FBI Warning Issued About Hive Ransomware

The FBI has issued a warning about Hive ransomware after the crime group took down IT systems at Memorial Health System in Ohio The alert details indicators of compromise and tactics, techniques and procedures—or TTPs—associated with ransomware attacks by the apparent ransomware-as-a-service operation. The full release can be found here:  https://www.ic3.gov/Media/News/2021/210825.pdf In addition to the details of the attack, the FBI has issued...

Read More

Alleged HVAC Hack Shines Spotlight on OT Risks to Healthcare

ENE Systems hack said to affect 3 Boston Hospitals   A hacking incident that reportedly targeted a Massachusetts-based ENE Systems that provides HVAC systems to several Boston-area hospitals and others shines a spotlight on the growing cybersecurity risks involving IoT devices and OT equipment.   Call to Action Perhaps the most high-profile incident involving an HVAC hack was the 2013 Target breach. It resulted in 41 million...

Read More

Health Data Breach Trends

Ransomware Attacks, Vendor Incidents Continue to Dominate So far in 2021, some 383 health data breaches affecting more than 27 million individuals have been added to the HHS wall of shame. That includes 131 breaches affecting nearly 10 million since the end of May. Of the 2021 breaches, the vast majority — 283 breaches affecting 26.1 million individuals — were reported as involving hacking/IT incidents. Largest Breaches of 2021 Florida Healthy...

Read More

Kaseya Breach Points to Risks in VSA/MSP Systems

Over the last week, more than a thousand companies, many of them small businesses, were dealing with the fallout from the Kaseya mass ransomware incident. In the wake of the devastating compromise of Kaseya’s popular IT management tool, researchers and security professionals are warning that the debacle isn’t a one-off event but part of a larger trend. Hackers are increasingly targeting the entire class of tools that administrators...

Read More

Nebraska Medicine Data Breach Lawsuit Has Proposed Settlement

Complaint Alleged Multiple Security ‘Failures’ Leading to 2020 Cyberattack A federal court has approved a proposed settlement in a class-action lawsuit filed in February against Nebraska Medicine. This is in the wake of a 2020 malware attack and exfiltration of sensitive personal data and medical records of tens of thousands of individuals. The costs of the proposed settlement could exceed $37 million in patient reimbursements.  Out...

Read More

How ‘SEO Poisoning’ Is Used to Deploy Malware

Criminals targeting business people with malware-laden documents SolarMarker backdoor malware operators are using “SEO poisoning” techniques to deploy the remote access Trojan to steal sensitive information, Microsoft reports. SEO poisoning attacks use PDFs stuffed with links to malware that is used to steal data and credentials from browsers. Attack Analysis In April, cybersecurity firm eSentire found that hackers had flooded the...

Read More

Ransomware Continues to Cause Disruptions

Oil pipelines and Apple among most recent targets Seemingly every week, there’s a new disruption caused by ransomware. Some of them are more noteworthy than others, with the recent pipeline disruption getting the most coverage followed by a $50M ransom demanded from Apple a few weeks ago. It’s all part of a trend of escalating criminal activity centered around ransomware. Trends While the high-profile demands and disruptions are generating...

Read More

Phishing Threats Continue

Phishing continues to be one of the most prominent, and damaging, ways that cybercriminals gain access to healthcare networks. It is also one of the most straightforward threats for an organization to deal with. Unlike a number of more technical cybercrimes, phishing can be prevented with simple training. Employees who have received training in spotting and reporting phishing emails dramatically reduce the risk that malware and ransomware will...

Read More

70 Breaches Added to Wall of Shame in Last Month

159 Major Breaches in 2021 About 70 major health data breaches have been added to the federal tally in the last four weeks as ransomware attacks have persisted and breaches at vendors have affected clients. As of Monday, the Department of Health and Human Services’ HIPAA Breach Reporting Tool website showed 159 breaches affecting a combined total of 12.5 million individuals have been added to the tally so far this year. That’s up...

Read More

Proposed Rule Changes Would Dramatically Increase Reporting Requirements for Banks

The Treasury Department’s OCC, Federal Reserve Board and the FDIC are proposing rule changes that would dramatically increase the reporting requirements for banks that experience a “computer security incident”. While the time for public comment has passed and the rule changes are not final yet, here is the sum-mary of what is being proposed. “The OCC, Board, and FDIC (together, the agencies) invite comment on a notice of proposed rule-making...

Read More