What Do Hackers Do with Stolen Medical Information?

Throughout 2021, multiple medical data hacks have been reported, including the New South Wales Ministry of Health, multiple vendors and hospitals in the United States, European Medicines Agency (EMA), and more. With the recent push for telehealth and applications coupled with the influx of patients internationally, the number of attacks is on the rise ranging from data leaks to locking up hospital’s computers and demanding a ransom.

According to CBS This Morning, these hacks are occurring as hackers can profit up to US$ 500 per record that is obtained, as it contains personal information, including social security number, financial information, date of birth, medical record numbers, and insurance information. With this information, hackers can utilize information to create full “identity kits” that contain “counterfeit passports, ID cards, and social security cards. Once the full kit is completed, they can sell for up to $2,000 a pop.”

A typical structure of WMSNs for personalized healthcare applications is demonstrated in Figure 1. Although WMSNs bring a lot of convenience to people’s life (Siddesh et al., 2017), security and privacy issues in WMSNs are becoming great challenges due to the sensitiveness of medical system (Ameen, Liu, & Kwak, 2012; Xu, Qi, Dou, & Yu, 2017). The medical data collected from the medical sensor nodes is sensitive, and the privacy of these data is protected legally. Due to the open feature of wireless communication, an adversary can intercept and alter the transmitted messages easily. Once obtaining these sensitive data, an adversary may acquaint the disease what the patient has and profit financially by selling sensitive data, it is a serious violation of the patient’s privacy. Further, the adversary can even misreport or distort the patient’s physiological data to cause physical harm, it may result in improper diagnosis and treatment. Therefore, it is very important to design an effective authentication scheme to guarantee secure communication and protect patients’ privacy in WMSNs.

In the past decade, many authentication schemes are proposed to solve the security issues in WMSNs. In 2007, Hu et al. (2007) designed a telecardiology sensor network platform for real-time healthcare data collection using the symmetric cryptography. Two years later, Huang et al. (2009) presented a healthcare monitoring architecture for monitoring elderly or chronic patients in their residence, which used Advanced Encryption Standard (AES) algorithm to provide authentication and secret communication. Unfortunately, neither of them could achieve mutual authentication successfully. In 2009, Malasri et al. (2009) designed a secure WMSN system for healthcare based on symmetric cryptography and elliptic curve cryptography (ECC), they implemented their mechanisms on a wireless mote platform. Later, Das (2009) presented a two-factor user authentication protocol for WSN and claimed their protocol could provide strong authentication and resist various attacks. Unfortunately, Khan et al. (2010) pointed out that Das’s scheme (Das, 2009) was vulnerable to privileged-insider attack and Gateway node (GWN) bypass attack. In 2012, Kumar et al. (2012) presented an efficient and strong authentication protocol, named E-SAP, for healthcare application using WMSNs. They demonstrated that their protocol was more secure against many practical attacks. But later, He et al. (2015) in 2015 pointed out that the scheme proposed by Kumar et al. failed to resist some known attacks, liking off-line password guessing attack and privileged insider attack…