Kashmir Hill, John Ismay, Christopher F. Schuetze, and Aaron Krolik report: The shoebox-shaped device, designed to capture fingerprints and perform iris scans, was listed on eBay for $149.95. A German security researcher, Matthias Marx, successfully offered $68, and when it arrived at his home in Hamburg in August, the rugged, hand-held machine contained more than…
Author: Dissent
NYS Comptroller DiNapoli Releases More School District Audits
Two more school district audits were released before the holiday. Nanuet Union Free School District – Network User Accounts and Information Technology Contingency Plan (2022M-135) Issued Date December 09, 2022 Background The District serves the Town of Clarkstown in Rockland County. The District is governed by an elected seven-member Board of Education (Board) that is…
Ransomware Needs ‘Physical’ Damage For Insurance, Ohio Court Rules
Daphne Zhang reports: Owners Insurance Co. convinced the Ohio Supreme Court that it has no duty to cover a medical software company’s ransomware-related losses because the attack didn’t cause any property damage. EMOI Services LLC’s insurance policy “requires direct physical loss of or damage to media—Computer software cannot experience direct physical loss or physical damage, because…
NZ: Compliance investigation into Mercury IT breach commenced
Here’s yet another data breach case in which a court has issued a protective order. The New Zealand Privacy Commissioner writes about a court order issued after the LockBit attack on Mercury IT that might contribute to a supply chain attack; Justice Grice has released the reasons for making the interim orders this week. The High Court…
Updating the Lake Charles Memorial Health System data breach
On Oct. 25, the Hive ransomware team notified Lake Charles Memorial Health System that they had been in their system for 12 days and had exfiltrated 270 GB of the hospital, employee, and patient data. As Hive informed the health system and DataBreaches, Hive had exfiltrated data but not locked it. They demanded $900,000 to…
“No need to hack when it’s leaking:” the “Here’s how you get a HIPAA complaint” edition
So… regular readers know that DataBreaches has occasionally reported on data security incidents in the healthcare sector that involved leaks due to misconfigurations of GitHub repositories, storage buckets, open directories, etc. Not all of this site’s attempts to disclose leaks responsibly have gone smoothly, as described in a collaborative paper written with Dutch researcher Jelle…