Information Technology Security

By Bill Toulas,  Bleeping Computer HSA provider HealthEquity has determined that a cybersecurity incident disclosed earlier this month has compromised the information of 4,300,000 people. HealthEquity, one of the largest HSA custodians in the U.S., specializes in providing health savings accounts (HSAs), flexible spending accounts (FSAs), health reimbursement arrangements (HRAs), and 401(k) retirement plans. In a Form 8-K filing submitted on July 2, 2024, the company disclosed that threat actors stole members' sensitive health data using a partner's compromised credentials. An investigation determined that the breach occurred on March 9, 2024, but was only verified by the firm on June 26, following an internal investigation. "We discovered some unauthorized access to and potential disclosure of protected health information and/or personally identifiable information stored in an unstructured data repository outside our core systems," reads the data breach notice to be...

By Ionut Ilascu,  Bleeping Computer A faulty component in the latest CrowdStrike Falcon update is crashing Windows systems, impacting various organizations and services across the world, including airports, TV stations, and hospitals. The glitch is affecting Windows workstations and servers, with users reporting massive outages that took offline entire companies and fleets of hundreds of thousands of computers. According to some reports, emergency services in the U.S. and Canada have also been impacted. Worldwide outage By the time of the correction, though, many large organizations across multiple verticals had already been affected. Some reports say that CrowdStrike’s update impacted some 911 emergency service agencies in the state of New York (EMS, police, fire department), Alaska, and Arizona, as well as 911 services in parts of Canada. A 911 telecommunicator in Illinois said that they were “working off of paper until things come back.” There also reports that the health hotlin...

By Bill Toulas,  Bleeping Computer Geisinger , a prominent healthcare system in Pennsylvania, has announced a data breach involving a former employee of Nuance , an IT services provider contracted by the organization. Geisinger is a non-profit organization that operates 134 care sites, ten hospitals, and the Geisinger Health Plan, serving a total of 1.2 million people. It employs 26,000 staff, including 1,600 doctors, and is considered one of Pennsylvania’s most important organizations. An announcement published earlier this week explains that in November 2023, Geisinger detected unauthorized access to its patients’ database by a former Nuance employee. Nuance was promptly informed and took action to block the former employee’s access to Geisinger’s systems holding patient records. “On Nov. 29, 2023, Geisinger discovered and immediately notified Nuance that a former Nuance employee had accessed certain Geisinger patient information two days after the employee had been terminated,” ...

By Lawrence Abrams,  Bleeping Computer UnitedHealth has confirmed for the first time what types of medical and patient data were stolen in the massive Change Healthcare ransomware attack, stating that data breach notifications will be mailed in July. On Thursday, the company published a data breach notification warning that the ransomware attack exposed a "substantial quantity of data" for a "substantial proportion of people in America." While UnitedHealth has not explicitly shared how many people were affected, UnitedHealth CEO Andrew Witty stated during a congressional hearing that "maybe a third" of all American's health data was exposed in the attack. According to the data breach notification, a massive trove of sensitive information was stolen, including: Health insurance information (such as primary, secondary or other health plans/policies, insurance companies, member/group ID numbers, and Medicaid-Medicare-government payor ID numbers); Health i...

By Sergiu Gatlan,  Bleeping Computer NHS England revealed today that multiple London hospitals impacted by last week’s Synnovis ransomware attack were forced to cancel hundreds of planned operations and appointments. Formerly known as Viapath, Synnovis was established as GSTS Pathology in 2009 and switched to the Synnovis brand in October 2022. The organization was established as a partnership between SYNLAB UK & Ireland, Guy's and St Thomas' NHS Foundation Trust, and the King's College Hospital NHS Foundation Trust. Ongoing service disruptions at Guy's and St Thomas' NHS Foundation Trust, King's College Hospital NHS Foundation Trust, and primary care providers across South East London result from Synnovis being locked out of its systems by a June 3 attack linked to the Qilin ransomware operation. While memos issued by hospital officials revealed this "ongoing critical incident" has had a "major impact" on their procedures and operations ...

