Hacker attacks Defense pharmacy site

One or more hackers attacked the website and Internet domain of the Defense Department's prescription drug database, the PharmacoEconomic Center, the security firm Imperva reported Friday. The site and domain remained inaccessible into Monday afternoon. Attempts to reach the site resulted in the message:

www.pec.ha.osd.mil

Is

Temporarily Unavailable

We're working to resolve this issue

Programs on the PharmacoEconomic Center site and domain include the Prescription Medication Analysis and Reporting Tool, which maintains a medication profile for troops slated for deployment. It also includes a version of that tool developed to track drugs prescribed for soldiers in warrior transition units, special organizations designed to assist wounded soldiers and their families. Both programs remained inaccessible today.

The PharmacoEconomic Center, in partnership with the Veterans Affairs Department and the Defense Supply Center-Philadelphia, manages national pharmaceutical contracts for Defense and VA as well as a prescription formulary describing the types of drugs that can be prescribed to active-duty military personnel, retirees and their families.

In addition, the PharmacoEconomic Center maintains the U.S. Central Command Central Nervous System Drug Formulary, detailed in a Nextgov investigation last week.

Imperva said the hacker offered full control and root access to the domain for $399. Security blogger Brian Krebs reported the hacker also offered to sell personally identifiable information from the sites hacked for $20 per 1,000 records.

Other military sites attacked by this hacker included the Army Communications-Electronics Command and the South Carolina National Guard. Both sites were unavailable during the weekend and remain so today.

One Army doctor, who declined to be identified, said the attack against the PharmacoEconomic Center site and domain came at an embarrassing time, as the Military Health System kicks off its annual three-day conference today in Oxon Hill, Md.

If the hacker penetrated the PharmacoEconomic Center databases, he or she would glean a lot of information about military prescription drug use, and the breach indicates that MHS views prescription information as a "low priority" item, the doctor said.

Neither the Army Office of the Surgeon General, which provides administrative support and has oversight responsibility for the PharmacoEconomic Center, nor MHS replied to e-mailed queries from Nextgov on Sunday.

Nextgov will update this story if the agencies respond.