Security and Windows TCO
-
LWN ☛ Security updates for Monday
Security updates have been issued by Debian (chromium, open-vm-tools, openjdk-17, pmix, and trafficserver), Fedora (netconsd, podman, suricata, and usd), Oracle (.NET 6.0, .NET 7.0, binutils, ghostscript, java-1.8.0-openjdk, kernel, and squid), SUSE (apache-ivy, gstreamer-plugins-bad, kernel, nodejs12, opera, poppler, rubygem-activesupport-5.2, tiff, util-linux, and virtualbox), and Ubuntu (krb5).
-
Data Breaches ☛ Data of 171,871 Deer Oaks Behavioral Health clients and employees dumped by ransomware group [Ed: Windows TCO]
Deer Oaks Behavioral Health in Texas is a behavioral health services provider of psychological and psychiatric services to residents of long-term care and assisted living facilities. On October 31, they issued a substitute notice on their website about a ransomware incident they experienced.
According to their notice, they discovered the attack on September 1. “The unauthorized activity was immediately detected and isolated by Sophos antivirus software limiting the Incident to one segment of Deer Oaks’ network,” they wrote.
[...]
On or about September 11, LockBit3.0 added Deer Oaks to their leak site. On November 5, they claim to have leaked all the data that they described as “3 MS SQL Server databases with operations, clients, private data, finance data and transactions of Deer Oaks.” In the screenshot above, employee names, email addresses, phone numbers, and LinkedIn information have been redacted by DataBreaches.
-
Data Breaches ☛ Cardiovascular Consultants (CVC Heart) allegedly hit by ransomware
On October 25, Cardiovascular Consultants LTD (CVC Heart) was added to Qilin’s dark web leak site. The listing does not provide much information but claims, “You can download all personal data of clients and employees of this company below.” The link to what purports to be a compressed file 205.93 GB in size does not work, however. Perhaps it is there simply as a warning to pressure CVC Heart to pay them. Qilin did not respond to a site visitor who asked them about the non-working download and were not logged in to their Jabber account when DataBreaches attempted to find them there on a few occasions.
-
Data Breaches ☛ Mulkay Cardiology Consultants notifies almost 80,000 of ransomware attack
When DataBreaches checked NoEscape’s site again in mid-October, the Mulkay listing was still displayed, but the leak site itself appeared somewhat different as some of the listings were now tagged with “DDoS” notations that had not been there previously. Mulkay was one of the ones tagged with “DDoS” and an attempt to connect to their site failed with a 508 error. DataBreaches does not know for how long their site was under DDoS attack, but by the next day, the listing had been removed from the leak site and Mulkay’s site did not appear to be having any issues.
-
Data Breaches ☛ HC3: Analyst Note: BlackSuit Ransomware
Discovered in early May 2023, BlackSuit’s striking parallels with Royal, the direct successor of the former notorious Russian-linked Conti operation, potentially places the group with one of the most active ransomware groups in operation today. Both Royal and the now defunct Conti are known to have aggressively targeted the HPH sector, and if their purported ties to BlackSuit prove to be verified, then the sector will likely continue to be attacked profoundly. What follows is an overview of the potential new group, possible connections to other threat actors, an analysis of its ransomware attacks, its target industries and victim countries, impact to the HPH sector, MITRE ATT&CK techniques, indicators of compromise, and recommended defense and mitigations against the group.
-
CBC ☛ Info from 5.6 million patient visits among data stolen in ransomware attack on Ontario hospitals
A database containing information on 5.6 million patient visits to Bluewater Health and the social insurance numbers of as many as 1,446 Chatham-Kent Health Alliance employees are among the data taken in the ransomware attack on five southwestern Ontario hospitals, officials said in a lengthy update Monday.
The update — including specific information about what was stolen from each hospital — comes after some data was published by the hackers online.
-
Data Breaches ☛ Info from 5.6 million patient visits among data stolen in ransomware attack on Ontario hospital
Their article lists the summary of what the hospitals have determined so far in terms of what data was acquired. DataBreaches also reported on the third tranche of data on November 5.