Panic at the DISCO: When Patient Data Hits the Dance Floor

Panic at the DISCO: When Patient Data Hits the Dance Floor

Speakers: Marina Bochenkova, Digital Forensics and Incident Response, Z-CERT

Conference: Area41

YouTube: https://www.youtube.com/watch?v=cbtdh7am5Iw

Overview

In "Panic at the DISCO," Marina Bochenkova of Z-CERT unravels a perplexing and deeply concerning case of patient data exposure in the Netherlands, stemming not from a sophisticated cyberattack, but from profound negligence and systemic failures in data handling and asset disposal. The talk details a real-world investigation that began with a seemingly innocuous discovery: a random individual purchasing used hard drives at a flea market, only to find them brimming with highly sensitive personal and medical information belonging to Dutch citizens. This incident quickly escalated into a complex forensic puzzle, highlighting critical vulnerabilities in the healthcare supply chain and the alarming gaps in regulatory oversight.

Bochenkova, a digital forensics and incident response specialist for the Dutch national C-CERT for healthcare, meticulously recounts her team's journey to trace the origins of these drives, identify the affected organizations, and understand why such a catastrophic data breach went unnoticed for years. Her narrative, likened to a "true crime podcast," exposes the intricate web of corporate structures, legal ambiguities, and human errors that allowed patient identification documents, prescriptions, test results, and even citizen identification numbers (BSNs) to end up for sale for five euros a piece. The talk serves as a stark reminder that the most significant threats to data privacy often arise not from malicious actors, but from a pervasive lack of accountability and secure practices across the entire data lifecycle.

Background

▶ Watch: Hook: Man finds patient data on flea market hard drives (0:00)

The unsettling chain of events began in February 2025, when a tech enthusiast stumbled upon a vendor selling hard drives at an abandoned airport flea market in the Netherlands. For a mere five euros each, he acquired several drives ranging from 15 GB to 500 GB. Expecting them to be empty or at least wiped, he was shocked to discover each drive was "full of personal patient data of Dutch citizens." This included highly sensitive information such as identification documents, prescriptions, test results, scan images, dates of birth, addresses, and the Dutch citizen identification number (BSN)—literally "everything you could give that is the most personal intimate information." Recognizing the gravity of the situation, the man bought the remaining drives and reported his findings to the police.

However, the initial response from law enforcement and the Dutch Data Protection Authority (DPA) was underwhelming. They deemed the situation not technically a crime, as the drives were sold, not stolen, and there was no evidence of extortion. The case, therefore, landed in the lap of Z-CERT, the national C-CERT for healthcare in the Netherlands, due to its intersection of healthcare data and security. The investigation, codenamed "Operation Disco" (likely a portmanteau of "disk" and "onderzoek" — Dutch for investigation), revealed that the drives originated from Nortada, a Dutch ICT company that provided comprehensive IT services to general practitioners, pharmacies, and various medical institutions. These services ranged from network and systems administration to data management and electronic patient records. Nortada ceased operations in July 2023, following the death of its owner, leaving a significant void in data stewardship that ultimately led to this alarming exposure. The initial forensic challenge for Z-CERT involved processing approximately 50 separate hard drives, totaling over 2 terabytes of data, which, due to a lack of dedicated secure infrastructure, were initially stored in a server room accessible to non-forensics personnel.

Key Findings

▶ Watch: Drives' origin: Deceased owner's IT company, Nortada (4:30)

The investigation uncovered a staggering array of facts that painted a picture of widespread negligence and systemic failure. Initially, Z-CERT identified that the ~50 hard drives contained patient data from at least 143 distinct healthcare organizations. However, based on further discoveries, Bochenkova confidently stated that the "scope of the data breach is quite a bit bigger than just those 50 drives."

A critical breakthrough was determining the timeline of Nortada's demise. The owner died on July 1st, 2022, a full year before the company was officially deregistered in July 2023, and two and a half years before the drives were discovered at the flea market. This significant gap raised questions about who was responsible for the data during this period. The company itself had a complex structure: starting as a sole proprietorship in 2006, incorporating as a BV (private limited company) in 2018, and even having a non-profit entity created in 2020 for financial administration, though its registration was suspiciously backdated to 2022.

The key to understanding the disposal of the drives pointed to a notary responsible for handling the closure of the incorporated company. In the Netherlands, an incorporated company's assets are its property and are inherited, typically by a next of kin or a legal professional like a notary, who then becomes responsible for its administration and closure. Bochenkova's attempts to contact this specific notary were met with silence; instead, the notary merely updated and closed the non-profit's registration shortly after being contacted, rather than providing any answers. This evasive behavior, coupled with Bochenkova's discovery of a prior, identical incident where a notary was fined for selling servers with patient data, strongly implicated the notary in the improper disposal.

