The question of how this could have happened in the first place looms larger. So do questions about UPMC's grasp of its own data security and its response to this hack.
After all, UPMC said it learned of the breach when employees reported fraudulent tax returns had been filed using their identities. And with federal prosecutors, the IRS, the Secret Service, the U.S. Postal Inspection Service and police investigating, UPMC now says it was informed by authorities that all employees could have been affected. Why didn't UPMC detect the breach — and realize how extensive it was — on its own?
When hackers hit health care, patient or payment records — not payroll data — usually are stolen, according to Larry Ponemon, president and founder of the Ponemon Institute, a Michigan cybercrime research organization. “Employee data,” he says, “tends to be better protected.” Why wasn't UPMC employees' payroll information “better protected”?
Those responsible for this hack must be brought to justice, of course. And UPMC, owing its employees far better payroll security, must take a more proactive approach to avoid a repeat of this data breach, which its 62,000 employees never should have had to worry about.
©2014 The Pittsburgh Tribune-Review (Greensburg, Pa.)
