FBI probes hacking incident at Indiana clinic

13.02.2006
A Fort Wayne, Ind.-based orthopedics clinic with more than a dozen facilities in the state has called in the U.S. Federal Bureau of Investigation to investigate a hacking incident that highlights the dangers companies can face from the placement of hidden back doors in their software.

The case involves Orthopaedics Northeast, which last month suddenly began experiencing serious performance slowdowns with Webchart, a clinical document management system supplied to the clinic by Medical Informatics Engineering Inc., a health care software developer that's also based in Fort Wayne.

MIE, which no longer supports the clinic's Webchart installation, last week confirmed that it is part of the FBI's investigation. But it denied that it was involved in the hacking activities at the clinic, which is known informally as ONE.

The performance problems, which on one occasion caused the Webchart software to become totally inaccessible for several days, were eventually traced to deliberate changes made in the system's underlying MySQL database, according to Todd Plesko, CEO of triPractix LLC, a medical systems integrator that now manages the clinic's IT services.

The database changes were made by someone who illegally accessed the system nine times over a period of two weeks, initially via a back door using a hard-coded username and password, said Plesko, whose company is headquartered in Fort Wayne as well.

Uncovering the intrusion led to the discovery of "a backdoor realm called MIE Private, with a username of MIE, that would completely bypass all of Webchart's front-end authentication," he explained.