A mix-up at a school in Worcestershire, England, caused parents to receive the Covid-19 test results of other people’s children.

The data breach, reported today by the Evesham Journal, occurred at co-educational secondary school and sixth-form college The De Montfort School (TDMS) in Evesham, which is part of the Four Stones Multi Academy Trust.

Students returning to learning after the holiday season underwent asymptomatic testing for the coronavirus at TDMS on Tuesday. In a security incident ascribed to “human error,” some students’ test results were sent to the wrong guardians.

Ninth-grade student Amelia Felton was among the children affected by the data breach. Felton’s mother, Becky, learned of the security breach not through the school, but via the parent of another student.

“I’m not very happy,” Becky Felton told the Evesham Journal. “It was another parent that told me she had received my daughter’s result. This is a serious breach of personal data.”

The head teacher at The De Montfort School, Ruth Allen, confirmed that the data breach had taken place while the test results were being uploaded to the school’s network. 

Allen said the incident had involved the personal data of only a small number of students, and that the school’s coronavirus testing process had been successful owing to the cooperation of students and teaching staff.

“In line with government guidance, on Tuesday, January 4, the school facilitated asymptomatic testing for our students following the Christmas break,” said Allen.

“Testing for students was completed quickly and without fuss thanks to our excellent team of testers and the good will of our students, who now have testing down to a fine art. This meant that all students were back in face-to-face lessons on Wednesday.”

She added: “Unfortunately, whilst uploading results, a data breach occurred that affected a small number of students.”

Allen said that the data breach has been investigated according to the regulations laid out in the Four Stones Multi Academy Trust data protection policy and that the security incident was reported to the Information Commissioner’s Office. 

The TDMS head added that the data breach was “found to be the result of a human error.”

A company that operates multiple fertility centers across Northern Illinois has suffered a data breach because of a cyber-attack.

Fertility Centers of Illinois (FCI) reported the data breach to the Department of Health and Human Services’ Office for Civil Rights (OCR) as affecting 79,943 current and former patients.

The unidentified attacker had access to some of the patients’ protected health information (PHI) and was also able to access personal data belonging to FCI employees.

Third-party computer forensic specialists were hired by FCI after the company detected suspicious network activity on February 1, 2021. 

While cybersecurity measures implemented by FCI ensured that the company’s electronic medical record system could not be accessed, the attacker was able to get into administrative files and folders. 

FCI reviewed the contents of the compromised files and by August 27, 2021, determined that they contained a range of patient data including names in combination with one or more of the following types of information: Social Security numbers, passport numbers, financial account information, payment card information, diagnoses, treatment information, medical record numbers, billing/claims information, prescription information, Medicare/Medicaid identification information, health insurance group numbers, health insurance subscriber numbers, patient account numbers, encounter numbers, referring physicians, usernames and passwords with PINs, or account login information.

Employee information potentially compromised in the cyber-attack included names, employer-assigned identification numbers, ill-health/retirement information, occupational health-related information, medical benefits and entitlements information, patkeys/reason for absence, and sickness certificates.

Since the attack occurred, FCI has made improvements to its cybersecurity posture, which include implementing enterprise-class identity verification software and providing extra training to its workforce on cybersecurity practices.

Data breach notifications have been mailed out to all affected individuals. FCI is offering victims complimentary credit monitoring and identity theft protection services for 12 months through Equifax.

News of the FCI attack follows the theft of data from America’s largest fertility clinic operator, US Fertility, in September 2020. In November 2021, a fertility clinic in the United Kingdom also became the victim of cyber-criminals when ransomware was used to attack a medical record scanning company used by Lister Fertility Clinic.

A recently reported data breach impacting the Rhode Island Public Transit Authority (RIPTA) is to be investigated by the state’s attorney general.

The protected health information (PHI) of thousands of individuals was involved in the data breach, which occurred when RIPTA was attacked by cyber-criminals last summer. 

RIPTA reported the data breach to the Department of Health and Human Services’ Office for Civil Rights (OCR) as affecting 5,015 individuals who are members of the transport authority’s group health plan. 

The Providence Journal reports that the number of impacted individuals subsequently rose to 17,378. 

Suspicious activity was identified on RIPTA’s computer network on August 5, 2021, and – according to a breach notice posted to the authority’s website – blocked the same day. 

Digital forensic evidence of the cybercrime revealed that parts of RIPTA’s network had been accessible to an unknown threat actor since August 3, 2021. 

After reviewing what data the threat actor had been able to access, RIPTA determined that files containing the personal information of health plan members were stored in the comprised area of the network and that these files had been exfiltrated in the cyber-attack.

Data stored in the exfiltrated files included health plan members’ names, addresses, dates of birth, Social Security numbers, Medicare ID numbers, qualification information, health plan ID numbers, and claims information.

