Case Study on a Session Hijacking Attack: The 2021 CVS Health Data Breach

Abstract

The CVS medical data breach in March of 2021 was a source of anxiety, fear, and anger in many users, leading to lower customer loyalty. Our study found that their websites used misconfigured databases, allowing an adversary to steal healthcare data through session hijacking attacks. Customers’ search metadata containing email addresses, prescriptions, and other medical search queries, were stored in cloud-hosted log files. Although no concrete evidence of data misuse was uncovered, the research found that over a billion confidential search queries were potentially exposed to adversaries. This paper analyzes the data breach methodology and impact in detail and provides possible defense strategies against such attacks. It violates the security and protection regulations mandating proper confidentiality of users’ private medical and healthcare information. This paper also outlines possible defense measures against healthcare data session hijacking attacks, including having policies in place, such as an incident response plan, preserving evidence of the breach, and isolating the data breach.