Re: Undisclosed breach at major US facility

["Brian Eaton" <eaton.lists () gmail com>]

On 7/3/06, r r <anothersecurityquestion () gmail com> wrote:
> Any useable thoughts?

If you disclose this to anyone, don't expect to remain anonymous for
very long.  This hypothetical server probably has hypothetical logs
with your hypothetical IP address.  Your hypothetical ISP will almost
certainly be willing to help the authorities get in contact with you.

Even if you don't disclose this, you still might get contacted once
the owners of the server clue in to the problem.

I suspect contacting the affected hospitals might be a good start
towards getting this taken care of.  The hospitals have more clout
with the software vendor than you do.  If you're scared of going to
the hospital administrators, then the media might be a good option.

I hope you don't end up in court.

Regards,
Brian

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/