Quest Diagnostics breach exposes patient records to an intruder

Quest Diagnostics has been hacked. Patient data was exposed. They serve roughly half of U.S. hospitals and physicians. Investigation ongoing.

TL;DR of this week. Your aunt’s password: “P4ssword!” (on a Post-it note in the kitchen) The stewards and guardians of the internet’s encryption’s password: “4” Yes, just 4. This key could be used to target and decrypt ~everything, and we’re still cleaning up residual risk.

There's about a coin-flip chance Quest Diagnostics has run your blood work in the last three years. On Wednesday, Quest found a stranger inside the system doctors use to pull up those results. Quest hasn't said how many people are affected yet. Its SEC filing just says the intruder got into "certain patient records," and the company is still working out whose. Here's why this one should bother you more than the usual "your email got leaked" story. When someone steals your credit card, your bank kills the number and you've got a new card in a few days. A lab result doesn't work like that. If it says you're HIV positive or that a biopsy came back bad, that stays true about you no matter how many copies are floating around. The system is called Quanum Lab Services Manager, and clinics use…

The secret key that's supposed to prove a website is real, the thing behind that little padlock in your browser, turned out to be the number 4 at one company this week. Anyone who knew it could have faked your bank's website, your email login, pretty much any site you visit. And it wasn't even the scariest thing to happen online in the last four days. Here's how that works. A handful of companies called certificate authorities vouch that your bank's site really belongs to your bank. Their keys are supposed to be numbers more than 100 digits long, which is why nobody can guess them. An Indian authority called eMudhra had eight of its keys exposed, and one of them was literally 4. Chrome and Firefox blocked them within hours, but plenty of apps and servers don't check for that kind of…