CyberSecurity news
FlagThis - #healthcare
|
@WhatIs
//
References:
DataBreaches.Net
, The Dysruption Hub
,
A cyberattack struck Covenant Health on Monday, May 26, 2025, disrupting operations at St. Joseph Hospitals in Bangor, Maine, and Nashua, New Hampshire, as well as St. Mary’s Health System and Community Clinics in Lewiston, Maine. The healthcare provider, a Catholic-based nonprofit serving New England and parts of Pennsylvania, was forced to shut down all data systems across its hospitals, clinics, and provider practices as a protective measure against the "cyber incident initiated by an outside group." This action has impacted access to electronic records, appointment scheduling, and internal communications, leading to connectivity issues throughout the organization.
The cyberattack has led to significant operational disruptions at the affected facilities. In both Bangor and Nashua, ambulance services have been diverted, and diagnostic scans have been redirected to other locations. Patients have reported difficulties in refilling prescriptions, and outpatient lab services at St. Joseph Hospital in Nashua are now only available on the main hospital campus with a physical order in hand. Staff are working under modified procedures to maintain patient care amidst the system outages. The hospitals have posted notices on their websites acknowledging the disruptions and assuring the public that teams are working to restore full services as quickly as possible. Covenant Health spokesperson Karen Sullivan confirmed that cybersecurity experts have been engaged to investigate the breach and assist in restoring system functionality. While a timeline for full restoration has not been provided, the organization emphasizes that patient care remains a priority. Cybersecurity analysts are warning that medical institutions are increasingly vulnerable to cyberattacks due to the high value of patient data on illicit markets, stressing the urgent need for enhanced digital defenses across the healthcare sector. The incident is currently under investigation, and updates will be provided as more information becomes available. Recommended read:
References :
@ketteringhealth.org
//
Kettering Health, a healthcare network operating 14 medical centers and over 120 outpatient facilities in western Ohio, has been hit by a ransomware attack causing a system-wide technology outage. The cyberattack, which occurred on Tuesday, May 20, 2025, has forced the cancellation of elective inpatient and outpatient procedures and has disrupted access to critical patient care systems, including phone lines, the call center, and the MyChart patient portal. Emergency services remain operational, but emergency crews are being diverted to other facilities due to the disruption. Kettering Health has confirmed they are responding to the cybersecurity incident involving unauthorized access to its network and has taken steps to contain and mitigate the breach, while actively investigating the situation.
The ransomware attack is suspected to involve the Interlock ransomware gang, which emerged last fall and has targeted various sectors, including tech, manufacturing firms, and government organizations. A ransom note, viewed by CNN, claimed the attackers had secured Kettering Health's most vital files and threatened to leak stolen data unless the health network began negotiating an extortion fee. In response to the disruption, Kettering Health has canceled elective procedures and is rescheduling them for a later date. Additionally, the organization is cautioning patients about scam calls from individuals posing as Kettering Health team members requesting credit card payments and has halted normal billing calls as a precaution. The incident highlights the increasing cybersecurity challenges facing healthcare systems. According to cybersecurity experts, healthcare networks often operate with outdated technology and lack comprehensive cybersecurity training for staff, making them vulnerable to attacks. There is a call to action to invest in healthcare cybersecurity, with recommendations for the government and its partners to address understaffed healthcare cyber programs by tweaking federal healthcare funding programs to cover critical cybersecurity expenditures, augmenting healthcare cybersecurity workforces and incentivizing cyber maturity. Recommended read:
References :
@The DefendOps Diaries
//
Ascension, one of the largest private healthcare systems in the United States, is facing scrutiny following a significant data breach. The company revealed that the personal and healthcare information of over 430,000 patients was exposed in an incident disclosed last month. The breach stemmed from a compromise affecting a former business partner, highlighting the inherent risks associated with third-party vendors and the critical need for robust cybersecurity measures within the healthcare ecosystem.
