WILLIS: AFTER ‘YEAR OF THE BREACH,’ COMPANIES SHOULD REVIEW CYBER COVERAGE; BUT WILL THEY BUY?
Anya Khalamayzer & Chad Hemenway. National Underwriter, Property & Casualty. 08/20/2012.
Willis refers to 2012 as the “Year of the Breach” and strongly urges companies to closely examine their insurance coverage and risk management strategies to determine whether they are sufficiently protected for cyber exposures. Ann Longmore, executive vice president of FINEX, Willis’ financial, executive risk and professional liability business, says that the major assets of every Fortune 500 company are intellectual and a cyber attack on the operating system containing this information could be disastrous. Longmore emphasizes the ingenuity of hackers and says that the battle for control of assets and information is continuously changing. According to the Identify Theft Resource Center, the average size of a data breach in the U.S. was $5.5 million last year. In just the first quarter of this year, nearly 4.5 million records were exposed by 105 breaches.
Some companies are finding that their insurance policies do not cover the cost of cyber attacks. For example, last August Zurich America filed a lawsuit against Sony claiming that its general liability policy did not cover data breaches. Willis says that commercial general liability policies use the term physical damages, which does not always apply to electronic data. So, it is important that companies adopt strategies for offsetting the potential cost of a cyber breach. Corporate insurance managers could benefit from obtaining endorsements for data breach, cyber extortion and digital asset losses. The Chubb 2012 Public Company Risk Survey found that 65 percent of public companies have not purchased cyber liability insurance, 63 percent of companies’ decision makers expressed concerns about cyber risk and 57 percent of the survey respondents did not include cyber insurance in their security breach plans.
How did $14 million in drugs vanish from a UM pharmacy?
By John Dorschner The Miami Herald
A UM pharmacy technician is charged with stealing $14 million in expensive cancer drugs over three years before he was discovered.
This video by a UM surveillance camera of the pharmacy at the Sylvester Comprehensive Cancer Center allegedly shows pharmacy technician Manuel Pacheco removing boxes of the cancer drug Neulasta, worth $2,600 per syringe. The video is from the court file in his case, in which he is charged with grand theft, trafficking in contraband prescription drugs and dealing in stolen property.
Read complete article. [+]
UM alleges that $14 million in drugs are missing from that pharmacy over a three year period.
This video by a UM surveillance camera of the pharmacy at the Sylvester Comprehensive Cancer Center allegedly shows pharmacy technician Manuel Pacheco removing boxes of the cancer drug Neulasta, worth $2,600 per syringe. The video is from the court file in his case, in which he is charged with grand theft, trafficking in contraband prescription drugs and dealing in stolen property. UM alleges that $14 million in drugs are missing from that pharmacy over a three year period.
Olga Hutnik, a pharmacy buyer at the University of Miami, noticed something odd in May 2011 when she looked at the results of a new program to track drugs in the UM medical system: Hundreds of syringes of an expensive cancer drug were apparently missing.
The new software “was not the most trustworthy,” Hutnik later told investigators, so she decided to hand-count the syringes of Neulasta, a medication used to boost white blood cells to reduce the risk of infection at a cost of about $2,600 per dose.
That decision, court records say, led eventually to the arrest of a UM employee – and a stunning discovery that $14 million in prescription drugs had gone missing over a three-year period from UM’s Sylvester Comprehensive Cancer Center. Pharmacy technician Manuel Gerardo Pacheco – who seemed to be “living beyond his means,” investigators said later – was charged with four counts of grand theft, two counts of trafficking in contraband prescription drugs and one count of dealing in stolen property.
He has pleaded not guilty.
“Obviously, somebody let the ball slip,” said Randy Kroner, a Miami forensic accountant. He said most large organizations have internal auditors that make sure the proper controls are followed – counting supplies that come in, tracking units that go out and then reconciling the two. “Looks like this case just fell through the cracks.”
In fact, both UM’s chief financial officer, Joe Natoli, and board member Norman Braman have said there were no inventory controls at the cancer pharmacy to keep track of supplies.
“That’s ludicrous,” said Michael Kessler, a certified forensic accountant who heads Kessler International, a financial services company with an office in Miami. “A hospital should track its supplies down to the last sponge and scalpel in the operating room. Somebody was asleep at the switch.”
In a statement last week, the UM Miller School of Medicine said rampant theft of pharmaceuticals is a national problem and UM had tight controls at several of its pharmacies, but controls at the cancer pharmacy “failed to quickly detect the employee theft of expensive non-controlled substances, actually life-saving chemotherapy drugs for cancer patients. As soon as the theft was detected, physical security and inventory controls of pharmaceuticals at Sylvester were reviewed and strengthened.”
