A woman in Attleboro takes an at-home test and finds out she’s pregnant. She looks up nearby reproductive health clinics and finds one: Four Women Health Services, which has also been providing abortions for decades. She sends a request through an online chat on Four Women’s website to set up an ultrasound appointment.
Less than half an hour later, she receives a call to schedule an appointment and books one.
But the person who just called her doesn’t work for Four Women. They called to book her an appointment at the center across the street: Attleboro Women’s Health Center, or Abundant Hope.
That’s what allegedly happened last October. Four Women is now suing in federal court, alleging that at least four potential patients apparently had their messages intercepted by Attleboro Women’s Health Center — an entity that is not a licensed health care facility and does not provide abortions.
It is unclear exactly how Four Women’s patient communications were allegedly compromised. A digital security analyst contracted by Four Women, Robert Knapp with Rapid7 in Texas, said in court filings that the “most likely points” through which the center allegedly accessed patient data are Klara and AthenaHealth, two third-party vendors that Four Women uses to communicate with patients and manage their data. Neither company responded to GBH News’ requests for comment.
[…]
“I would love to hear from the app developers … I want to hear from tech people exactly what is happening,” Barnett said. “It’s actually quite rare that an app itself is so heavily compromised — like, technically speaking, that there’s some vulnerability that is being burned by some hackers.”
I doubt it’s anything so sophisticated. Probably purchasing targeted advertising and setting up front websites. It’s far easier to masquerade as another party than it is to steal their data.
