[Cryptography] heartbleed first blood?

[ianG]

In the hunt for actual data of thefts not myth, ftr:

https://www.trustedsec.com/august-2014/chs-hacked-heartbleed-exclusive-trustedsec/

As many of you may have already been aware, a breach at Community Health
Systems (CHS) affecting an estimated 4.5 million patients was recently
revealed.  TrustedSec obtained the first details on how the breach
occured and new information relating to this breach. The initial attack
vector was through the infamous OpenSSL “heartbleed” vulnerability which
led to the compromise of the information.

This confirmation of the initial attack vector was obtained from a
trusted and anonymous source close to the CHS investigation. Attackers
were able to glean user credentials from memory on a CHS Juniper device
via the heartbleed vulnerability (which was vulnerable at the time) and
use them to login via a VPN.

>From here, the attackers were able to further their access into CHS by
working their way through the network until the estimated 4.5 million
patient records were obtained from a database.  This is no surprise as
when given internal access to any computer network, it is virtually a
100% success rate at breaking into systems and furthering access.  This
is the first confirmed breach of its kind where the heartbleed bug is
the known initial attack vector that was used.  There are sure to be
others out there, however this is the first known of its kind.
...

Also:
http://time.com/3148773/report-devastating-heartbleed-flaw-was-used-in-hospital-hack/


(iang)