![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-132700-100x100.png\")
I can't wait to see this dude's mug shot when they catch him within 2 days.
I can't wait to see this dude's mug shot when they catch him within 2 days.
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-254112-100x100.png\")
how much spam do you think we can have sent to hackingforprofit@yahoo.com in 7 days?
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-543146-100x100.png\")
@Corporate_guy: Gmail would. Yahoo? Not so much. Trust me, it wouldn't take long before the box would be almost unusable. His response from VA would be a needle in a haystack, unless they've added a search functionality recently.
![\"user-pic\"](\"/css/images/default.gif\")
@RecordStoreToughGuy: Yahoo's spam filter has gotten a lot better over the past year(for me anyway). But, when I first started getting spam I reported it all and it began catching it pretty quick. The last time I got a spam e-mail in my main mail box was about six months ago, and that was the first one in about a year.
@MightyDwarf56: Interesting. I haven't used Yahoo in a couple of years. When I was scambaiting, the catcher accounts would fill up so fast they'd be unusable. Of course, they'd be mostly opening letters, which are technically spam, but most scammers send them manually via BCC, so the filters might not catch on as quickly. Still worth a shot.-
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-905801-100x100.png\")
It's gotten better but it's nowhere near the level of GMails. My guess is we could flood his box within a single day so badly that he'd be forced to shut down his, now infamous, email.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-730546-100x100.png\")
@RecordStoreToughGuy: They have a search function. They're still sucky.
And how hard would it be to catch this guy? How many 13 year olds are out there selling 8 million patient records to the highest bidder?
@wickedpixel: Oh... lots. Google search the term \"mugu,\" go to any and all websites that come up with that term listed somewhere in a guestbook, and leave that address. He'll be drowning in 419 opening letters and phishing spam before long.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-103994-100x100.png\")
As a network administrator, if the state does not have a backup OFF SITE, or at least not accessible from the same place as the main site - then they need to fire their computer guy (well possible fire for the hack in the first place.... but that is more debatable.)
@coan_net: Hey, they probably learned their lesson about offsite backups from Ohio. Made international news a year ago. if you don't have an intern's car for offsite storage, you just hafta leave it on the server...
@coan_net: They won't fire him. Actually, Barack Obama has tapped him as the new CTO for the United States.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-95807-100x100.png\")
@Corporate_guy: At this point all we have is a boast that he deleted \"the backup\".
If this place has any sense, that wasn't the only one.
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-91598-100x100.png\")
@j-o-h-n: True enough. If someone stole your car and claims they threw all your spare keys into the river, would you believe them? Or would you pull a spare key out of your own wallet and wonder what he's babbling about.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-16563-100x100.png\")
@coan_net: If he doesn't, first pass a law stating he can't change his name, social or credit card numbers for ten years. Then post all his particulars on the site, begging for ID thieves to take the data and have a field day.
THEN fire him.
And three people above, and below him.
Yeah it is hard to believe that someone could hack all of these files, and delete all of the backups. Most if not all State and local agencies with a half-brained CIO, would have two hard-site backups off site of the actual infrastructurewhere the files were held on storage.
Either this hacker is a whizkid or a total idiot.
Awesome. I will send him an email offering him $5 to be able to punch him in the face. He can consider it practice for the beating he's going to get just before he gets raped in prison.
@key2616: Awesome. I will send him an email offering him $5 to be able to punch him in the face. He can consider it practice for the beating he's going to get just before he gets raped in prison.
Nice! LOL!
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-499790-100x100.png\")
umm... can't they track emails such as Yahoo accounts?
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-384699-100x100.png\")
@UrIt: nothing you but on a yahoo profile has to be verifioed and any IP logged is likely through aa nest of proxies and TOR servers. It isn't impossible but they'd have better luck putting money in teh account and then tracking the money.
I hope they use Paypal to transact the ransom. That way, NO one gets what they want!
this is why I hate when hospitals ask for DL info and SS#
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-887707-100x100.png\")
@rockergal: Don't give it to them. Now you have even more reason. Carry a copy of this article with you if someone questions why. Don't give them CC or bank account numbers, either.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-248249-100x100.png\")
@rockergal: Key word: ASK. You don't have to give.
I've never seen a scalpel, heart monitor, or prescription that prompts you for your SSN before continuing like a Windows product key.
