Patient health data leaked from dentists' information system
At the end of August, Innovaatik — the company providing information‑system services to dental‑care providers — notified the police that their managed computer system had been repeatedly accessed illegally and patient personal data, including health data, had been downloaded. On Wednesday, police detained a 45‑year‑old Estonian citizen as a suspect.
The suspect no longer has access to the data, and wider dissemination was likely prevented, the prosecution and police said.
According to Jete Luik, head of the Cybercrime Bureau at the Central Criminal Police, Sunday's report indicated a large‑scale data leak.
"We immediately began investigating to determine the full extent of the leak and to stop the data from spreading further," Luik said.
Initial assessments show the leak affected data from more than 300 Estonian healthcare providers. The police will determine during criminal proceedings how many patients' data reached the suspect. Based on information gathered so far, personal identification codes, email addresses and health data were downloaded from Innovaatik's database. Healthcare providers will notify patients if necessary.
Current information suggests the suspect accessed the database illegally starting at the end of June. Most of the downloaded data concerned dental treatment, but may also have included other medical history.
"While cybercrime often involves international actors, in this case the suspect operated in Estonia. We have established that he had a prior connection to the company, and initial assessments suggest his motive was to draw attention to security vulnerabilities in the information system," Luik explained.
According to state prosecutor Vahur Verte, current information indicates the suspect did not misuse the data or pass it on to anyone.
"The victim acted commendably quickly. Upon discovering the incident, they immediately contacted the police, which allowed us to act fast and detain the suspect. Based on the current version of events, we recovered all data that was illegally downloaded, and there is no reason to believe the suspect shared it or made backups. Thanks to rapid action, wider dissemination was likely prevented," Verte said.
The prosecutor added that people have no choice at the doctor's office about whether to disclose their phone number or health concern. People trust that just as doctors treat patients responsibly, those involved in providing healthcare services will treat entrusted data with equal care.
"A stolen password can easily be replaced, but a phone number, home address or medical history that reaches a criminal cannot be changed. Harm caused by sensitive data falling into the wrong hands is very difficult or impossible to remedy," Verte said.
According to the head of the Cybercrime Bureau, cybercriminals deliberately seek access to increasingly sensitive data.
"Therefore, companies processing people's health data must treat cybersecurity with particular responsibility," Luik said.
Such incidents can also be easily exploited by other criminals to create new fraud schemes.
"We ask people to be cautious if someone contacts them regarding the data leak. If anyone demands money for supposedly leaked data, it is likely a scam," Luik said.
Criminal proceedings were initiated under the article concerning unlawful access to a computer system. The investigation is being conducted by the Cybercrime Bureau of the Central Criminal Police and led by the Office of the Prosecutor General.
--
Editor: Karin Koppel, Argo Ideon
