Dark web: Hackers sell doctors' identities for $500 in disturbing new trend

Cyber criminals trade all the information needed to pose as a healthcare professional in order to commit insurance fraud and obtain controlled drugs

Personal healthcare records listed on the dark web can be extremely profitable for cyber criminals (Getty Images/iStockphoto)

The identities of doctors are selling on the dark web for $500, new research reveals.

Hackers are obtaining all the details needed to pose as a medical professional by targetting hospitals and other healthcare organisations, which possess huge troves of highly valuable data.

The hacked data is then sold through black markets on the dark web – a section of the internet that is only accessible using specialist software.

Documents on sale include malpractice insurance documents, medical diplomas, board recommendations, medical doctor licenses, and DEA licenses.

Cyber criminals are able to use this stolen information to forge the identities of doctors in order to submit fraudulent insurance claims or obtain prescriptions for controlled drugs like opioids.

The disturbing trend was uncovered by researchers at cyber security firm Carbon Black, who tracked the shifting patterns of cyber attacks towards medical organisations.

"This is a relatively new trend," Tom Kellermann, chief cyber security officer at Carbon Black, told The Independent.

"The price is warranted when you consider what can be done with the data. Cyber criminals can use this information to facilitate insurance fraud, as well as submit prescriptions for controlled substances like opioids. These can then be sold on the black market at a steep profit."

More than three quarters of the organisations surveyed by Carbon Black said they had experienced an increase in cyber attacks over the past year, with nearly two thirds saying the attacks had become more sophisticated.

Beyond doctors' identities, other data targeted included personal medical records and hacked health insurance company login information.

This information is generally cheaper to obtain, with forged prescriptions costing between $10 and $120 on the dark web and insurance login information costing as little as $3.25 per record.

But by far the most alarming data listed on dark web marketplaces was medical care provider data, the researchers said.

"A hacker compromises the corporate network of a healthcare provider to find administrative paperwork that would support a forged doctor's identity," states a report detailing the researchers' findings.

"The buyer [of the data] then poses as the stolen doctor's identity and submits claims to Medicare or other medical insurance providers for high-end surgeries."

The researchers called for "extreme vigilance" on the part of security teams working to protect healthcare institutions.