June 26th, 2008
Fired Director of IT accused of destroying organ donor information of former company
Here’s a story that will make you absolutely sick. I used to live in Houston, time to time I still check out the Houston Chronicle… which I did this morning. I was interested in reading more about the altercation between the Astros pitcher and general manager, but then I stumbled across a story that made me really doubt my hope for the human race.
Apparently, the fired technology director of a Houston organ donation company has been accused of hacking into the companies systems and deleting records. The article states:
A federal indictment alleges that over two days in November 2005, Danielle Duann illegally accessed and damaged LifeGift Organ Donation Center’s database.
The agency recovers organs and tissue from the deceased for distribution in 109 Texas counties. Recipients live in a broad swath of the state including Houston, Fort Worth, Lubbock and Amarillo.
After Duann, 50, was fired as the agency’s director of information technology, she is accused of accessing the system and issuing commands that wiped out organ donor information and accounting files.
Man, after reading this, I totally lost my cool. This is messing with people’s lives. This could’ve been devistating. It’s hard for me to imagine someone doing this… it not only smacks of pre-meditated attempted murder, but on a large scale. How many people need organs in the course of a day, a week, a month? Fortunately, the article states that the company saw no interruption in their ability to deliver:
“There was no interruption in clinical operations as a result of the deletion of files, therefore no lives of transplant candidates were in jeopardy,” LifeGift spokeswoman Catherine Burch Graham said Tuesday afternoon.
The agency recovered the information from a backup system.
“All of the files were back within several months of the hacking and clinical operations were not affected in any way,” Graham said.
Thank God for backups. I can’t stress how much this incident sickens me to hear about and how bad it could’ve been. The article provided further comment to what Duann is facing:
Duann’s face was wet as she was escorted by a U.S. Marshal Tuesday afternoon and she was unable to respond to questions.
If convicted, the former computer chief faces up to 10 years in prison and a $250,000 fine.
Assuming the evidence is there to convict her, I personally hope the jury seeks the maximum in penalty. 10 years and $250,000 in fines doesn’t even seem to cut it.
-Nate
Nathan McFeters is a Senior Security Advisor for Ernst & Young's Advanced Security Center in Chicago. The views and opinions expressed in this article are his own and do not represent the views and opinions of Ernst & Young Advanced Security Center or Ernst & Young, LLP. Nathan has performed web application, deep source code, Internet, Intranet, wireless, dial-up, and social engineering engagements for numerous clients in the Fortune 500 during his career at Ernst & Young and has spoken at a number of prestigious conferences, including Black Hat, DEFCON, ToorCon, and Hack in the Box. He can be found at his Pwn* blog and XS-Sniper, a blog with Billy Rios. See his full profile and disclosure of his industry affiliations.