By Bill Toulas,  Bleeping Computer The Singing River Health System is warning that it is now estimating that 895,204 people are impacted by a ransomware attack it suffered in August 2023. Singing River Health System is a major healthcare provider located in Mississippi, operating the Singing River Hospital in Pascagoula, Ocean Springs Hospital , and the Singing River Gulfport Hospital , collectively providing over 700 beds. The health system, which employs over 3,500 people, also operates two hospices, four pharmacies, six imaging centers, ten specialty centers, and twelve medical clinics in the Gulf Coast region. On August 19, 2023, Singing River announced that it had been targeted by a sophisticated ransomware attack, which resulted in operational disruptions at its hospitals and potentially data theft. Singing River was added to the HHS' Office for Civil Rights breach portal in late August, with a temporary figure of 501 impacted individuals. On September 13, 2023, the healthca...

By Bill Toulas, Bleeping Computer Healthcare service provider Kaiser Permanente disclosed a data security incident that may impact 13.4 million people in the United States. Kaiser Permanente is an integrated managed care consortium and one of the largest nonprofit health plans in the U.S. It operates 40 hospitals and 618 medical facilities in California, Colorado, the District of Columbia, Georgia, Hawaii, Maryland, Oregon, Virginia, and Washington. In a statement, the organization said that information from "approximately 13.4 million current and former members and patients" was leaked to third-party trackers installed on its websites and mobile applications. “Kaiser Permanente has determined that certain online technologies, previously installed on its websites and mobile applications, may have transmitted personal information to third-party vendors Google, Microsoft Bing, and X (Twitter) when members and patients accessed its websites or mobile applications” - Kaiser Perma...

By Lawrence Abrams,  Bleeping Computer The RansomHub extortion gang has begun leaking what they claim is corporate and patient data stolen from United Health subsidiary Change Healthcare in what has been a long and convoluted extortion process for the company. In February, Change Healthcare suffered a cyberattack that caused massive disruption to the US healthcare system , preventing pharmacies and doctors from billing or sending claims to insurance companies. The attack was ultimately linked to the BlackCat / ALPHV ransomware operation, who later said they stole 6 TB of data during the attack . After facing increased pressure from law enforcement, the BlackCat gang shut down their operation . This occurred amid claims they were pulling an exit scam by stealing a $22 million Change Healthcare ransom payment from the affiliate who conducted the attack. While Change Healthcare has declined to comment on whether it has paid a ransom, the affiliate known as "Notchy" said they ...

By  Krebs On Security There are indications that U.S. healthcare giant Change Healthcare has made a $22 million extortion payment to the infamous BlackCat ransomware group (a.k.a. “ALPHV“) as the company struggles to bring services back online amid a cyberattack that has disrupted prescription drug services nationwide for weeks. However, the cybercriminal who claims to have given BlackCat access to Change’s network says the crime gang cheated them out of their share of the ransom, and that they still have the sensitive data Change reportedly paid the group to destroy. Meanwhile, the affiliate’s disclosure appears to have prompted BlackCat to cease operations entirely. In the third week of February, a cyber intrusion at Change Healthcare began shutting down important healthcare services as company systems were taken offline. It soon emerged that BlackCat was behind the attack, which has disrupted the delivery of prescription drugs for hospitals and pharmacies nationwide for nearly t...

By Sergiu Gatlan,  Bleeping Computer The BlackCat/ALPHV ransomware gang has officially claimed responsibility for a cyberattack on Optum , a subsidiary of UnitedHealth Group (UHG), which led to an ongoing outage affecting the Change Healthcare platform . Change Healthcare is the largest payment exchange platform used by more than 70,000 pharmacies across the United States. UHG is the world's largest healthcare company by revenue, employing 440,000 people worldwide and working with over 1.6 million physicians and care professionals in 8,000 hospitals and other care facilities. In a statement published on their dark web leak site today, BlackCat said that they allegedly stole 6TB of data from Change Healthcare's network belonging to "thousands of healthcare providers, insurance providers, pharmacies, etc." "Being inside a production network one can imagine the amount of critical and sensitive data that can be found. The data relates to all Change Health clients tha...