A follow-up internal audit found the cancer pharmacy’s controls are now sufficient. “The university is seeking reimbursement for losses from the employee and its insurance carrier,” the statement said. In an April memo to employees about UM’s moves to control fraud, Natoli noted three major incidents at UM, including “a pharmacy technician with access to expensive drugs that were not under inventory control.”
Last fall, in a letter to fellow UM board members, Miami auto magnate Braman decried the pharmacy theft as an example of managerial ineptitude involving a “host of wrong doings” that “took months of forensic accounting to discover because of nonexistent inventory controls.”
Natoli told The Herald in May that UM was a “highly decentralized organization with old systems that had grown very, very rapidly,” and UM was working hard to put the necessary controls in place.
In the pharmacy case at Sylvester, the investigation began May 27, 2011, when Hutnik, a senior pharmacy buyer, met with UM security people about possibly missing drugs, according to a UM investigative report in the court file. An audit had found that between December 2010 and April 2011 there was a discrepancy of 680 units of Neulasta between what had been purchased and what had been dispensed.
Investigators zeroed in on Pacheco, then 54. UM Security Manager Lee Michaud had found that Pacheco had recently purchased a $56,000 BMW without getting a loan.
Pacheco’s lawyer, David S. Markus, has acknowledged in court filings that “there is evidence that the defendant committed theft,” but he said on Friday, “They’re scape-goating my client, trying to blame him for the whole $14 million when it was really open season at the pharmacy where anyone could have taken things because the controls weren’t there.”
On June 1, 2011, hidden video surveillance cameras were installed to monitor refrigerators containing Neulasta. At 6:36 a.m., Friday, June 3, the cameras caught Pacheco removing several blue boxes containing Neulasta from the refrigerator and slipping them into the right pocket of his lab coat.
The following Monday, at 6:38 a.m., a UM investigator monitoring the cameras saw Pacheco remove blue boxes from the refrigerator and again put them in his pocket, according to the UM investigative report. Michaud and another UM investigator confronted Pacheco in the pharmacy. “He was asked to remove his lab coat. In the pockets were four boxes … of Neulasta and 12 small vials of Aloxi,” an anti-nausea medication injected in patients after chemotherapy, according to Michaud’s report.
Aloxi costs $168 a vial. In a minute, Pacheco had slipped $12,416 worth of drugs into his pocket, according to the investigative report.
He immediately confessed, according to Michaud’s report, saying he had been removing Neulasta four doses at a time from the pharmacy refrigerator since November 2010.
Pacheco said he sold the drugs to a Jose Suarez, “who he had met several years ago when he worked in a retirement home.” For four boxes of Neulasta, Suarez paid $1,400, Pacheco said. UM had paid about $10,000 for four boxes.
An active “gray market” for expensive drugs exists in Latin America and elsewhere, according to investigators.
Pacheco said Suarez had also asked for Aloxi. The two men were supposed to meet that afternoon so Pacheco could hand over his recent take, which included another 50 boxes of Neulasta in his refrigerator at home.
In an interview with a special agent from the Food and Drug Administration, Max Trimm, Pacheco estimated that Suarez had given him between $30,000 and $35,000 for the stolen drugs. Pacheco later upped that figure to $60,000, according to an investigator’s report.
Pacheco allowed investigators to search his home, according to an investigator’s report. In a small refrigerator in Pacheco’s bedroom, they found 163 doses of Neulasta and 20 doses of Aloxi.
They also found doses of Avastin and Oxaliplatin, used to treat colon cancer; Rituxan, used for non-Hodgkin’s lymphoma; Aranesp, for chronic kidney failure, and Velcade, used for bone-marrow cancer.
All together, the drugs in the refrigerator had a value of $734,639.18, according to an investigator’s report.
At 2:42 that afternoon, Pacheco called Suarez with detectives listening in. They agreed to meet in an hour at an Outback Steak House in West Kendall.
But that meeting was cancelled, several other attempts for detectives to observe Pacheco giving the drugs to Suarez fell through, and Suarez stopped responding to Pacheco’s phone calls.
To determine the extent of its losses, UM hired Navigant Economics, which specializes in financial analysis. Five months after Pacheco was caught, on Oct. 31, Navigant reported that the “university’s total loss as a result of Pacheco’s thefts over a three year period was at least $14,358,637.”