Both Ransomware Groups Pose Serious Concerns to Sector, Warns HHS HC3 The U.S. government is warning that Healthcare entities should be on high alert for signs of the new BlackCat and Royal ransomware-as-a-service groups. On January 12th, the Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center issued a threat brief that warns that BlackCat conducts triple extortion, meaning it doesn’t just...

The number of successful ransomware attacks has doubled in the last 4 years. But there are concrete steps a healthcare organization can take to avoid costly — and potentially deadly — downtime and better protect themselves against an attack. 1. Move from on-premises servers and backups to the cloud. Doing so outsources availability, uptime, and security to the SaaS vendor and also facilitates better backup and recovery if something does happen....

Targeting of Providers, Plans and Partners Since 2009, healthcare breaches have affected the personal information of 370 million people. Quick math says that’s more than the entire U.S. population, and that’s only counting the major breaches affecting 500 people or more. The situation is growing worse. In just the last three years, the volume and frequency of breaches have nearly doubled, from 368 in 2018 to 715 in 2021. And the nation is on...

Red-Teaming Tool Poses Ongoing Risks When Used by Hackers, HHS Warns The Department of Health and Human Services’ Office of Information Security’s HC3 unit says attackers are weaponizing legitimate security tools. Russian hackers deployed Cobalt Strike’s command-and-control function during their attack against SolarWinds’ network management software. Hackers who earlier this year got into Cisco corporate IT...

Use of Social Engineering, Phishing to Divert Payments Cybercriminals are stealing multimillion-dollar payouts from healthcare payment processors by compromising user login credentials, the FBI warns the healthcare industry. In a recent alert, federal agents say they’ve received multiple reports of cybercriminals redirecting healthcare payments into their pockets. According to the FBI, cybercriminals used employees’ publicly...

Some 60 breaches affecting about 2.5 million individuals were added in July to the federal tally of major health data breaches. Those incidents continued a trend playing out in 2022: Large hacking incidents predominately involving ransomware attacks against providers, vendors, or both are responsible for an overwhelming amount of data theft. About 80% of the major breaches reported were related to hacking/IT incidents, and these breaches...

New draft of federal cybersecurity guidance could help healthcare organizations avoid regulatory fines in the wake of breaches. Federal regulators are looking for the adoption of “recognized security practices,” when investigating the aftermath of a breach involving protected health information. In 2021, Congress told the Department of Health and Human Services to consider whether a medical center or business associate can show that it...

Depending on where you put its tracking pixel, it might be. Lawsuit: Facebook Is Collecting Patient Data of ‘Millions’ Class Action Alleges Meta Pixel Code Tracks Websites, Patient Portal Interactions A class action is alleging Facebook unlawfully collects patient data from the online portals of hundreds of medical providers without knowledge or consent. The lawsuit, filed Friday (June 17, 2022) by an anonymous “John...

Why that might not be a good thing for Nebraska. Based on a study of thousands of cases that it has worked, incident response firm Coveware has found that the number of firms paying a ransom has dropped from 85% in Q1 2019 to 46% in Q1 2022. When victims do pay a ransom, in Q1 2022, they paid an average of $211,529, down 34% from the previous quarter, Coveware found. It attributes this to fewer victims paying, attackers overall infecting...

Authorities Warn Healthcare, Public Health Sectors of Latest Concerns Federal authorities are warning the healthcare sector of potential threats involving Lapsus$, including those related to the extortion group’s recent hack of identity management vendor Okta. The Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center, or HC3, in an advisory issued on April 7, warns of attack threats to the sector...