Nation-State Group Breaches Alaska Department Of Health

September 21, 2021 TH Author headline,government,privacy,usa,data loss,cyberwar

A bear lumbers along a shore with pine trees in the background. — Enlarge / If Alaska’s native *Ursus arctos* population could be enlisted for cyber defense patrols, attackers might need to paws for reflection before committing a criminal breach.

Last week, Alaska’s Department of Health and Social Services (DHSS) disclosed a security breach apparently made by a sophisticated nation state-level attacker.

According to DHSS—which contracted with well-known security firm Mandiant to investigate the breach—the attackers gained a foothold inside DHSS’ network via one of its public-facing websites, from which it pivoted to deeper resources.

A months-long saga

This is not the first report of the DHSS breach. The organization first publicly announced the intrusion on May 18, with a June update announcing a multipronged investigation, and one more in August on completion of the first of three investigatory steps.

In the August update, DHSS disclosed that Mandiant—a subset of larger infosec firm FireEye—completed its initial investigation and concluded that the intrusion was a direct, sophisticated attack rather than a simple drive-by ransomware infestation. “The type of group behind this disruptive attack is a very serious operation with advanced capabilities,” said DHSS Commissioner Adam Crum.

According to DHSS Technology Officer Scott McCutcheon, the attackers were both advanced and persistent: “This was not a ‘one-and-done’ situation, but rather a sophisticated attack intended to be carried out undetected over a prolonged period. The attackers took steps to maintain that long-term access even after they were detected.”

The majority of the technical detail provided by Alaska DHSS came in the August update—last week’s notification instead concerned the attack’s impact on Alaskan citizens.

Data leaked, and Alaskan response

A security monitoring firm performing proactive surveillance first noticed signs of an intrusion on May 2. Alaska’s Office of Information Technology (Security Office) notified DHSS of unauthorized computer access on May 5, after which DHSS reports it immediately shut down systems to deny attackers further access to protected data.

During that (at least) three-day window, attackers potentially had access to personal data, some of which constitutes breach of both HIPAA and the Alaska Personal Information Protection Act (APIPA). The number of individuals involved in the attack is still unknown, as is exactly what data may have been exfiltrated—but the attackers potentially had access to “any data stored on the department’s information technology infrastructure,” including but not limited to the following:

Full names
Dates of birth
Social Security numbers
Addresses
Telephone numbers
Driver’s license numbers
Internal identifying numbers (case reports, protected service reports, Medicaid, etc.)
Health information
Financial information
Historical information concerning a person’s interaction with DHSS

In response, the state of Alaska is offering free credit monitoring to “any concerned Alaskan.” All Alaskan citizens who have applied for a Permanent Fund Dividend will receive an email notification describing the breach and offering a code for the free credit-monitoring service. Concerned Alaskans who do not receive an emailed code will need to contact a toll-free hotline that will be available at the DHSS website beginning Tuesday, September 21.