@rockergal: This is why I never provide it. So far five years later nobody has demanded I provide it. I just leave it blank on the forms.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-87183-100x100.png\")
Well, it appears his Yahoo! e-mail account is locked out anyhow for about 24 hours. I wonder what sort of super-genius hacker uses a Yahoo account.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-963707-100x100.png\")
@citking: Someone who doesn't want to be tracked by whatever client they use, and therefore uses a crappy standard email client that jillions of non-computer-savvy people use instead of a powerful one like Gmail that's probably a couple levels of magnitude more advanced than this hacker or a client attached to his own website.
(Convoluted grammar! I'm sorry.)
Behold! The first offender in the upcoming country-wide clusterf*** that will be computerized medical records.
Everyone who advocates for those records needs to remember that stupid people will administer them. This means no offsite backups, passwords that are 1-2-3-4, machines left out and stolen...
@Bathmat: Given what a total and utter clusterfuck paper medical records have been in my experience (I've lived in three states in the last six years, under four different sets of insurance coverage including \"none at all\"), computerizing it really couldn't make it any worse. And at least there's not anything of dire importance in mine. My mom's had her life on the line more than once because Doctor A and Doctor Y with offices in the same damn hospital didn't have access to the same records.
@Etoiles: There are certain problems that computerized medical records would solve, in theory. This includes the problem of coordinating patient care among several different departments, hospitals, and so on.
I can tell you at least one thing your medical record contains: your SSN number. The threat here is not that someone will learn that you were in for colon surgery last Tuesday when you said you were bowling. The threat here is that your name, address, SSN, etc. will be sold to a 3rd party, who will then commit credit fraud using your personal information.
This cannot happen on a large scale without computerized medical records. Someone strolling into a medical practice will have a lot less luck stealing IDs from the paper records than someone hacking into a database.
@Bathmat: Which is absolutely true, but there are already a lot of places out there where a determined person could steal my name, address, and SSN. (DMV databases. Student loan lenders. Probably even my cell phone company. And so on.) It's not that I perceive it as zero-risk; rather, the net gain (the third doctor to walk in the room will KNOW that mom's allergic to penicillin, or a doctor in VA will be able to see what a doctor in MA did about the cartilage in my knee) will be worth the small additional risk of having Yet Another Database out there that could potentially be compromised.
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-563505-100x100.png\")
@Etoiles:
Where I work, I manage medical records - both paper and now electronic - and you're absolutely correct. It's amazing how many paper charts get lost on a regular basis.
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-793795-100x100.png\")
@grumpygirl:Happened to my wife last month they still have not found it. She just walked out when they handed her another stack of paperwork to fill out. On the 1st page ssn info she tolg them they allready lost the info once why would she trust them with it again.
@Bathmat: \"Behold! The first offender in the upcoming country-wide clusterf*** that will be computerized medical records.\"
It would have been impossible for me to say it better myself.
Now, imagine all that, plus proprietary non-inter-compatible file formats.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-925161-100x100.png\")
@Bathmat: The world would be a much better place if people would stop using the combination on my luggage.
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-186584-100x100.png\")
By his concise grasp of the English language, he's clearly not Nigerian royalty. If he was able to get into their system, there has to be a way for them to track where their records were accessed from. There's no way he'd be stupid enough to do this inside the US. I'd say he's American and hiding outside the country.
@kunai: I'd say he's more likely some 16 year old kid thats quite skilled with computers, but have shit for common sense and no grasp of the world around him.
@kunai: They generally connect from another compromised PC, or even a series of them, which can dead-end the trail. Compromised PCs are all too easy to come by.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-343837-100x100.png\")
They should send him a cashiers check for $15mil, have him deposit it and send the extra $5mil back.
If they are really so retarded that he was able to delete their only backup he should be pardoned, and given the $10M as a reward. Seriously - no way. They have backup. One thing the govt. CAN do well is write and follow procedure documents.
@joeblevins: It is possible they have never actually restored the backup before. It happens a lot.
I'm not an IT expert - what does \"restored the backup\" mean? Are you saying that it is really a possibility that they don't have some kind of a daily backup stored in a safe somewhere? These guys probably have a 50 page procedure document just for backups, and another one for disaster recovery. Unless someone just chose not to do their job for a few months I don't see how this could happen.
@1234tu: I implemented backup security procedures for a company that processed financial data for other companies many years ago. We're talking early 1990's, and this stuff was encrypted with 3 separate keys that even I never had access to even one of. Yet, part of the procedure I specified included restore exercises conducted every 6 months just to be sure the data was written correctly and readable. Many businesses have done backups only to find that tapes were not actually written properly, or had physically become unreadable, or in the case of encrypted data, keys mishandled in such a way the data could not be decrypted.
