What do you do when a service or platform that your organization relies on goes down? The recent chaos caused by problems with CDK and Crowdstrike highlights the need to be mindful of risks caused by 3rd party vendors. It’s also a reminder as to why having a contingency plan in place before an outage or attack occurs is key to any organization’s response. Both issues stemmed from different root causes. In CDK’s case, a ransomware attack left...

Microsoft announced in December that Windows 10 will reach end of support in October 2025. Those who rely on the operating system will no longer receive essential security updates, bug fixes or technical support unless they migrate to Windows 11 and they sign up for escalating maintenance fees. The Extended Security Update program for devices running Windows 10 enables enterprises to continue receiving monthly security updates by paying $61 per...

As U.S. federal regulators fine-tune a strategy to push the healthcare sector into strengthening its cybersecurity posture, they are revisiting a HIPAA compliance audit program that’s been dormant since 2017. A new round of HIPAA audits for regulated entities is in the works. The Department of Health and Human Services recently published a notice saying that its Office for Civil Rights would be pulling the trigger soon on a study to assess...

‘Essential’ and ‘Enhanced’ Best Practices Will Influence Upcoming Rule-Making The Department of Health and Human Services has released guidance that spells out voluntary cybersecurity performance goals for the healthcare sector. The new 13-page Cybersecurity Performance Goals document, recently released by HHS’ Administration for Strategic Preparedness and Response, details both essential goals “to outline...

We hope that you had a successful 2023. Looking back, 2023 saw a number of high-profile breaches as criminals and nation-state-supported hackers both created new methods of attacking and took advantage of existing vulnerabilities. Looking to 2024, here are a few things that we think are worth keeping an eye on moving forward. Phishing NOW WITH AI Phishing continues to be a persistent and lucrative attack vector for criminals and state-...

Massachusetts Management Firm to Pay $100,000, Monitor HIPAA Compliance for 3 Years A Massachusetts-based medical management firm holds the dubious honor of being the first ransomware victim fined for a data breach by the Department of Health and Human Services. Doctor Management Group agreed to a $100,000 financial settlement and three years of HIPAA compliance monitoring and corrective actions following an investigation into a 2019 ransomware...

Cybercrime is an ever-evolving field. Technology evolves to allow new tactics or new scales for criminals, as well as giving firms new tools to combat fraud and theft. Due to the fact that it’s ever-evolving, sometimes it can be difficult to see vast changes that occur over time. Over the last 5 years, there have been significant changes to the landscape of cybercrime. Not just in the increases in scale but also significant changes in the types...

More Hacks Compromising Protected Health Info Being Reported to Regulators Healthcare organizations are adding millions to the tally of individuals affected by the Memorial Day weekend hack of the MOVEit file transfer application by Russian-speaking hackers. In recent days, the U.S. Department of Health and Human Services’ Office for Civil Rights has posted several more reports submitted by entities involving MOVEit breaches. An estimated...

How GPT’s Evil Twin Could Be Used in BEC Attacks A black hat AI tool called Worm GPT is being used to improve the efficacy of phishing emails. This is particularly troubling because a recent survey shows that 1 in 5 people fall for the fake, AI-generated emails, according to cybersecurity researchers. Researchers at SlashNext recently assessed WormGPT, an evil twin of OpenAI’s GPT AI model designed specifically for malicious...

Latest Breach Affects 234,000 Individuals; Involves Recent MCNA Insurance Co. Hack The state government of Iowa reported to federal regulators a third major health data breach since April involving a third-party vendor. The breach stems from an incident at dental health insurer MCNA Insurance Co. The Iowa Department of Health and Human Services reported hackers had compromised the protected health information of nearly 234,000 Iowa residents in...