Security Leftovers
-
Yahoo News ☛ Emergency Medical Services Authority notifies patients of hacking incident
Emergency Medical Services Authority (“EMSA”) says, it has identified suspicious activity in its IT network and is mailing letters to patients whose information may have been involved.
According to EMSA, on February 13, 2024, EMSA identified suspicious activity in its IT network. EMSA immediately initiated its incident response protocols, which involved shutting off select systems as a proactive measure.
[…]
The investigation determined that an unauthorized party gained access to its network and, between February 10, 2024 and February 13, 2024, acquired files that contained information pertaining to certain EMSA patients. The information involved varied by individual, but generally included one or more of the following: name, address, date of birth, date of service, and, for some, name of primary care provider and/or Social Security number.
-
Commonwealth Healthcare Corporation breached, patient data involved
Although the listing is not on a previously known Tor URL, the writing seems familiar. DataBreaches emailed one particular ransomware group to ask if this might be their work but has not received any response.
-
System Status Note
On March 8, DataBreaches experienced a massive DDoS attack. At the time, I thought all posts had been restored and it was just a question of reuploading images. After hearing from researchers who cannot find old posts, however, it seems that yes, there are likely many old posts that did not get reuploaded and some posts where images are missing. I’m not sure what the issue was with importing, but something obviously didn’t go perfectly. I cannot give you an ETA as to when all old posts and images will be restored because that’s not a priority.
-
InfoSecurity Magazine ☛ New AcidPour Wiper Targeting Linux Devices Spotted in Ukraine [Ed: But how does that get onto the systems?]
A new variant of the wiper malware AcidRain, known as AcidPour, has been discovered by SentinelOne’s threat intelligence team, SentinelLabs.
AcidRain is destructive wiper malware attributed to Russian military intelligence.
In May 2022, AcidRain was used in a broad-scale cyber-attack against Viasat’s KA-SAT satellites in Ukraine.
-
Cyber Security News ☛ AcidPour Attacking Linux Systems Running On x86 Architecture [Ed: It still fails to explain how it gets there, it just tries to blame "Linux"]
It is written in C, without external libraries it uses direct syscalls and inline assembly for operations such as string manipulation.