A week after a hacker claimed to have stolen sensitive patient information from a [Virginia] state Web site that tracks prescription drug use, state officials say they don’t know whether the information was compromised.
Officials confirmed Wednesday that an unauthorized message was posted on the Prescription Monitoring Program Web site last Thursday. According to Wiki-Leaks, an open-government Web site, the message was a ransom note claiming that the entire database, containing more than 35 million prescription records, had been stolen by a hacker.
The hacker claimed to have deleted the original database and created an encrypted backup copy.
“For $10 million, I will gladly send along the password,” the message read. “You have 7 days to decide. If by the end of 7 days, you decide not to pony up, I’ll go ahead and put this baby out on the market and accept the highest bid.”
The hacker included an e-mail address with the user name “hackingforprofit.”
The FBI and the State Police are investigating. The Web site, operated by the state Department of Health Professions, has been shut down since last week for security reasons.
The Prescription Monitoring Program collects information about every prescription for certain federally controlled drugs dispensed by Virginia pharmacies. The list includes drugs with a high risk of abuse, such as morphine, OxyContin and Ritalin.
The database was set up as a pilot program in southwestern Virginia in 2003 and expanded statewide in 2006. Its purpose is to combat drug abuse by allowing health professionals to track prescriptions.
Access to the database is restricted to about 2,500 registered users, mostly doctors and pharmacists.
Emily Wingfield, chief deputy director of the Department of Health Professions, said the database contained 31.3 million prescription records as of Jan. 1 and about 1 million records are added every month. That lends some credibility to the hacker’s claim to…