By Bill Toulas,  Bleeping Computer The Rhysida ransomware gang has claimed the cyberattack on Lurie Children's Hospital in Chicago at the start of the month. Lurie is a leading pediatric acute care institution in the U.S. that provides care to over 200,000 children annually. The cyberattack forced the healthcare provider to take its IT systems offline and postpone medical care in some cases. Email, phone, access to MyChart, and on-premises internet were all impacted. Ultrasound and CT scan results were rendered unavailable, patient service prioritization systems were taken down, and doctors were forced to switch to pen and paper for prescriptions. Today, the Rhysida ransomware gang has listed Lurie Children's on its extortion portal on the dark web, claiming to have stolen 600 GB of data from the hospital. Rhysida ransomware now offers to sell the stolen data for 60 BTC ($3,700,000) to a single buyer. The deadline was set to seven days, after which the data will either be sol...

By Lawrence Abrams,  Bleeping Computer The Company had $262.2 billion in revenue for fiscal year 2023 and employs approximately 46,000 people. In a Form 8-K filing with the SEC, Cencora disclosed they suffered a cyberattack that led to data theft. "On February 21, 2024, Cencora, Inc. (the "Company"), learned that data from its information systems had been exfiltrated, some of which may contain personal information," reads the SEC filing. Cencora says they contained the incident and are now working with law enforcement, external cybersecurity experts, and external counsel to investigate it. Upon initial detection of the unauthorized activity, the company immediately took containment steps and commenced an investigation with the assistance of law enforcement, cybersecurity experts, and external counsel. Cencora says they have not determined if the incident will materially impact their finances or operations. Cencora confirmed that their cyberattack is unrelated to the...

By Sergiu Gatlan,  Bleeping Computer Today, the FBI, CISA, and the Department of Health and Human Services (HHS) warned U.S. healthcare organizations of targeted ALPHV/Blackcat ransomware attacks. "ALPHV Blackcat affiliates have been observed primarily targeting the healthcare sector," the joint advisory cautions. Today's warning follows an April 2022 FBI flash alert and another advisory issued in December 2023 detailing the BlackCat cybercrime gang's activity since it surfaced in November 2021 as a suspected rebrand of the DarkSide and BlackMatter ransomware groups. The FBI linked BlackCat to over 60 breaches during its first four months of activity (between November 2021 and March 2022) and said the gang has raked in at least $300 million in ransoms from over 1,000 victims until September 2023. "Since mid-December 2023, of the nearly 70 leaked victims, the healthcare sector has been the most commonly victimized," the three federal agencies warned in today...

By Zack Whittaker,  Tech Crunch An ongoing cyberattack at U.S. health tech giant Change Healthcare that sparked outages and disruption to hospitals and pharmacies across the U.S. for the past week was caused by ransomware. A healthcare executive with knowledge of the incident, who was on the call briefed by the company’s executives, said the healthcare tech giant attributed the cyberattack to the BlackCat ransomware group . Reuters first reported the news linking the cyberattack to BlackCat, citing two people familiar with the incident. A spokesperson for Change Healthcare did not immediately respond to a request for comment. BlackCat, also often referred to as ALPHV , has not yet publicly claimed responsibility for the cyberattack. Ransomware and extortion gangs typically publish portions of a victim’s stolen data to extort a ransom demand. Ransomware attacks typically scramble a victim’s files and demand a ransom to receive the decryption key. Newer cyberattacks often invol...

By Bill Toulas,  Bleeping Computer Healthcare giant UnitedHealth Group confirmed that its subsidiary Optum was forced to shut down IT systems and various services after a cyberattack by “nation-state” hackers on the Change Healthcare platform. United Health Group (UHG) is a health insurance company with a presence across all 50 US states. The organization is the world's largest healthcare company by revenue ($324.2 billion in 2022), employing 440,000 people worldwide. Its subsidiary, Optum Solutions, operates the Change Healthcare platform, which is the largest payment exchange platform between doctors, pharmacies, healthcare providers, and patients in the US healthcare system. Optum suffers massive cyberattack Change Healthcare first started warning customers Wednesday that some of its services had become unavailable, later stating a cybersecurity incident caused it. An 8-K filing submitted by UnitedHealth Group with the SEC yesterday confirmed that a cyberattack by suspected ...

