Healthcare facilities are becoming more susceptible to cyberattacks as they continue to digitize patient records. Hackers are constantly looking for loopholes in the security of medical systems so they can steal sensitive patient data. PHI and PII are the terms used to describe this data. PHI refers to any data, including medical records, insurance information, and prescription information, that can be used to determine a person’s health status or level of care. PII is any information that can be used to identify a specific person, including that person’s name, address, social security number, and date of birth. This article will look at how hackers resell PHI/PII and medical records on the dark web.

An overview of the black market.

The underground economy of illegal activities is referred to as the “black market.”. The black market’s use of cybercrime has grown more lucrative in recent years. The average price of a data breach in the healthcare sector is $7.13 million, according to a report by IBM Security. As a result, PHI/PII and medical records have become valuable commodities on the black market. In order to commit various types of fraud, including identity theft, insurance fraud, and prescription fraud, hackers can sell this information to other cybercriminals.

Medical records and PHI/PII Obtaining Techniques.

Medical records and PHI/PII are obtained by hackers using a variety of techniques. Phishing is a popular technique in which a hacker sends an email purporting to be from a trustworthy source, like a healthcare organization. The email might include a link to a fake website that impersonates the company’s login page and requests the user’s login information. In order to access the organization’s system and obtain patient data, the hacker can use these credentials.

Exploiting system flaws within the company is another strategy. In order to access patient data, hackers can use software tools to search for systemic flaws and exploit them. Malware, a class of software created to infect a computer system and grant the hacker remote access, can be used to accomplish this. A system can get malware installed on it in a number of ways, including by downloading infected files from the internet or opening email attachments.

Lastly, physical devices that contain sensitive information, like laptops or smartphones, can be stolen by hackers in order to obtain patient data. This is a less common way to obtain patient data and is referred to as physical theft.

the sale of PHI/PII and medical records.

Medical records and PHI/PII can be sold on the black market once the hacker has them. The dark web, a section of the internet that is not indexed by search engines and is only accessible through particular software, is where the data is frequently sold. Cybercriminals frequently purchase and sell illegal goods and services on the dark web, which serves as their haven.

Since selling PHI/PII in bulk is more lucrative than selling individual records, hackers frequently sell medical records and PHI/PII in this manner. Information like name, date of birth, social security number, and medical history are frequently sold along with the data in packages. Depending on the quantity, quality, and market demand for the data, the price of the data can change. In general, the more complete and current the data, the more valuable it is on the black market.

Medical records and PHI/PII Breaches’ Effects.

Breach of PHI/PII and medical records can have catastrophic effects on patients and healthcare organizations. Identity theft, financial fraud, and even medical fraud can hurt patients. When a hacker uses the patient’s information to get prescriptions or medical services in their name, that is considered medical fraud. This may result in inaccurate medical records, incorrect diagnoses, and potentially harmful drug interactions.

The sale of PHI/PII data on the black market is illegal, and it has serious negative effects for the people whose data is stolen, as is important to remember. Selling this kind of data on the black market does not have any justifiable economic advantages. However, it’s important to talk about some of the causes behind cybercriminals’ actions.

Profit is one of the main drivers behind selling PHI/PII data. On the black market, this information is very valuable, and cybercriminals can make a sizable profit by selling it. The average price of a compromised medical record is $429, according to a Ponemon Institute study. This is a lot more expensive than the typical record theft cost in other industries. The high value of medical records and PHI/PII data makes it a desirable target for cybercriminals.

The simplicity of its sale is another element that encourages the sale of PHI/PII data on the black market. For cybercriminals to buy and sell stolen data, the dark web offers a comparatively secure and anonymous marketplace. Using cryptocurrencies like Bitcoin also makes it simpler to carry out transactions covertly.

PHI/PII data sales on the black market occasionally serve political or ideological ends as well. For instance, cybercriminals with political motivations may steal and sell medical records in order to highlight security flaws in a specific healthcare organization or to draw attention to a certain issue.

It’s crucial to remember that the sale of PHI/PII data on the black market has serious drawbacks for both individuals and society as a whole. This kind of information can be stolen, which can lead to identity theft, financial fraud, medical fraud, and other types of harm. Healthcare organizations may experience financial losses, legal action, reputational harm, and other consequences as a result of a data breach, all of which can have a significant effect.

To sum up, selling PHI/PII data on the black market may be financially lucrative for cybercriminals, but it is also a prohibited and unethical activity that has serious negative effects on both the people involved and society as a whole. Both healthcare organizations and individuals must take precautions to safeguard their private information and guard against data breaches. This entails putting into practice robust cybersecurity measures, such as encryption, two-factor authentication, and regular security audits, as well as exercising caution and vigilance when engaging in online activity and disclosing personal information.