Further investigation, including an interview with an ex-employee of Nortada (found through a serendipitous connection via fencing), revealed that the company had been experiencing severe financial difficulties. The owner couldn't pay salaries for months, which likely prompted the incorporation in 2018 (to shield personal liability) and ultimately led to the decision to sell company assets, including the hard drives, rather than properly destroying them. The ex-employee also expanded the known client base beyond just general practitioners, mentioning lawyers' offices, 18 pharmacies in the Breda area, and even payment terminals/cash registers for retail stores, including Lidl, suggesting an even broader potential exposure of non-healthcare related sensitive data. The chilling discovery that the Nortada helpline was still active years after the company's closure, and that the notary continued to update company registration details years after the owner's death, underscored the pervasive negligence.

Technical Deep Dive

▶ Watch: Notary's role: Responsible for company closure, selling drives (18:40)

The initial phase of the investigation presented significant technical hurdles. Z-CERT was faced with over 2 terabytes of data spread across nearly 50 individual hard drives, originating from more than 100 different organizations. The data itself was unstructured, messy, and lacked any consistent record-keeping, making traditional forensic analysis challenging. Bochenkova's colleagues initially used Autopsy to grep for information and run scripts, but the sheer volume and disorganization of the data proved cumbersome.

Bochenkova, preferring a more targeted and efficient approach, sought a method to analyze the data without ingesting entire "bloated Windows garbage" full disk images, which she estimated contained 80% irrelevant data. Her primary goal was to extract file system metadata to determine which documents were accessed after the owner's death, identify files that had been moved or copied, and detect any USB drive activity. To achieve this, she turned to Velociraptor, a powerful open-source endpoint visibility and collection tool, leveraging its dead disk forensics capabilities.

The Velociraptor dead disk forensics workflow involved several key steps:

1. Enrollment: The first step was to enroll the raw .image file of a Windows disk into Velociraptor, treating it as a "new client" but indicating it was an image rather than a live system.
2. Remapping File Generation: Velociraptor required a remapping file, which essentially provided a map of the image's file system, allowing the tool to interact with the dead disk as if it were a live endpoint.
3. Write-back File Generation: A write-back file was also generated, containing a unique and static client ID for the image. This ensured that Velociraptor could consistently identify and query the same image across multiple sessions.
4. Configuration and Execution: Once these files were generated, Bochenkova would start Velociraptor with the client configuration file, pointing it to both the remapping and write-back files. This enabled her to access Velociraptor's graphical user interface (GUI), explore the virtual file system, and run various collectors.

Bochenkova specifically focused on collectors designed to extract metadata such as MACB times (Modified, Accessed, Created, Birth). She explained how comparing a file's creation time (Birth time) with its modified time could easily reveal file copy activity: if a new file's creation time is more recent than its inherited modified time (from the original file), it indicates a copy operation. She successfully validated this methodology by locating the specific document that the Dutch man who bought the drives had opened.

Despite the power of Velociraptor, the investigation was hampered by practical limitations. The team's hardware could only handle two or three Velociraptor clients (disk images) concurrently, making the process of analyzing nearly 50 drives extremely time-consuming and difficult to automate. Bochenkova candidly admitted to resorting to a "notepad of commands" for a copy-paste workflow, highlighting the real-world constraints often faced in forensic investigations. The initial focus on individual metadata for breach notification shifted when Z-CERT decided to inform organizations rather than individuals, a decision influenced by a colleague's discovery of a "nice neat list of all of the healthcare organizations" on drive number 48. This finding, while simplifying the notification process, underscored the chaotic and opportunistic nature of the investigation.

Demo / Proof of Concept

▶ Watch: Notary's suspicious actions and non-response to inquiries (19:30)

While the talk did not feature a live, interactive demonstration of Velociraptor or a proof-of-concept exploit, Marina Bochenkova provided a detailed walkthrough of her forensic methodology and its successful application in the actual investigation. She explicitly described the steps for using Velociraptor's dead disk forensics mode, from enrolling an image and generating remapping/write-back files to running collectors and analyzing metadata. The efficacy of her approach was validated when she successfully located the exact document that the initial Dutch discoverer of the drives had opened, confirming that her analysis techniques were accurate and capable of extracting relevant information from the compromised disks. This internal validation served as the proof of concept for her chosen technical path within the broader investigation.

