
  counterattack. It is a fascinating strategic
• 15:10
  pivot. Truly. So to set the scene, Partnered
• 15:13
  Health has refused to confirm or deny if a ransom
• 15:16
  demand was ever made by the hackers. Which is
• 15:19
  pretty standard. Right. Furthermore, no criminal
• 15:21
  group has publicly stepped forward on the dark
• 15:23
  web to claim the attack. And as of the initial
• 15:26
  reporting, none of the stolen data has appeared
• 15:28
  on dark web leak sites. So it's just this tense
• 15:31
  standoff. A very tense standoff. And in the middle
• 15:34
  of this standoff, Partnered Health goes to the
• 15:38
  New South Wales Supreme Court and obtains an
• 15:40
  interim injunction. Right. Essentially, they
• 15:43
  got a civil court order that legally prohibits
• 15:45
  anyone from using, publishing or disseminating
• 15:48
  the stolen data. Yes. And now I have to challenge
• 15:51
  this. OK. A court order against a cyber criminal.
• 15:55
  I know what it sounds. That sounds like putting
• 15:57
  up a no trespassing sign to stop a category five
• 15:59
  hurricane. It really does. I mean, are we really
• 16:02
  supposed to believe that an offshore hacker sitting
• 16:05
  in a basement halfway across the world who has
• 16:07
  already broken multiple federal laws to steal
• 16:10
  this data is going to look at an Australian civil
• 16:12
  court document and say, oh, well, the New South
• 16:15
  Wales Supreme Court says I shouldn't publish
• 16:17
  this. I better hit delete. No, it sounds completely
• 16:19
  absurd on its face. Yeah. Your skepticism is
• 16:22
  entirely justified here because. A local court
• 16:25
  injunction is absolutely not going to deter the
• 16:28
  actual thief. Right. If they are offshore and
• 16:31
  operating outside the bounds of international
• 16:32
  law, a Supreme Court order is meaningless to
• 16:36
  them. Then why spend the massive amount of money
• 16:38
  on corporate lawyers to file for it? Because
• 16:41
  the injunction isn't actually aimed at the hacker.
• 16:44
  Oh. It is a strategic mechanism aimed at the
• 16:47
  secondary market. We have seen this tactic used
• 16:50
  recently in Australia during the HWL, Ebsworth,
• 16:53
  and Medibank breaches. Okay. You shouldn't think
• 16:56
  of the injunction as a lock on the stolen goods.
• 16:59
  You should think of it as a legal fence around
• 17:01
  the blast radius. A legal fence around the blast
• 17:03
  radius. Okay, break down the mechanics of how
• 17:05
  that actually works. Well, when health data is
• 17:07
  leaked, it doesn't just stay with the original
• 17:09
  hacker. A whole ecosystem of secondary actors
• 17:12
  springs into action. Who else gets involved?
• 17:15
  Data brokers download it to slice it up and sell
• 17:18
  it. Local scammers access it to build highly
• 17:20
  targeted phishing attacks. Even local journalists
• 17:23
  might download it to report on the specific contents
• 17:25
  of the leak. Right, because it's newsworthy.
• 17:27
  Exactly. Yeah. But by getting a Supreme Court
• 17:30
  injunction, partnered health gains immediate,
• 17:33
  severe legal leverage against anyone within the
• 17:37
  reach of Australian law. Ah, I see. So if an
• 17:39
  Australian internet service provider, a local
• 17:42
  tech hosting company, or even a social media
• 17:45
  platform sees this data being shared on their
• 17:47
  network, partnered health doesn't just have to
• 17:50
  politely ask them to take it down based on general
• 17:52
  privacy guidelines? Exactly the opposite of a
• 17:55
  polite request. They could say, if you host or
• 17:58
  share this data, you are in direct contempt of
• 18:01
  a Supreme Court injunction. Which carries immediate,
• 18:03
  severe legal and financial penalties. Huge penalties.
• 18:08
  It forces local tech infrastructure to aggressively
• 18:11
  scrub the data, limiting its spread locally.