@Skaperen: \"How secure is it? Perfectly secure! In fact, it's so secure, even we can't read it, and we made the backup tapes in the first place!\"
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-357799-100x100.png\")
@1234tu: I think he means that they've never had to use their backup before. Often, folks don't discover that their backup system doesn't actually work until it is too late (i.e., the first time they really need it).
@ParanoidGeek: When our exchange server crashed last week we lost about half of our emails from our \"good backup\" Note to self never again trust a back up and check all user for cache mode. Note to bosses we need new servers and upgrades.
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-267279-100x100.png\")
@ParanoidGeek: Most state agencies have mandatory disaster recovery drills where the go 'offline' for a weekend and actually restore the backup.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-958230-100x100.png\")
Can't they do an IP trace like on tv to catch him?
@masterasia: Afterwards they can blow up surveillance video to 800 times its size and it will be a crystal-clear picture of the suspect's license plate!
@b.k.: Actually, a significant amount of that is possible using subpixel motion-to-spatial interpolation between frames. It requires a LOT of frames to do it, though, so it's no good if the plate is in just a few frames. OTOH, if the vehicle is in motion through a few frames, there is a good bit of information that can be had.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-387281-100x100.png\")
Spoiler:: The password is HIPAA
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-72586-100x100.png\")
I'd like to offer him $100 for all the data. If there are no higher bidders, I'll buy it and sell to Virginia for $10,000. I'm not greedy: I'll get enough for a new used car, and Virginia saves so much money they'd build me a statue and name a day of the week after me.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-358777-100x100.png\")
How does anyone in today's day and age expect to get away with this? Technology will catch you!
Given the relative ease and inexpensive nature of securing networks, I am constantly surprised by the number of organizations (particularly universities) that are caught with their proverbial pants down.
Disclaimer: I'm an IT security professional (insert witty \"don't try this at home\" line here!)
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-6173-100x100.png\")
I hope he enjoys federal PMITA prison.
@Eyebrows McGee (on Twitter: LPetelle):
Wow...two Office Space references in one day (see: magazine subscription story comments)...this is a GOOD day, indeed.
It would have been double-win if the hacker had demanded a stapler in his ransom note.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-226755-100x100.png\")
I'm not sure who's dumber. The hacker or the state of Virginia.
@Sheogorath: Now, I don't reside in a hacker, but I do live in The Commonwealth of Virginia. As one of the names on that database, I feel qualified to say door number two. It's a close match, because making this a matter of face means that the authorities that be are going to try harder. He's blown his chances for a concession. The only currency he's going to be dealing with is cigarettes in exchange for his body.
Thats like a $1.20 per patient! What a bargain.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-159466-100x100.png\")
So.. how is he going to accept payment for the 10 million? There is obviously no way this will be successful. He says himself that he has no idea what the data is worth, but that he could probably get a buyer for it. Where? eBay? You don't know how much it's worth but have the ability to line up buyers interested in so much data? You're so going to get busted in some crazy sting operation with that line of thinking.
There are all sorts of shadowy places where identity thieves and major ID theft rings hang out. It would be very easy for the guy, if he knows where to look, to find someone, and most likely someone that another person he knows can vouch for, that would gladly pay big bucks for reliable data that includes DL and SSN. In spite of anti--money-laundering laws, there are still many ways to move and launder funds to make them nearly impossible to trace.
He could actually pull it off... but he's got balls of steel for having the willingness to go up against this sort of opponent, sorta like the kid that broke into Sarah Palin's Yahoo account... except this guy seems, for now, to be at least a little smarter :)
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-433532-100x100.png\")
@trujunglist: Tell the person to set up a UBS account in Switzerland then send the person the money - I don't think the hacker will figure out what's going to happen. The US gov't will have the money back within 7 days.
Seriously, even with an 'anonymous' Yahoo mail account, do they really think they can't figure out who he is? Subpoena Yahoo, subpoena the ISP that matches the IP who opened the account, viola!
One thing the article failed to mention is that our wonderful Secretary of Technology here in Virginia, Aneesh Chopra, has been tapped by the Big O as our nation's new Chief Technology Officer.
I think they need to get Jack Bauer and that chick Chloe he works with on the case. They can do anything with computers, even make lemonade and grind sausage.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-70159-100x100.png\")
But Is his shit secure.
