The U.S. Department of Veterans Affairs (VA) Office of Management announced a data breach involving the personal information of approximately 46,000 Veterans and actions taken by the department to prevent and mitigate any potential harm to those individuals.
The Financial Services Center (FSC) determined one of its online applications was accessed by unauthorized users to divert payments to community health care providers for the medical treatment of Veterans. The FSC took the application offline and reported the breach to VA’s Privacy Office. A preliminary review indicates these unauthorized users gained access to the application to change financial information and divert payments from VA by using social engineering techniques and exploiting authentication protocols.
Brandon Hoffman, Chief Information Security Officer at Netenrich, a San Jose, Calif.-based provider of IT, cloud, and cybersecurity operations and services, says, “The federal government has a bigger responsibility to protect the systems they use to transact their business because the potential for damage is much higher. In the past, federal government systems breaches have led to significant damage. In this case, the VA serves part of America that really doesn't need any more hassle. The latitude given to federal agencies is also something that is worth discussing. There still remains not central policy governing security and data resiliency across the federal government at large.”
Tim Wade, Technical Director, CTO Team at Vectra, a San Jose, Calif.-based provider of technology which applies AI to detect and hunt for cyber attackers, notes, “Given that the loss of records safeguarded by the federal government has been in batches of hundreds of thousands, or even millions in recent memory, it is probably a relief to someone somewhere that this breach accounts for less than fifty thousand. That we’re framing this loss in that context just further underscores the need for federal systems to rapidly modernize IT security capabilities. Leadership at the top must take accountability, and cultural changes must occur, if we are to expect these patterns to abate.”
The FSC is alerting the affected individuals, including the next-of-kin of those who are deceased, of the potential risk to their personal information. The department is also offering access to credit monitoring services, at no cost, to those whose social security numbers may have been compromised.
