Why medical records are more valuable to criminals than stolen credit card details
- Robert Salier
- Sep 6, 2024
- 3 min read
Updated: May 12
The dark web contains thriving underground markets for stolen information, shady and outright illegal goods and services. The dark web is an encrypted part of the internet that is not indexed by traditional search engines. It provides anonymity to both buyers and sellers, making it an ideal platform for illegal activities. Marketplaces on the dark web operate similarly to legitimate e-commerce sites, with listings, customer reviews, and even dispute resolution mechanisms.
One of the things on offer are people’s health records that have been stolen by hackers that have broken into healthcare institutions, anything from a doctor's surgery through to healthcare funds. This is what we in the cybersecurity industry call “Personally Identifiable Information”, or PII for short. It’s an industry is overflowing with acronyms!
It might surprise you to know that medical records command a much higher price than stolen credit cards details. While a stolen credit card might fetch USD$5 to $10, a complete health record can sell for upwards of USD$100 to $1,000. This high value is due to the richness and longevity of the data. Unlike financial information, which can be quickly changed or cancelled, health records contain sensitive and enduring data. This makes these records incredibly valuable to cybercriminals.
The Value of Health Records
Health records are a goldmine of personal information. A single health record typically contains the patient’s full name, date of birth, address, phone number, email address, Medicare ID, health insurance details, and detailed medical history including illnesses, diseases, medications and treatments. This comprehensive data set can be used for a variety of nefarious purposes, making it highly sought after by criminals.
Health records can be used to commit medical identity theft, where criminals use someone else's identity to receive medical care, purchase prescription drugs, or submit fraudulent insurance claims. This type of fraud is difficult to detect and can go on for years, making it lucrative to criminals.
Healthcare records can also be used for blackmail and extortion. The sensitive nature of health information means it can be used for blackmail. Criminals may threaten to reveal private medical conditions or treatments unless the victim pays a ransom. Criminals usually start by approaching the organisation they have stolen the records from, threatening to release sensitive information to the public if it refuses to pay a ransom. This is exactly what happened with the Medibank Australia breach in 2022, where details of patients that had abortions were made public.
The criminal use, sale or ransom of healthcare records can also have devastating consequences for individuals. Medical identity theft can result in incorrect medical treatments, financial losses, and significant stress. Victims often face a long and arduous process to clear their names and rectify their medical records. Additionally, the exposure of sensitive health information can lead to stigmatisation and personal embarrassment.
The sale of stolen health records on the dark web is a complex and growing problem, driven by the high value of these records and the relative ease with which they can be obtained. The dark web can be low risk and high reward for criminals, providing a level of anonymity that makes it difficult for law enforcement to trace transactions and identify perpetrators. This anonymity attracts criminals who wish to avoid detection. The risk of getting caught for cybercrime, especially when operating on the dark web, is relatively low compared to other forms of crime.
To combat this threat, healthcare providers, policymakers, and individuals all have a role to play. As an individual, you can refer to the advice provided by The Australian Federal Trade Commission on how to protect yourself against medical identity theft.