According to a document sent to state employees by the Department of Administration on Wednesday, some of the PHI exfiltrated in the attack had been “incorrectly shared” with RIPTA by the state’s previous health insurance provider, UnitedHealthcare.

RIPTA senior executive Courtney Marciano said that the PHI of individuals with no connection to RIPTA had been sent to the transport authority in error by UnitedHealthcare. RIPTA has since switched its insurance provider to Horizon BlueCross/Blue Shield of Rhode Island. 

Rhode Island attorney general Peter Neronha stated his intention to investigate the data breach to the Providence Journal. Neronha’s probe will determine whether any state laws have been violated, such as the Identity Theft Protection Act of 2015. 

It is possible that the OCR may investigate UnitedHealthcare over the seemingly impermissible disclosure of state employees’ PHI to RIPTA.

UK police have seized cryptocurrency worth £322m over the past five years, according to official figures obtained by the New Scientist publication following a freedom of information (FoI) request.

The funds were taken during multiple criminal investigations over this period, highlighting how cryptocurrencies are increasingly used in illegal activity. This is primarily due to the challenges law enforcement face in seizing digital currencies compared to cash. One of these is that cryptocurrencies are often protected by strong encryption, which is impenetrable without a key. It is also difficult for law enforcement to seize cryptocurrency under existing legislation in the UK, even if there is suspicion it has been gained from criminal activity.

The £322m worth of funds were seized by 12 of the UK’s 48 police forces, although the true figure could be much higher because 15 forces reportedly did not respond to the New Scientist’s request. In addition, the UK’s National Crime Agency, which is exempt from FoI legislation, has not revealed how much cryptocurrency it has seized.

Almost all (99%) of the seized cryptocurrencies were Bitcoin, although small amounts of Ethereum, Dash, Monero and Zcash were also confiscated.

Commenting on the story, Jake Moore, former head of digital forensics at Dorset Police and global cybersecurity advisor at ESET, said: “Police forces have come so far in digital investigations, yet the final step of confiscation is simply too difficult to examine in many situations. The key design of cryptocurrencies is to keep them secure from interception from anyone, whether that be a threat actor or law enforcement, plus they were not intended to have a back door for any reason. This naturally causes a problem for police forces wanting to seize through the original procedures they are all used to with old-fashioned finances. In some cases, criminals may be locked up without giving away access to their funds, only to see huge returns on their release from jail.

“Digital investigations still remain in their infant phase and require far more resources to improve fighting this growing criminality. Cyber-criminals are very aware of the well-documented evasion tactics available but policing is improving at a rate that will slowly catch up in time. Deploying better surveillance techniques on known suspects, increasing intelligence and improving the profiling on those who are thought to be involved all helps build stronger evidence to recover and seize funds. However, the cost of this could potentially outweigh the amount that is recoverable in many cases.”

Last year, Europol revealed it had observed the proliferation of new money laundering techniques involving cyptocurrencies, a trend exacerbated by the COVID-19 pandemic.

A Californian man has admitted his part in a $50m conspiracy to defraud scores of investors via lookalike scam websites.

Allen Giltman, 56, of Irvine, pleaded guilty to one count of conspiracy to commit wire fraud and one count of conspiracy to commit securities fraud.

For eight years up to October 2020, he’s said to have conspired with others to build and run websites to solicit funds from investors. Many were designed to look like legitimate sites run by financial institutions or non-existent but legitimate-seeming companies.

To enhance the sites’ legitimacy, the conspirators would falsely claim their ‘institutions’ were regulated by the Federal Deposit Insurance Corporation (FDIC), the Financial Industry Regulatory Authority (FINRA), the Securities Investor Protection Corporation and the New York Stock Exchange.

They claimed deposits would be protected and used real names and logos of the companies they impersonated.

Lured in by higher-than-average rates of return on their certificates of deposit (CDs), the victims usually found the sites via internet searches, according to the Department of Justice (DoJ).

Giltman typically fielded introductory calls and emails from these victims, impersonating real FINRA broker-dealers using their names and FINRA Central Registration Depository numbers. He then provided would-be investors with application forms and instructions on how to wire funds for CD purchases.

In reality, no investor ever received a CD, and their funds were apparently moved to various international bank accounts in Russia, Georgia, Hong Kong, and Turkey.  

Investigators identified around 70 victims of the nationwide scheme and as many as 150 scam sites.

Giltman faces a maximum jail term of 25 years and will be forced to pay $500,000 or twice the gross amount of gain or loss from each offense, whichever is greater. He is also facing a civil complaint filed yesterday by the SEC.

Investment fraud is among the highest-grossing cybercrimes, according to the FBI. It revealed that over $336m was lost to fraudsters in 2020, more than any other crime type bar romance scams and business email compromise.

Over 8700 victims were identified during the reporting period.