Breaches and incidents
Korea National Health Insurance Service: employee sold subscriber data for about 2.5 years; victims not notified
Per Medigate News, at a 16 Oct National Assembly audit lawmaker Kim Ki-woong raised the case of an NHIS employee who provided subscriber and dependent...
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- Per Medigate News, at a 16 Oct National Assembly audit lawmaker Kim Ki-woong raised the case of an NHIS employee who provided subscriber and dependent information to outsiders for about two years and six months in exchange for money and was dismissed.
- Root cause: insider misuse of lookup access; Medigate reports some unauthorized lookups took from one day up to 1,135 days to detect.
- Attacker: the dismissed NHIS employee (per the lawmaker); the buyers were not named.
- Victims had not been notified for more than three months because the case was under investigation, and NHIS said it had not identified exactly which records were passed on; the number affected was not disclosed.