Hackers Hawk Stolen Health Insurance Information In Detailed Dossiers

The phrase "health insurance" may conjure up images of medical bills for some people, but for hackers it leads only to visions of dollar signs.

According to Dell SecureWorks, health insurance information ranging from contract numbers to the type of plan a customer has purchased is increasingly making its way into detailed dossiers of hacking victims that are being assembled and given to identity thieves in underground cyberforums. These packages of data on individual people, which also include verified bank account numbers and credentials, Social Security numbers, and other personally identifiable information, are known in the underground as "fullz."

When further packaged with custom manufactured or counterfeit physical documents, such as credit cards and driver's licenses, the hacker merchandise is referred to as "kitz," each of which sells for between $1,200 and $1,300 apiece.

"Selling fullz and kitz aren't new, but the selling of kitz, which is focused on health insurance credentials and all the other supporting credentials and documents needed to use those stolen health insurance credentials, is a new trend," says Don Jackson, senior security research for Dell SecureWorks' Counter Threat Unit. "Selling health insurance credentials by themselves does not have enough value, as those other credentials are needed to obtain medical services."

The fullz tend to go for less, about $500 each based on what is included -- full names, addresses, phone numbers, email addresses with passwords, and so on. Health insurance credentials are $20 each, with an additional $20 added whenever there is a dental, vision, or chiropractic plan associated with the health plan. Other fees include $1 to $2 for a U.S. credit card with CVV code, or $20 to $200 for a PayPal account with a verified balance.

The health insurance information, says Jackson, is being used to get free medical services. Theft of medical services, including doctor visits, drugs, and surgeries, are the primary goal for buying these stolen credentials, he says.

"We have seen the cost of health insurance and the cost of medical services continue to rise," Jackson says. "As such, we have seen more demand for stolen health insurance data and the associated credentials needed to use the health insurance, such as physical documents like the insurance card, the driver's license, the SSN, address, payment card, etc. There is definitely an increase in the buying and selling of information like health insurance contracts. So the selling of kitz with this type of information, like health insurance credentials, is on the rise, and that is a new trend."

Additionally, the cost of obtaining the stolen health insurance information and related financial and PII data has not increased, which is a big benefit for the hackers stealing the data, he adds.

The biggest jump in value among stolen credentials involved gaming accounts. Those credentials are valued from between $5 and $1,000, according to Dell SecureWorks. In recent weeks, both Konami and Nintendo revealed that attackers had compromised tens of thousands of user accounts.

"When a seller says their stolen credentials have been validated, they usually charge more for them," he says. "If, for example, the hackers' primary job is to sell stolen credit cards, then they will give the potential buyer contact info for a third party who will validate that the credit cards are good and available to use. And if the stolen data does not end up being what the seller says it is ... then there are numerous hacker forums where sellers are rated and reviewed. Most of the validation comes through the forums and what others say about the seller."

Though Jackson did not identify specifically who was behind the underground marketplaces hawking the data, he suspects the criminals involved in one major operation are located in the U.S.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.