Attack on FELG: perpetrator claims theft of data of 2.4 million patients
The maker of a popular system for dental practices has confirmed the incident. The scale of the leak is not yet known, but practices, as data controllers, must assess for themselves whether a breach occurred.
FELG Software, the creator of software for dental practices, has confirmed a security incident. According to findings by the Zaufana Trzecia Strona service, the perpetrator calling himself “HORUS” claims to have stolen data of 2.4 million patients, 712 thousand medical staff members, and 1.2 million prescriptions. More than 16 thousand dentists use FELG tools, the company says.
The company learned about the attack on 28 September. The potential scope of the data includes first names, surnames, PESEL numbers, addresses, medical data, and information on e-prescriptions, e-ZLA (electronic sick leave certificates), and verification in the eWUŚ system, which confirms a patient's right to treatment under the National Health Fund. The perpetrator demanded a ransom in exchange for not disclosing the data. According to FELG, he himself claimed to have stolen about 10 percent of the database. None of these figures has been confirmed.
The attacker claims he was downloading data from 6 September through a poorly secured application programming interface (API). According to his account, it was enough to create a demo account and change the number in the query to receive data of subsequent patients. This is an IDOR flaw, meaning there was no check whether the user had the right to access a given record. Zaufana Trzecia Strona provided the perpetrator with the PESEL numbers of eight people who had agreed to this. None of them was in his database.
According to FELG's statement, the perpetrator claimed to be a member of the “Fingerprint” group, responsible for earlier attacks on MyDr, Medyc, and Fakturownia. Zaufana Trzecia Strona determined that this was false: the perpetrator admitted that he had claimed responsibility for the attacks on MyDr and Medyc to increase pressure when demanding ransom, and Fingerprint itself denied any involvement. “HORUS” has announced that he will put the database up for sale.
According to the Sekurak service, FELG CEO Grzegorz Stawarz confirmed the incident and said that the scale is being determined, and that the case has been reported to the prosecutor's office and the Personal Data Protection Office (UODO). The company has engaged digital forensics specialists and says it will provide practices with templates for notifications to UODO and a tool for notifying patients.
For practices, the September position of UODO issued after the MyDr leak in response to a question from the Supreme Medical Chamber is important. A supplier's statement does not release the data controller, that is the practice, from independently assessing whether a breach occurred. The 72-hour deadline for reporting a breach to UODO runs from the moment the controller determines it on its own.