Sorry first thing to come to mind after reading I have your shit.
What is wrong with our legal system ... is that it is possible to merely use information like this to acquire debts in the name of the victim ... information lots of people can get access to ... information that presents no form of authorization whatsoever. It's a problem system that allows mere identity to be interpreted as authorization.
acctually,he should be in the world book of records for a terriost with the most hostiges,he has over 8 million .The sad thing is that the ransom will come from the general public in the form of more taxes.Myself,I think when he is caught,and I think he will be, he should be hung by the neck till dead as an example to others who might try such a thing.Why should we have to pay for a criminal's room and board for life,and that goes for any crook with a life sentence.
\"kill em all\" and save the money.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-107016-100x100.png\")
They could just trace the money and get the account records. Whatever bank receives an influx of 10 million from an obviously shady transaction will (if they aint the Swiss) alert the proper authorities. Considering the dialect of hackanese, he's probably from a thoroughly westernized nation, so banking transactions should be easily traceable.
Hackers may be smart, but all it takes is a small mistake to get caught big time.
It appears to be running Windows server, the choice of know-nothing lackeys. I don't want to sound like an ass, but if somebody finds Unix too difficult, they're also going to find security concepts too difficult as well. Putting a server on the public internet, especially when it contains confidential data, is no job for a business major.
@chris_d: Nha. It's not that. Unless they decide to somehow use Windows 9x instead of Server NT based Windows.
They are just incompetents that don't know how to setup a server. They probably install Windows server, and went, \"ok it's all done\", without any configuration. And who puts a backup online either-way? this should be a big sign on how they know nothing about servers.
My guess is that instead of contracting a firm that handle server configuration with trained competent employees, they probably put newspaper ads to hire some IT's at low wage, to save a few dollars and take advantage of corrupt system (probably pocket the difference).
I'll give you odds this hacker is operating from within Virginia.
@usa_gatekeeper: I'll see your bet. Virginia's got the evil eye out and about. Ever since our DMVs furnished IDs for those fine, upstanding gentlemen who flew planes into buildings, we're under just a wee bit more scrutiny, I hear tell.
Odds are that data is on the market allready. He can collect from other crooks but not from a state gov.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-25340-100x100.png\")
Good luck getting $10 million out of Virginia. We've basically had a spending freeze for 5 years. Virginia doesn't have much money. He can keep my prescription info.
what a fucking idiot. Thanks for disclosing the email address you use. As if The state cant get Yahoo to disclose where that mailbox is accessed from.
What a dumb tool he is.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-219008-100x100.png\")
If they pay, they are fools.
After seeing the stupidity of VA government and the even greater ignorance of the general population accepting the answers I have no hope that we will survive an actual problem.
City of Richmond hires 'trained employees' who came from 6 month 'career colleges' (see ITT, Beta Tech 'centura college' and ECPI).. They have gotten what they paid for: People whose main server experience involved food.
I interviews for a job at city hall in Richmond during the 'interview\" an interviewer told me what I was CURRENTLY doing at my job was not possible. I sat in a 12 person interview explaining freaking imaging software to their IT staff!! The guy swore that it wasnt possible to image unlike machines to USB devices. He used the 'raising my voice' makes me right technique. I guess sysprep and acronis are 'fictional technology'... Jackasses.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-62173-100x100.png\")
At least we know one thing about this crook: He's a fan of the Coen Brothers. \"We have your sh!t!\"
That's pretty funny, i think.
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-125641-100x100.png\")
If this does anything at all to encourage states, companies, etc., to keep their data secure, that'd be a very good thing. VA should think of this as a very expensive lesson in why they should keep personal data secure. Yes, the hacker broke the law and should be punished, but data-keepers need to realize that laws alone will not protect their data.
Good thing we put all this time, money and technology into protecting intellectual properties instead of protecting people's personal information.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-68720-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-858304-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-562864-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-114567-100x100.png\")
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-6536-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-264335-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-11093-100x100.png\")
Just what we need: more fuel to try hackers as domestic terrorists.
@octopede: Forget the hands.
This piece of slime has demonstrated that he no longer deserves to co-exist on this rock. Go for the head.
You can't fix someone that broken. When you release him he'll be just as worthless.
@octopede: First this person hopefully does not live in the U.S. and will not be arrestable or catchable. Second, if you go nuts with hacker related law the people who find security holes in websites and report the holes will be wrongfully prosecuted as hackers. I would rather see a few hackers go free rather than see innocent people charged as terrorists.