The vulnerability in third-party software allowed attackers access to sensitive patient data. Depending on the patient, the attackers could access personal health information related to inpatient visits, including the physician's name, admission and discharge dates, diagnoses, and more. The data breach underscores the importance of healthcare organizations thoroughly vetting and continuously monitoring third-party vendors and their software solutions. This situation exemplifies how a single point of failure in the supply chain can have far-reaching consequences for patient privacy and data security. The Ascension data breach has broader implications for healthcare cybersecurity. The incident serves as a stark reminder of the vulnerabilities in healthcare systems, especially those involving third-party software. The lessons learned emphasize the need for strengthening cybersecurity defenses against third-party and ransomware threats. Healthcare providers must prioritize data protection, regularly assess the security of their partners, and implement robust measures to protect patient information from evolving cyber threats. Recommended read:
References :
Pierluigi Paganini@Security Affairs
//
Jeffrey Bowie, the CEO of cybersecurity firm Veritaco, has been arrested and charged with two counts of violating Oklahoma's Computer Crimes Act. The charges stem from an incident on August 6, 2024, where Bowie allegedly installed malware on employee computers at St. Anthony Hospital in Oklahoma City. Security footage captured Bowie accessing multiple offices within the hospital before installing the malicious software, which was designed to capture screenshots every 20 minutes and transmit them to an external IP address.
Following the discovery of the unauthorized installation by a vigilant hospital employee, St. Anthony Hospital conducted a forensic review confirming the presence of malware. When confronted, Bowie claimed he needed to use the computer for a family member undergoing surgery, but authorities found his explanation unconvincing. SSM Health, the hospital's parent organization, issued a statement assuring the public that immediate action was taken and that no patient information was compromised due to the security measures in place. The hospital has since increased monitoring and employee training to further protect their systems. Bowie's arrest has sent shockwaves through the cybersecurity community, particularly given his position as the head of a firm specializing in protecting businesses from cyber threats. Veritaco, described on Bowie's LinkedIn profile as a company focused on "cybersecurity, digital forensics, and private intelligence," employed between two and ten individuals. The incident underscores the potential for insider threats, even from individuals entrusted with security responsibilities, and has led to renewed calls for robust internal controls and employee vigilance. Recommended read:
References :
Pierluigi Paganini@Security Affairs
//
The Interlock ransomware group has claimed responsibility for a cyberattack on DaVita, a major kidney dialysis firm with over 2,600 U.S. dialysis centers and 76,000 employees across 12 countries. DaVita disclosed to the U.S. Securities and Exchange Commission (SEC) that they suffered a ransomware attack on April 12th affecting some operations. The company is currently investigating the impact of the incident which is the latest in a surge of ransomware attacks hitting US healthcare organizations.
Earlier today, the Interlock ransomware gang claimed responsibility for the attack by adding DaVita to its list of victims. The group has started leaking data allegedly stolen from the organization, claiming to have exfiltrated over 1.5 TB of data. The healthcare sector is increasingly under siege from cybercriminals, with ransomware attacks posing a significant threat to operational integrity and patient safety. This incident underscores the urgency for healthcare organizations to bolster their cybersecurity defenses to effectively counter these evolving threats. Ransomware attacks in the healthcare sector can have severe implications for patient care and safety. The DaVita attack disrupted internal operations and encrypted certain on-premises systems, affecting the delivery of essential medical services. Though patient care at DaVita centers and patients' homes continued, the incident highlights the potential for treatment delays and compromised patient safety. Following the attack, DaVita disclosed the incident to the U.S. Securities and Exchange Commission (SEC), indicating the regulatory scrutiny that healthcare organizations face in the aftermath of cyberattacks. Recommended read:
References :
Bill Toulas@BleepingComputer
//
Yale New Haven Health (YNHHS) has confirmed a significant data breach impacting 5.5 million patients. The cybersecurity incident, which occurred in March, involved unauthorized access to YNHHS systems, leading to the potential theft of sensitive personal information. The exposed data includes names, dates of birth, medical record numbers, and in some instances, Social Security numbers and health insurance details. YNHHS has alerted affected patients and is working with law enforcement and cybersecurity experts to investigate the breach.
