Security Patches and Incidents
-
LWN ☛ Security updates for Thursday
Security updates have been issued by Debian (haproxy, libssh, and nodejs), Fedora (filezilla and minizip-ng), Gentoo (Git, libssh, and OpenSSH), and SUSE (gstreamer, postfix, webkit2gtk3, and zabbix).
-
Anna Jaques Hospital’s computer system compromised by cyberattack
Days after what was called a cyberattack shut down Anna Jaques Hospital’s health record system on Christmas, hospital administrators are saying little about what caused the massive failure or whether the problem has been remedied.
“Upon discovery, we immediately secured our environment and engaged cybersecurity professionals to assist in the investigation. While there may be some delays in receiving services, patient safety remains our top priority,” a hospital spokesperson said on Wednesday.
At the height of the crisis, Anna Jaques Hospital staff were turning away ambulance crews from delivering patients to its emergency department and diverting them to area hospitals.
-
After cyber attack, New York hospitals find stolen patient info stored in Massachusetts, look for its return
Nearly four months after a cyber attack, Claxton-Hepburn Medical Center and Carthage Area Hospital have made progress in learning what stolen data may have been leaked, and where it was being stored. Now the hospitals have filed legal paperwork to get that data back.
[…]
The hospitals and FBI have discovered where the stolen data was stored. The hospital is now taking legal action, filing documents in late November that indicate the stolen data was stored on a server owned by Wasabi Technologies in Boston, Massachusetts.
-
The Print ☛ 4 arrested in Indian Council of Medical Research data leak case now booked in separate incident of ‘data brokering’
Weeks after Delhi Police arrested four men suspected of being involved in the Indian Council of Medical Research (ICMR) data leakage case reported two months ago, the four have been booked in a separate case of “data brokering”, ThePrint has learnt.
As reported by ThePrint earlier, police had initially suspected the accused of trying to sell the leaked data involving ICMR and had arrested them based on inputs that they were allegedly advertising it on social media and looking for potential buyers.
However, the four have now been booked for “data brokering” in a separate case, Delhi Police sources told ThePrint.
“They have been booked in a separate case under Indian Penal Code section 420 (cheating) and sections of the Information Technology Act,” said a senior police officer.
-
Bleeping Computer ☛ Mortgage firm LoanCare warns 1.3 million people of data breach
Mortgage servicing company LoanCare is warning 1,316,938 borrowers across the U.S. that their sensitive information was exposed in a data breach at its parent company, Fidelity National Financial.
LoanCare is a sub-servicing and interim sub-servicing provider and a significant player in the mortgage servicing sector, handling approximately $390 billion in balances from 1.2 million loans.
Last week, its parent company, Fidelity National Financial, a prominent title insurance provider in the United States, disclosed a cyberattack in an SEC filing.
Following this disclosure, LoanCare posted a notice about the incident on its website and informed the authorities of the incident while also sharing a sample of the notice sent to impacted individuals.
-
Attorney General James Secures $300,000 from NewYork-Presbyterian Hospital for Failing to Protect Patient Data
“New Yorkers searching for a doctor or medical help should be able to do so without their private information being compromised,” said Attorney General James. “Hospitals and medical facilities must uphold a high standard for protecting their patients' personal information and health data. NewYork-Presbyterian failed to handle its patients’ health information with care, and as a result, tech companies gained access to people’s data. Today’s agreement will ensure that NewYork-Presbyterian is not negligent in protecting its patients’ information.”
The NewYork-Presbyterian Hospital operates 10 hospitals across New York City and the surrounding metropolitan area and receives more than 2 million patient visits each year. The NYP’s website allows visitors to book appointments, search for doctors, learn about NYP services, and research information relating to symptoms and conditions. An OAG investigation found that NYP did not have appropriate internal policies or procedures for vetting third-party tracking tools and did not review or vet third-party tracking tools for violations of policy or law prior to their deployment.
-
Data Breaches ☛ Recent attacks on Fred Hutch and Integris: Is attempting to extort patients directly becoming the “new normal?”
DataBreaches previously reported a breach involving Integris Health in Oklahoma. The incident did not involve encryption, but the threat actors were reportedly contacting patients directly and offering to remove their protected health information for a small fee before leaking or selling the data of what they claim is more than two million patients.
DataBreaches noted in that post that this site had been contacted by someone about the breach. DataBreaches subsequently made contact with them.
Of note, the threat actor claimed that they “taked DA for integris” on 11/11. They also claimed that Integris did not enter into chat or any negotiations with tthehem, even though they say Integris knew that they had acquired patients’ protected health information.
-
Data Breaches ☛ German hospital system hit by cyberattack [Ed: Windows TCO]
As noted above. LockBit3.0 is suspected of being responsible for the attack, but as of publication, there is no claim on the threat actors’ leak site.