{"id":10921,"date":"2019-06-05T11:15:32","date_gmt":"2019-06-05T15:15:32","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=10921"},"modified":"2019-06-07T11:52:14","modified_gmt":"2019-06-07T15:52:14","slug":"report-it-right-amca-got-hacked-not-quest-and-labcorp","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/report-it-right-amca-got-hacked-not-quest-and-labcorp\/","title":{"rendered":"Report it Right: AMCA got hacked \u2013 Not Quest and LabCorp"},"content":{"rendered":"\n

This is just one more example of the way the media mucks up cybersecurity\ncoverage<\/h2>\n\n\n\n

Chances are, if you\u2019ve had blood drawn in the US recently\nand didn\u2019t pay your bills on time \u2013 your information has been compromised. Over\nthe past couple of days both Quest Diagnostics and LabCorp, the two biggest US\nmedical testing companies, have gone public with news of a third-party breach\nthat will affect nearly 20 million customers (12-million for Quest, 7.7-million\nfor LabCorp).<\/p>\n\n\n\n

Here\u2019s the thing though: neither of those two companies were\nactually the ones that messed up \u2013 the American Medical Collection Agency was.\nAnd frankly, the AMCA should be the one getting pilloried in the news headlines\nright now.<\/p>\n\n\n\n

This is indicative of a greater problem with the way the media\ncovers cybersecurity though. Which is to say, poorly. That\u2019s likely a result of\na general lack of understanding on the part of the people reporting it. But it\u2019s\nalso unacceptable because it can give false impressions and actually even end\nup harming security. <\/p>\n\n\n\n

So, today we\u2019re going to talk about the AMCA Data Breach,\nthe way the media covers cybersecurity issues and what needs to be done to fix\nit.<\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n\n

Let\u2019s place the blame where it\u2019s due: AMCA<\/h2>\n\n\n\n

Let\u2019s start with what actually happened before we begin dissecting the coverage of it. AMCA got breached. The American Medical Collection Agency is a debt collection service. When you go get a medical procedure done \u2013 not just bloodwork, really anything billable \u2013 and you don\u2019t pay on time, it gets sent to the AMCA (or a company of its ilk). According to its website, the AMCA is: <\/p>\n\n\n\n

“…the leading recovery agency for patient collections\u2026and one of the nation\u2019s top high volume lower balance agencies, managing over $1 billion in annual receivables for a diverse client base.\u201d<\/p><\/blockquote>\n\n\n\n

I\u2019m not going to wax poetic about the morally bankrupt practices of the collections industry or provide anecdotal evidence of all the scummy ways they go after people<\/a>. For all I know the AMCA is nothing like that. The Better Business Bureau gives them a rating of D-, but hey at least it’s not an F.<\/p>\n\n\n\n

Regardless of your feelings about the business it conducts\nthough, the AMCA should be the company that\u2019s wearing this one. It got breached\nand it didn\u2019t even know it. <\/p>\n\n\n\n

\u201cWe are investigating a data incident involving an unauthorized user accessing the American Medical Collection Agency system. Upon receiving information from a security compliance firm that works with credit card companies of a possible security compromise, we conducted an internal review, and then took down our web payments page,\u201d a spokesperson for AMCA said<\/a>. <\/p><\/blockquote>\n\n\n\n

But that\u2019s not how this is being covered. Nearly every single headline mentions either Quest or LabCorp. There\u2019s a reason for that. HIPAA guidelines<\/a> require both of these organizations to report this data breach, even though it happened to a partner and not them directly.<\/p>\n\n\n\n

This would be a good time to mention that under the GDPR,\nHIPAA and a number of other regulations and laws \u2013 you also have some\nculpability when your partners screw up, even if you weren\u2019t directly responsible.\nThis is why it\u2019s important to have Data Processing Agreements and other similar\nmechanisms in place to help limit legal liability. <\/p>\n\n\n\n

But, as we\u2019re seeing, even if you follow the letter of the law, your partners\u2019 mistakes can end up hurting you way more than it hurts them. The AMCA isn\u2019t being singled out for this. Its reputation isn\u2019t taking as much of a hit as the two medical testing companies’ are. <\/p>\n\n\n\n

And this is only going to get worse, because the AMCA has other DBAs, such as \u201cRetrieval-Masters Credit Bureau\u201d (BBB: F rating… welp) and \u201cAmerican Traffic Solutions,\u201d (not BBB accredited). It has clients well beyond just the medical industry. But given the status quo, as more and more of the affected companies are notified and come forward, it will be their names in the headlines – not AMCA’s. <\/p>\n\n\n\n

But make no mistake about it, this is on the AMCA. <\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

We have to do a better job reporting on data breaches<\/h2>\n\n\n\n

I started out my career as a newspaper reporter. I know what\nit\u2019s like to work a beat, I know what it feels like to get tossed on a story\nyou know nothing about \u2013 I get it. It\u2019s not an easy job and the media is too\nreviled in this country. Having said that, there needs to be a higher standard\nfor cybersecurity coverage.<\/p>\n\n\n\n

And this is not isolated to just this incident. Take, for\ninstance, the news last week that Checkers and Rally\u2019s had been breached and\nmillions of people could potentially have their financial information\ncompromised. Go Google that real quick. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Look at the headlines. You may be asking, \u201cwhat\u2019s wrong with that?\u201d The problem is that it seems to misunderstand the way people consume this kind of news, and just news in general. Headlines have never been more important than they are in the digital age, where people are bombarded by media from all angles. <\/p>\n\n\n\n