Mandiant's incident response team was brought in to help contain the breach. The healthcare system began notifying affected patients via mail on April 14. The organization is affiliated with Yale University and Yale School of Medicine and is Connecticut's largest provider of its kind, with five hospitals and medical clinics throughout the US state as well as New York and Rhode Island. This cyberattack is considered one of the largest healthcare data breaches of the year. YNHHS has stated that the incident has not affected its ability to provide patient care, with the patient portal and electronic medical records functioning normally. The incident serves as a stark reminder of the increasing cyber threats faced by healthcare organizations and underscores the critical need for robust security measures to safeguard patient data. Recommended read:
References :
Pierluigi Paganini@securityaffairs.com
//
A newly discovered remote access trojan (RAT) called ResolverRAT is actively targeting healthcare and pharmaceutical organizations worldwide. Security researchers at Morphisec have identified this sophisticated malware as a new threat, noting its advanced in-memory execution, API and resource resolution at runtime, and layered evasion techniques. ResolverRAT is designed for stealth and resilience, making static and behavioral analysis significantly more difficult. The malware has been observed in attacks as recently as March 10, indicating an ongoing campaign.
ResolverRAT spreads through meticulously crafted phishing emails, often employing fear-based lures to pressure recipients into clicking malicious links. These emails are localized, using languages spoken in targeted countries, including Hindi, Italian, Czech, Turkish, Portuguese, and Indonesian. The content often revolves around legal investigations or copyright violations to induce a sense of urgency. The infection chain initiates through DLL side-loading, with a legitimate executable used to inject ResolverRAT into memory, a technique previously observed in Rhadamanthys malware attacks. Once deployed, ResolverRAT utilizes a multi-stage bootstrapping process engineered for stealth. The malware employs encryption and compression and exists only in memory after decryption to prevent static analysis. It also incorporates redundant persistence methods via the Windows Registry and file system. Furthermore, ResolverRAT uses a bespoke certificate-based authentication to communicate with its command-and-control (C2) server, bypassing machine root authorities and implementing an IP rotation system to connect to alternate C2 servers if necessary. These advanced C2 infrastructure capabilities indicate a sophisticated threat actor combining secure communications and fallback mechanisms. Recommended read:
References :
Dissent@DataBreaches.Net
//
A data breach at Oracle Health has impacted multiple healthcare organizations and hospitals across the United States. The breach involved a threat actor gaining unauthorized access to legacy servers and stealing patient data. The incident, which occurred on February 20, 2025, was initially discovered by Oracle Health, formerly known as Cerner, but has only recently been publicly disclosed by BleepingComputer on March 28, 2025, after Oracle Health failed to respond to requests for comments.
The compromised data includes sensitive information from electronic health records, single sign-on credentials, Lightweight Directory Access Protocol passwords, OAuth2 keys, and tenant data. It is believed that the breach was facilitated through the use of compromised customer credentials, aligning with known attack techniques. The implications for healthcare organizations are substantial, particularly concerning compliance with HIPAA regulations, and could lead to legal repercussions and financial penalties for affected entities. Oracle Health is facing criticism for its lack of transparency regarding the incident. The company is reportedly telling hospitals that they will not notify patients directly, placing the responsibility on them to determine if the stolen data violates HIPPA laws. However, Oracle Health has committed to assisting in identifying impacted individuals and providing notification templates to help with notifications. Recommended read:
References :
Sam Bent@Sam Bent
//
Ascom, a Swiss global solutions provider specializing in healthcare and enterprise communication systems, has confirmed a cyberattack on its IT infrastructure. The attack, suspected to be carried out by the Hellcat group, exploited vulnerabilities in Jira servers. The company revealed that hackers breached its technical ticketing system.
The Hellcat group claimed responsibility, stating they stole approximately 44GB of data potentially impacting all of Ascom's divisions. Hellcat hackers are known for using compromised credentials to infiltrate Jira systems, leading to data breaches in multiple organizations. Security experts advise implementing multi-factor authentication, regular security audits, prompt patching, and employee training to mitigate such attacks. Recommended read:
References :
|