Defensive Implications

▶ Watch: Conclusion: Negligence, incompetence, and call to action (29:00)

The "Panic at the DISCO" case serves as a critical wake-up call for organizations, particularly those in the healthcare sector, regarding the often-overlooked risks associated with third-party IT service providers and asset disposal. The defensive implications are multi-faceted and demand immediate attention:

1. Robust Supply Chain Risk Management: Healthcare organizations must rigorously vet and continuously monitor their IT service providers (MSPs). Contracts must explicitly detail data ownership, retention periods, secure data destruction protocols, and audit rights, especially upon contract termination or provider insolvency. Organizations need to understand the full data lifecycle managed by their vendors and demand proof of adherence to security standards, such as destruction certificates for hardware.
2. Enforceable Data Retention Policies: It is imperative for organizations to implement and strictly enforce data retention policies. Data should only be stored for as long as legally required or operationally necessary. Keeping data "without any reason to" dramatically increases the attack surface and the potential impact of a breach. Regular audits of stored data are crucial to ensure compliance.
3. Mandatory Secure Data Destruction: Simple deletion or reformatting of hard drives is insufficient for sensitive data. Organizations must adopt and enforce industry-standard secure data sanitization methods, such as physical destruction (shredding), degaussing, or multi-pass overwriting to Department of Defense (DoD) standards. This applies to all hardware, including servers, workstations, and even individual hard drives, at the end of their lifecycle. The notary's failure to even move files to the recycling bin highlights a fundamental lack of understanding.
4. Enhanced Oversight and Accountability: Medical companies must exert greater oversight over how their sensitive data is managed by third-party providers. This includes regular security assessments, penetration testing, and clear communication channels to ensure that security postures are maintained and incidents are reported promptly. The lack of interest and oversight by the medical companies in this case was a significant contributing factor.
5. Advocacy for Clearer Regulatory Frameworks: The ambiguity surrounding the legality of selling hardware with data underscores a gap in current regulations. Organizations should advocate for clearer laws and stricter enforcement mechanisms, particularly concerning data handling during company closures, bankruptcies, or transfers of ownership. The DPA's initial reluctance to act highlights the need for more proactive and prescriptive legal frameworks.
6. Internal Forensic Preparedness: The Z-CERT team's persistence, even when external authorities were hesitant, demonstrates the value of having internal or readily accessible forensic capabilities. Organizations should invest in training and tools (like Velociraptor) to investigate incidents thoroughly, even when official channels are slow or uncooperative.
7. Education and Awareness for All Stakeholders: The incident reveals a profound lack of awareness among various stakeholders, including legal professionals (notaries) and even the IT company itself, regarding their responsibilities for data protection. Comprehensive education programs are needed to instill a culture of security and accountability across all parties handling sensitive information.

Key Takeaways

• Negligence is a Major Threat: This case unequivocally demonstrates that gross negligence and incompetence, rather than sophisticated cyberattacks, can lead to widespread and devastating data breaches.
• Supply Chain Risk is Paramount: Organizations must recognize and actively manage the inherent risks posed by third-party IT service providers, ensuring robust contracts and oversight for data handling and disposal.
• Secure Data Destruction is Non-Negotiable: Simple deletion is inadequate for sensitive data. All hardware containing personal information must undergo proper, verifiable data sanitization or physical destruction at end-of-life.
• Regulatory Gaps Demand Attention: Current legal and regulatory frameworks may not adequately address data breaches stemming from corporate dissolution or asset disposal, creating loopholes for accountability.
• Forensic Persistence Pays Off: Even with limited resources and initial resistance from authorities, persistent and methodical forensic investigation can uncover critical details and expand the understanding of a breach's scope.
• Data Retention Policies are Critical: Organizations must implement and enforce strict data retention policies, ensuring sensitive information is not stored indefinitely without a legitimate purpose.

About the Speaker(s)

Marina Bochenkova is a Digital Forensics and Incident Response specialist at Z-CERT, the national C-CERT for healthcare in the Netherlands. In this role, she is at the forefront of protecting sensitive medical data and responding to security incidents affecting the Dutch healthcare sector. Beyond her work in forensics, Marina is also actively involved in expanding Z-CERT's capabilities in medical device testing and investigation, reflecting her broader interest in the security of operational technology (OT) and critical infrastructure. Based in Amsterdam, she is also one of the organizers for BSides Amsterdam. Marina's dedication to uncovering the full truth, even in the face of institutional inertia, was a driving force behind the investigation detailed in her talk. She was also supported in this investigation by her colleague, Youssef.