By France Bleu Nord, Radio France The pirates demand a ransom. This is the first time that the Armentières hospital has been the victim of such an attack. The Armentières hospital center was the victim of a cyberattack during the night from Saturday to Sunday at 2 a.m., France Bleu Nord learned on Sunday February 11 from the hospital management. The pirates demand a ransom from the hospital. The emergency department is closed for the next 24 hours, patients are being redirected to other hospitals. “The printers turned on started printing a message, indicating that our data was encrypted and that we should contact them”tells franceinfo Samy Bayod, deputy director of the Armentières CH. “We immediately disconnected the entire hospital network, we have been isolated since 3 a.m.,” he specifies.

By Alexander Martin, TheRecord.Media Data on more than 33 million people in France, approximately half the population, was compromised in a cyberattack at the end of January, according to the country’s privacy watchdog. The Commission Nationale Informatique et Libertés (CNIL) announced this week it had been informed by two health insurance companies, Viamedis and Almerys, about the incident. It warned that the data affects policyholders and their families and includes “marital status, date of birth and social security number, the name of the health insurer as well as the guarantees of the contract taken out.” Fortunately, unlike the incident affecting Australian health insurance business Medibank , medical histories and treatment data was not compromised. The CNIL said that the health insurance companies were directly responsible for informing the affected individuals — but people are urged to be cautious over potential phishing attempts intending to defraud them. The CNIL warned tha...

CISA, the Federal Bureau of Investigation (FBI), and the Department of the Treasury (Treasury) have released a joint Cybersecurity Advisory (CSA), North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector, to provide information on Maui ransomware, which has been used by North Korean state-sponsored cyber actors since at least May 2021 to target Healthcare and Public Health (HPH) Sector organizations.  CISA, FBI and Treasury urge network defenders to examine their current cybersecurity posture and apply the recommended mitigations in this joint CSA, which include: Train users to recognize and report phishing attempts. Enable and enforce multifactor authentication. Install and regularly update antivirus and antimalware software on all hosts. See North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector for Maui ransomware tactics, techniques, and procedures, indicators of comp...

By Nathan Wasson, Hot Hardware Yesterday, we reported on a data breach at Shields Health Care Group that resulted in the theft of personal information belong to 2 million Americans. Oftentimes, data stolen in breaches like this end up on online forums or marketplaces where cybercriminals buy and sell these ill-gotten gains. Lately, US law enforcement agencies, in collaboration with law enforcement agencies in other countries, have conducted major operations with the goal of shutting down hubs of cybercriminal activity. The Federal Bureau of Investigation (FBI), the United States Secret Service, and the Department of Justice (DOJ) seized RaidForums back in April. According to the DOJ, RaidForums was home to “more than 10 billion unique records for individuals residing in the United States and internationally." Now, federal law enforcement has shut down SSNDOB Marketplace by seizing the domains of the website and its mirrors. The domains “ssndob.ws,” “ssndob.vip,” “ssndob.club,” an...

By Bill Toulas,  Bleeping Computer Shields Health Care Group (Shields) suffered a data breach that exposed the data of approximately 2,000,000 people in the United States after hackers breached their network and stole data. Shields is a Massachusetts-based medical services provider specializing in MRI and PET/CT diagnostic imaging, radiation oncology, and ambulatory surgical services. According to a data breach notification published on the company's site, Shield became aware of the cyberattack on March 28, 2022, and hired cybersecurity specialists to determine the scope of the incident. The examination of log files showed that the hackers had access to Shields’ systems from March 7, 2022, to March 21, 2022, allowing them to potentially access data containing the following patient information: Full name Social Security number Date of birth Home address Provider information Diagnosis Billing information Insurance number and information Medical record number Patient ID Other medical ...