Automatic Extraction of Protected Health Information from Multilingual Hacker Communities

Protected Health Information (PHI, e.g., electronic health records, insurance information) is increasingly stolen in data breaches by malicious actors with the intent to sell to others in hacker communities. These actors often protect themselves by describing the content and availability of PHI data using encrypted messaging platforms (e.g., Telegram & Discord). However, the extent and nature of these PHI discussions are not well known. Therefore, in this research, we propose a Named Entity Recognition Framework for PHI (NERF-PHI) to systematically analyze PHI-related hacker conversations. To conduct our research, we collected more than three million multilingual hacker posts from Discord servers and Telegram groups. Utilizing open-source machine translation tools, we translated conversations to English and extracted information related to vulnerable individuals and medical entities. Results from our study suggest that encoder-based Large Language Models show significant promise for extracting PHI-related information from hacker communities and can be used by cybersecurity professionals and law enforcement to combat PHI misuse. Our study is also one of the first comprehensive analyses of multilingual PHI discussions in hacker communities.