The FBI has not discovered the hacker who broke into the Virginia Department of Health Professions’ computer, nor has it discovered what private information was retrieved, Virginia’s Secretary of Health and Human Resources Marilyn B. Tavenner said yesterday. Questioned intensely by members of the House Appropriations Committee, Tavenner said the FBI believes it will take another two weeks to complete its investigation.
“They said it was like looking for a needle in the haystack, but they have ways to find the needle,” she said.
Someone broke into the department’s database of addictive prescription drugs, such as OxyContin, morphine and methadone. The data are kept to monitor who is using the drugs. The user’s name and address, the date of birth and the substance are in the database.
The department recognized an unauthorized message posted on the Web site on April 30. The computer systems were shut down and state authorities were notified. All data had been properly backed up and the backup files had been secured, Tavenner said.
Tavenner said computer security at the department was judged to be among the top 5 percent of state computer systems. She acknowledged, however, that she knows of no other state where security had been breached.
She said pharmacists and other drug providers are being alerted to be on the lookout for suspicious behavior in the event someone was using stolen material to buy drugs.
The FBI was called in as the lead investigator because the security breach was accompanied by a demand for ransom, Tavenner said.
Del. L. Scott Lingamfelter, R-Prince William, worried that terrorists could break into other Virginia computer systems, such as those of Virginia’s universities, and obtain important proprietary information.
Lemuel C. Stewart Jr., chief information officer for the state, suggested that organized crime could have breached the system.