the tl;dr is
Sell patient info repeatedly on the black market, using the profits to fund other activities
Obtain expensive medical equipment, prescriptions, or procedures
Commit tax fraud
Expose or blackmail specific individuals, such as politicians or celebrities
Receive medical care
Undergo surgery
Purchase or sell prescription or controlled drugs
*edit grammar fix
The article alludes to "medical" abuses of stolen EHRs, but doesn't explain how these abuses rely on anything more than identity information.
I'm left skeptical, especially because the author has something to sell.
There are many small doctors offices where the doctor is the executive.
A vendor will convince the doctor that their suite of software and hardware will solve all of their problems.
The doctor buys the package, and because they believed the vendor, they don't do anything more about security.
Then the doctor finds that the package doesn't work with X supplier or whatever, so the doc buys another package from another vendor, but keeps the old stuff.
The surface area is large and fertile.
So it's not necessarily that EHRs are particularly valuable, but that they are particularly available.
"any service that stores profiles including SSNs" isn't a particularly wide qualifier. The narrow domain of such services have had a long history in learning how to do that properly, and there really aren't any major new domains that are just starting to have stores of data that's useful for identity theft but weren't electronically available before - except EHRs, which are useful to current criminals, are just recently made electronic, and are poorly secured since this problem is new for them.
And are there lots of cases of people stealing ID just to get medical care? That's both sad and pretty interesting. Do they catch a lot of people trying this? Even $1200 for a "kitz" sounds like a great deal given the cost of US medical services. I'd guess there's a fairly low risk of getting caught once you leave the hospital.
Right. Fake ID and fake insurance card would work just fine.
I'd imagine the sadness easily turning into some sort of aimless wrath. It's like being told you've lived a lie to save birthgiver's face. Maybe that's what happened to Paul Le Roux when he found out he was not only adopted but that they didn't even bother giving it a name.
The situation is exactly like any other adoption just was informal in that it didn't involve the government. It worked out very well for everyone involved. Adoption happens every single day.
[1]https://www.greenwayhealth.com/press-releases/greenway-healt...
"Lede" is the newspaper term, "lead" refers to a toxic metal element, or to someone who is followed.
Also, the second part basically just says "they sell them, they're worth this much", but doesn't really get into why others are willing to pay that much.
If you're going to be pedantic you should at least be correct.
Lead here is fine, especially since lede is a neologism.
https://www.merriam-webster.com/words-at-play/bury-the-lede-...
> Although evidence dates the spelling to the 1970s, we didn't enter lede in our dictionaries until 2008. For much of that time, it was mostly kept under wraps as in-house newsroom jargon.
So it's especially strange to criticize the use of the word "lead".
Yeah, I've had this conversation a few times. I think that there are some know reasons for the theft, but the black market for this stuff is pretty opaque. I imagine that if you're in the business of cybercrime, you diversify, and one option is stolen health records.
--