A massive security breach in Norway’s Health South-East Regional Health Authority may have exposed the personal health records of 2.9 million people.

Covering ten counties, Health South-East RHA is responsible for the health care of 57% of Norway’s population. In 2013, Norway cemented their reputation for excellence in healthcare when they were placed first on the UN’s Health Development Index.

The Norwegian healthcare sector’s national information security centre (HelseCert) altered the RHA to the breach on Monday, January 8th. Kjetil Nilsen, director of the National Security Authority (NSM), told Norwegian publication VG that it was “too early to say how big the attack is.” He added that the perpetrator was likely to be an “advanced player” with the tools and know-how to perform such an attack.

Neither the NSM or Health South-East RHA could say for sure if the attack had compromised patient records, but that there was currently no indication that they had.

Health South-East RHA released no further information about how the attackers gained access to their systems.

Why are patient records valuable?

There are a number of reason why an attacker may want to steal patient data. The information in itself is often of value to unscrupulous marketers.

Healthcare data also will often contain extensive personal data which can be used to answer users’ secret questions (like, “What is your mother’s maiden name?”) and gain access to their accounts.

GDPR

This case highlights the stringent new rules due to be brought in to all EU member counties later this year through GDPR. Had GDPR been in force, Health South-East RHA would have reportedly fallen foul of the requirement to notify those affected by a data breach within 72 hours.

Despite being alerted to the attack on 8th January, Health South-East didn’t announce the infiltration until 15th January, seven days later. In this case, it took far longer than the GDPR requirement to gather all the data required to give a full picture of what had happened to those potentially affected.

It is hoped that this incident will serve as a wake-up call for many businesses and organisation who have yet to upgrade their processes and systems to meet the stringent demands of GDPR.