Business Associate Breaches Affect Millions Nearly 1/3 of the major health data breaches added to the federal tally so far this year involve business associates, continuing a trend in recent years. A recent analysis by CI Security found that in the second half of 2020, nearly 75% of all records breached were tied to security incidents involving business associates. Currently, the HHS OCR website shows that 37 major breaches, affecting more than...

  Bureau and Security Experts Warn About Gang’s Effective Extortion Model   The FBI issued a warning this week over the growing threat from the operators behind the Egregor ransomware variant and other cybercriminal gangs affiliated with the group. Since September, the Egregor gang and its affiliates claim to have compromised approximately 150 corporate networks in the U.S. and other countries. In some cases, the extortion...

New Egregor ransomware has been gaining traction since emerging in September. A new form of ransomware is becoming increasingly prolific as cybercriminals turn to it as a preferred means of encrypting vulnerable networks in an effort to exploit bitcoin from victims. Egregor ransomware first emerged in September but has already become notorious following several high-profile incidents, including attacks against Barnes & Noble and video game...

From Ransomware and DDoS to Malware and SIM Swapping: Europol Describes Latest Threats According to the seventh annual Internet Organized Crime Threat Assessment, produced by Europol ransomware attacks remain the top cyber-enabled threat. But phishing, business email compromises and other types of fraud – many now using a COVID-19 theme – also loom large. Here are 10 of the top threats from the Europol report in alphabetical order....

Regulator: Georgia Clinic Showed ‘Systemic Noncompliance’ Federal regulators have announced a $1.5 million HIPAA settlement with Athens Orthopedic Clinic in Georgia, stemming from a 2016 breach involving The Dark Overlord hacking group that exposed the records of nearly 209,000 individuals. The exposed PHI included name, date of birth, SSN, patient demographic information, clinical information, and financial/billing information. The...

Two recent ransomware incidents targeted companies serving healthcare organizations, highlighting an emerging challenge for vendor risk management in the sector. Blackbaud, which sells cloud-based marketing, fundraising, and customer relationship management software, was recently hit by ransomware. Some of its affected clients are now being revealed. Meanwhile, medical debt collector firm R1 RCM, formerly known as Accretive Health, also has...

At least 275,000 individuals served by a variety of healthcare providers and health plans had data exposed as a result of a breach at Houston-based billing and debt collection vendor Benefit Recovery Specialists Inc. The company says that on April 30, it discovered a malware incident affecting certain company systems. BRSI customer files containing personal information may have been accessed and/or acquired between April 20 and April 30, 2020....

Risk Mitigation Tips Ransomeware Attacks continue to surge as two ransomware incidents recently reported to federal regulators as health data breaches illustrate. Recent ransomware-related data breaches reported to the DHHS OCR affected Woodlawn Dental Center based in Cambridge, Ohio, and Mat-Su Surgical Associates in Palmer, Alaska. Woodlawn Dental Incident The HHS “Wall of Shame” shows that Woodlawn Dental reported on May 18 that a breach...

Attackers are continuing to use concerns over COVID-19 to distribute ransomware and malware, including for smartphones. The healthcare sector continues to be the largest single target of cybercriminals, and they are exploiting the current situation. Culprits behind such attacks include cybercrime operators looking to make a fast buck as well as nation-states seeking to sow chaos. These attacks are hitting all levels of the U.S. healthcare...

As of early December, the HHS “Wall of Shame” shows that 462 major health data breaches affecting a total of nearly 41 million individuals have been logged in 2019. By the numbers: • 272 breaches were reported as hacking/IT incidents, affecting a total of nearly 36 million people, accounting for approximately 88 percent of people affected by breaches. • 136 breaches were reported as “unauthorized access/disclosure” breaches,...