Why Security Leaders Struggle to Secure Funding

Ascension Health Cyber Attack Affects Nearly 5.6 Million

December 23, 2024December 23, 2024

Massive Cyberattack Compromises Data of Over 5.5 Million Patients at Ascension Health

In a significant cybersecurity breach earlier this year, Ascension Health, one of the largest healthcare systems in the United States, reported that data from over 5.5 million patients and employees was compromised. The cyberattack, attributed to the notorious Black Basta ransomware-as-a-service operation, raised concerns about the security of sensitive health information. This incident underscores the critical need for robust cybersecurity measures in the healthcare sector.

According to a recent report by Cybernews, the infiltration of Ascension’s systems occurred on February 29, leading to the theft of extensive personal data. This included medical information, insurance and payment details, government identification data, and other personal information. In an updated filing with the Office of the Maine Attorney General, Ascension reassured the public that, while patient data was involved, there is no evidence that information was taken from their Electronic Health Records (EHR) or other clinical systems where comprehensive patient records are securely stored.

Impact of the Cyberattack on Patients

The ramifications of this cyberattack are significant. Here are key points regarding the breach:

Total Affected: Over 5.5 million patients and employees.
Data Compromised: Medical information, insurance details, payment information, government IDs, and personal details.
Security Assurance: Ascension confirmed that no patient records were taken from their EHR systems.
System Restoration: All affected systems have been fully restored following the incident.

Response from Federal Agencies

The initial disclosure of the Black Basta attack against Ascension Health in May prompted a collaborative response from federal agencies, including the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI. They released joint guidance outlining recommended safeguards to protect against ransomware threats, emphasizing the urgency for healthcare organizations to strengthen their cybersecurity protocols.

Conclusion

As cyberattacks become increasingly prevalent in the healthcare industry, the incident at Ascension Health serves as a critical reminder of the importance of safeguarding sensitive patient information. Healthcare systems must prioritize cybersecurity to protect against future threats.

For more information on cybersecurity in healthcare, check out Cybersecurity & Infrastructure Security Agency and Healthcare Information Security.

We invite you to share your thoughts on this incident or read related articles to stay informed about the evolving landscape of cybersecurity.

Cyberattack Disrupts Krispy Kreme’s Online Orders

December 13, 2024December 13, 2024

Krispy Kreme experienced significant disruptions to its online ordering systems due to a cyberattack, as reported by Cybernews. The company revealed the incident in a Securities and Exchange Commission filing, noting that both internal and external cybersecurity experts are investigating the breach. While in-store operations and delivery services remain unaffected, online ordering is currently offline as restoration efforts continue. Cybersecurity expert Ryan Sherstobitoff warned that such attacks can lead to revenue losses and damage customer trust, especially during the holiday season. This incident highlights the urgent need for robust cybersecurity measures in retail to protect operations and maintain consumer confidence.

Manufacturers Hit Hard by Surge in AI Email Attacks

December 20, 2024December 20, 2024

The manufacturing sector, vital to the U.S. economy, is increasingly vulnerable to advanced email attacks, particularly phishing, which rose by 83% from September 2023 to 2024. Cybercriminals target manufacturers due to their complex supply chains and valuable data, as illustrated by Clorox’s $356 million loss from a cyber incident. Key attack methods include Business Email Compromise (BEC) and Vendor Email Compromise (VEC). To enhance cybersecurity, manufacturers should implement security awareness training, multi-factor authentication, and AI-powered threat detection. As threats evolve, prioritizing robust cybersecurity measures is crucial for protecting sensitive data and maintaining competitiveness.

AI Ransomware FunkSec Hits 85 Victims with Double Extortion

January 10, 2025January 10, 2025

In late 2024, researchers identified a new ransomware family called FunkSec, which has targeted over 85 victims globally. This group employs a ransomware-as-a-service model, attracting novice cybercriminals. FunkSec launched a data leak site to centralize its operations, offering tools for DDoS attacks and showcasing a troubling mix of hacktivism and organized cybercrime. Key figures in the group include individuals from Algeria and Indonesia, promoting political motives alongside financial gains. Their advanced ransomware, FunkSec V1.5, features capabilities like recursive encryption and privilege escalation. Cybersecurity experts warn of the blurred lines between hacktivism and cybercrime as threats evolve.

Chinese Hackers Target Telecoms in 12+ Countries with GHOSTSPIDER

December 1, 2024December 1, 2024

Cybersecurity experts report a surge in cyberattacks by the China-linked group Earth Estries, utilizing a new backdoor, GHOSTSPIDER, to target Southeast Asian telecom companies. This advanced persistent threat (APT) has compromised over 20 organizations, including those in telecommunications and government sectors across more than a dozen countries. Earth Estries employs various malware, including the Demodex rootkit and MASOL RAT, exploiting vulnerabilities in widely used software. Their operations are sophisticated, involving multi-modular implants and stealthy attacks that complicate detection. As telecoms remain key targets for such threat actors, heightened cybersecurity vigilance is crucial.

8Base Ransomware Breaches Croatian Port

December 10, 2024December 10, 2024

The Port of Rijeka, Croatia’s largest maritime hub, has suffered a significant ransomware attack by the 8Base group, compromising sensitive data such as invoices, personal information, and employment contracts. Despite the breach, Port CEO Dusko Grabovac assured that operations remain unaffected and the port will not pay the ransom demanded by the attackers. This incident underscores the rising cyber threats facing critical infrastructure and highlights the need for enhanced cybersecurity measures. Experts emphasize the importance of robust data protection and incident response plans to mitigate risks from such attacks, serving as a cautionary tale for other organizations.

New Draft of National Cyber Incident Response Plan Released

December 18, 2024December 18, 2024

The Cybersecurity and Infrastructure Security Agency (CISA) has released a draft for the National Cyber Incident Response Plan (NCIRP), aimed at improving the U.S. response to cyberattacks. It categorizes responses into four tiers: asset response, led by CISA and the Department of Defense; threat response; intelligence support, coordinated by the FBI and the Director of National Intelligence; and affected entity response. Developed with input from over 150 experts, the plan emphasizes collaboration between government and private sectors to address the growing complexity of cyber threats. Public feedback on the draft will be gathered over the next month.