• 18:13
  It effectively shuts down the secondary market
• 18:16
  within the country. Wow. It also seems like a
• 18:18
  very strategic move for corporate optics. Oh,
• 18:21
  absolutely. It is a powerful signal to regulators
• 18:24
  like the OAIC. and to future courts, proving
• 18:27
  that the company did not just throw their hands
• 18:29
  up in defeat. They fought back. They took aggressive,
• 18:32
  proactive, and very expensive steps to contain
• 18:35
  the harm to their patients. It is legally brilliant,
• 18:37
  even if it does nothing to stop the initial offshore
• 18:40
  hacker. So what does this all mean for you, the
• 18:43
  person listening right now? Yeah, that's the
• 18:45
  big question. We have covered the massive corporate
• 18:48
  structures, the forensic timelines, the lateral
• 18:51
  movement in cloud networks and this fascinating
• 18:53
  legal fencing. But let's bring it back down to
• 18:56
  the ground. Translate this into direct, actionable
• 18:59
  advice for the learner. If you have been to one
• 19:02
  of these clinics or honestly, if you are ever
• 19:05
  caught up in any health data breach. What do
• 19:08
  you actually do to protect yourself? The most
• 19:10
  immediate practical threat you face is targeted
• 19:13
  manipulation. Scams? Yes. Criminals use the specific
• 19:18
  details in these breaches to build customized
• 19:20
  scripts. They will call you. or text you, and
• 19:24
  they won't just use a generic greeting. They
• 19:25
  won't just say, dear sir or madam. Right. They'll
• 19:28
  say, hi, I am calling from the partnered health
• 19:30
  clinic on Main Street. Dr. Smith asked me to
• 19:33
  call you regarding your recent blood test on
• 19:35
  June 12th. We just need to verify a small billing
• 19:38
  detail. Wow. Because they have that clinical
• 19:41
  layer of data, they know your doctor's name,
• 19:43
  they know the exact date of your test. It bypasses
• 19:45
  all your normal spam filters because it sounds
• 19:47
  incredibly convincing. It preys on your trust
• 19:50
  in your medical provider. Exactly. So the takeaway
• 19:53
  is that just because a caller knows intimate
• 19:55
  details about your health history does not mean
• 19:58
  they're actually calling from your clinic. You
• 20:00
  have to maintain a state of high alert. Never
• 20:03
  click on links and text messages or emails claiming
• 20:06
  to be from your clinic regarding a breach, a
• 20:08
  test result, or an overdue invoice. Never. If
• 20:12
  you are even slightly concerned, hang up the
• 20:15
  phone, look up the clinic's phone number independently
• 20:17
  on their official website, and call them directly
• 20:19
  to verify. And regarding the identity theft side
• 20:22
  of things, since they have permanent identifiers
• 20:25
  like dates of birth and Medicare numbers. If
• 20:28
  your data is caught up in a breach of this magnitude,
• 20:30
  you should strongly consider putting a temporary
• 20:32
  ban on your credit report. It's a freeze, right?
• 20:35
  Yeah, it's a free service provided by credit
• 20:37
  reporting agencies. It stops anyone from opening
• 20:39
  new credit cards or taking out. loans in your
• 20:41
  name. Okay, good to know. It is a highly effective
• 20:44
  way to freeze the financial utility of your stolen
• 20:46
  identity while the dust settles. It is deeply
• 20:49
  frustrating that consumers have to play this
• 20:51
  level of defense, but it is the reality of the
• 20:54
  digital age. Unfortunately, yes. And for context,
• 20:57
  a lot of the deep analysis of the systemic IT
• 20:59
  issues we discussed today, the security gaps,
• 21:02
  the lateral movement, the notification readiness
• 21:05
  comes from the experts who study these corporate
• 21:07
  vulnerabilities. The folks at Kinsoft. Right.
• 21:10
  If this deep dive has left you as a business
• 21:12
  owner or practice manager wondering about your
• 21:15
  own IT architecture, you can consult the authors
• 21:17
  of the Their core message to businesses is simple.
• 21:26
  Stay patched. And stay skeptical. Stay patched
• 21:30
  and stay skeptical. That is excellent advice.
• 21:32
  The entire landscape is about proactive structural
• 21:34
  defense rather than relying on reactive panic
• 21:37
  when the logs show an intrusion. It has to be.
• 21:39
  Well, we have covered a massive amount of ground
• 21:41
  today from the comforting illusion of the local
• 21:43
  clinic to the complexities of Supreme Court injunctions
• 21:47
  against global hackers. We certainly have. And
• 21:50
  as we wrap up. Examining a case study like this
• 21:53
  raises an important question, one that goes a
• 21:55
  bit beyond just this specific partnered health
• 21:58
  breach. Oh. It's something for you to mull over
• 22:00
  as you go about your week. All right. Give us
• 22:02
  something to think about. We talked earlier about
• 22:04
  how medical data, your DNA, your specific medical
• 22:09
  history, your date of birth is permanent. It
• 22:13
  does not change like a leaked password. Right.
• 22:15
  But if our unchangeable biological realities
• 22:18
  are now continually being breached from centralized
• 22:22
  corporate warehouses. Which they are. If they're
• 22:25
  becoming permanent digital commodities floating
• 22:27
  out there in the ether, traded by data brokers
• 22:30
  on secondary markets. Yeah. Will society eventually
• 22:32
  have to completely abandon the idea of using
• 22:35
  secret personal data to verify who we are? Oh,
• 22:39
  wow. I mean, if your mother's maiden name, your
• 22:41
  date of birth, and your medical history are essentially
• 22:44
  public knowledge to anyone who knows where to
• 22:46
  look, how do we fundamentally prove we are who
• 22:49
  we say we are tomorrow? Wow. That is a terrifyingly
• 22:52
  good point. The master keys to our identity simply
• 22:55
  aren't secret anymore. We are eventually going
• 22:58
  to need an entirely new system for trust. Just
• 23:01
  something to keep in mind the next time a bank
• 23:03
  or a clinic asks you to verify your date of birth
• 23:07
  over the phone. To prove your identity. Indeed.
• 23:10
  Well, on that slightly existential note, we are
• 23:12
  going to leave it there for today. Thank you
• 23:14
  for joining us on this deep dive. Stay vigilant,
• 23:17
  stay curious, and we will catch you next time.
• 23:20
  Until next time, take care.