Two owners of a pharmaceutical wholesale company were sentenced Friday to a total of 38 years in prison for orchestrating a complex, nationwide drug diversion scheme that harmed vulnerable HIV-positive patients, placed countless others at risk, and corrupted the supply chain for prescription drugs in the United States.
“Patrick and Charles Boyd did not just commit fraud and cost taxpayers millions of dollars, they preyed upon some of the most vulnerable members of our society: HIV patients who depend on life-saving treatments to manage their disease,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “Fraud schemes like this one undermine the integrity of our supply chain for necessary prescription drugs. These defendants will rightly spend years in prison for their reprehensible conduct, which took advantage of people for illicit profit….
IT & DATA SECURITY (MITIGATING THE “INSIDER THREAT”)
As seen in the TD Bank case, an employee with too much “access” can sell your customer data to syndicates.
- Principle of Least Privilege (PoLP): Employees should only have access to the specific folders and databases required for their current task.
- Access Revocation: Have a “Termination Checklist” that ensures all digital access (Email, VPN, Banking) is revoked within 60 minutes of an employee resigning or being dismissed.
- System Logs & Audit Trails: Enable “Read/Write Logging” on your server. If a customer’s data is leaked, you need to know exactly which login accessed that record and at what time.
- Encryption at Rest: Ensure that sensitive files (like your customer ID numbers or payroll spreadsheets) are encrypted so that if a staff member copies them to a USB, they cannot be read.