Many people only read the headlines. Trust me, outside of the cybersecurity community most people aren\u2019t going to click on a link to read about a data breach at Checkers. I see the traffic for Hashed Out every Monday and stories about data breaches aren\u2019t what move the needle. Add in that we\u2019ve all kind of become numb to the term \u201cdata breach,\u201d and it\u2019s apparent these headlines aren\u2019t accomplishing what they need to be. <\/p>\n\n\n\n

In this case \u201cData Breach\u201d is too vague. You see a couple of\nheadlines that mention the number of locations or that it was a card breach,\nwhich is closer to where it needs to be, but only one outlet actually got it\nright: ThreatPost.<\/p>\n\n\n\n

POS Malware Found at 102 Checkers Restaurant Locations<\/a><\/strong><\/p><\/blockquote>\n\n\n\n

Even if someone just skims the headlines, this at least paints a clearer picture of what\u2019s happened. If they\u2019re concerned, they may actually click and find out what \u201cPOS Malware\u201d actually is. This is useful. But just throwing it under the catch-all term \u201cdata breach\u201d is at best inefficient and at worst downright lazy.<\/p>\n\n\n\n

People need a clearer idea about whether this affects them. The headline is your best chance to do that.<\/p>\n\n\n\n

Now let\u2019s turn back to the AMCA data breach<\/h2>\n\n\n\n

Once again the headlines are failing to capture the reality\nof the situation. This was not a LabCorp breach, this was not a Quest breach \u2013\nthis was an AMCA breach. Failing to mention that, or at least say that it was a\nthird-party breach is frankly a disservice to these companies as they practice\nresponsible disclosure of what was affected. <\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

And while that\u2019s bad for the individual companies, it\u2019s worse for the cybersecurity ecosystem. We need companies to come forward with disclosures when one of their partners messes up and data is compromised. We\u2019ve tried to legislate that with varying degrees of success<\/a> but at the end of the day, many companies are still loathe to do that.<\/p>\n\n\n\n

A study by nCipher that came out just last week found that 71% of UK C-Suite executives would be willing to cover up a data breach if they could escape the penalties<\/a>. <\/p>\n\n\n\n

Now, what about the way this news is being presented would ever make a company want to willingly admit to something like this? Because right now, the average internet user that sees any of these headlines thinks it was Quest or LabCorp \u2013 or any of the other companies that will likely make announcements in the upcoming days and weeks \u2013 that messed up.<\/p>\n\n\n\n

And it wasn\u2019t, their biggest mistake was trusting the wrong company. That\u2019s both a strong reason to vet your potential partners and ensure they\u2019ve got adequate security safeguards in place, but also an indictment of the way these stories are covered.<\/p>\n\n\n\n

And again, beyond mis-attributing the fault, at least at a glance, the headlines aren’t even that helpful. If I know it was those companies’ collections agency, I know whether or not it affects me. Just saying Quest or LabCorp got breached really lacks the proper context.<\/p>\n\n\n\n

Again, the headlines are what most people are going to skim. You have to make them count.<\/p>\n\n\n\n

What can be done to improve the way the media covers cybersecurity?<\/h2>\n\n\n\n

This is a multi-faceted issue that isn\u2019t going to be changed\nwith a single fix. A lot of these media companies are struggling to keep up\nwith the digital landscape, they\u2019re understaffed, their reporters are overworked.\nThere\u2019s a reason I left my job as a reporter.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

So one of the biggest issues is that the resources just aren\u2019t there. But part of the problem is also archaic views on the way a news division should be organized. Tech and cybersecurity are major topics nowadays and media outlets should be trying to invest in reporters and journalists with expertise in those areas. They need dedicated coverage. You wouldn\u2019t hire a business reporter without a strong knowledge of the financial industry. You wouldn\u2019t hire a sports reporter that doesn\u2019t know about sports. But with a lot of these tech topics that\u2019s what happens. You get a reporter that\u2019s honestly just trying to do their best with a topic they\u2019re not knowledgeable about. <\/p>\n\n\n\n

Unfortunately, there\u2019s a big cybersecurity skills gap right now<\/a>. There are a lot more roles than talent. And a lot of those roles pay better than being a reporter or journalist does.  So the incentive to become a cybersecurity reporter at any but the best outlets isn\u2019t very high. <\/p>\n\n\n\n

Granted, some organizations, like the New York Times and Washington Post do staff actual cybersecurity experts. Most don\u2019t though, and that means they have to approach the story from a layman\u2019s perspective and try to latch on to the things that they THINK are the most important without knowing for sure whether or not they actually are. <\/p>\n\n\n\n

LabCorp and Quest are much bigger names than AMCA, so putting them in the headline makes sense from a recognition standpoint, but it also distorts people\u2019s impression of the actual news. <\/p>\n\n\n\n

As I said, there is no easy fix for this, no magic wand to\nwave or pixie dust to sprinkle. But it still needs to be brought up. <\/p>\n\n\n\n

And look, I have no problem with the media taking an irresponsible\nor negligent company to task. That kind of public shaming can actually be a\nnet-positive. But it has to be used appropriately. Not every breach is the\nsame. The devil is in the details. <\/p>\n\n\n\n

That\u2019s why improving the media\u2019s coverage of these issues is\nso important.<\/p>\n\n\n\n

As always, leave any comments or questions below\u2026<\/em><\/p>\n\n\n\n

\"Hashed<\/figure>\n","protected":false},"excerpt":{"rendered":"

The way the media covers data breaches is probably bad for cybersecurity as a whole. We need more knowledgeable coverage and more accurate headlines.<\/p>\n","protected":false},"author":6,"featured_media":10928,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16],"tags":[4459,3843],"class_list":["post-10921","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","tag-data-breaches","tag-news-media","post-with-tags"],"views":33209,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/06\/Reporter-Feature-1.png","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/10921","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=10921"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/10921\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/10928"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=10921"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=10921"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=10921"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}