Medsurant Health in Pennsylvania recently notified HHS that 45,000 patients were impacted by a breach. The patients are not yet being notified, however, because it seems Medsurant is still trying to figure out who needs to be notified. In a statement published November 29, Medsurant stated that they received an email from a threat actor…
Author: Dissent
DNA Diagnostics Center notifying more than 2 million people who used a national genetic testing service
People who had their personal information collected by a national genetic testing organization between 2004 and 2012 may have never known that their information was acquired by DNA Diagnostics Center (DDC) in Ohio in 2012. They may find out now, though, as DDC fell prey to a cyberattack in May and data was exfiltrated over…
Seventh months after initial discovery, Broward Public Schools discloses Conti attack also impacted employees’ health insurance data
In March, 2021, Broward County Public Schools disclosed a breach that captured the public’s attention when Conti threat actors subsequently released a copy of their negotiation chat logs. When negotiations failed to result in an agreement, the threat actors dumped nearly 26,000 files on their dark web and clearnet leak sites. Now, seven months after…
Recovering from ransomware: One organization’s inside story
Yann Serra reports: On Sunday 21 February 2021, Manutan, a large office equipment distributor, discovered that two-thirds of its 1,200 servers had succumbed to a cyber attack by the DoppelPaymer ransomware crew. Commercial activity at the France-headquartered company – which has 25 subsidiaries spread across Europe – would be frozen for 10 days and did not resume fully until…
Ransomware group continually rebrands to slip under the radar
Lindsey O’Donnell-Welch writes: A ransomware operator has continually rebranded itself over the past year in order to evade detection, while launching cyberattacks on critical infrastructure across several industries. Researchers with Mandiant detailed a threat group called UNC2190, which is an operator behind an affiliate ransomware program. Since June, researchers said they have observed the group targeting…
Yanluowang ransomware operation matures with experienced affiliates
Ionut Ilascu reports: An affiliate of the recently discovered Yanluowang ransomware operation is focusing its attacks on U.S. organizations in the financial sector using BazarLoader malware in the reconnaissance stage. Based on observed tactics, techniques, and procedures, the threat actor is experienced with ransomware-as-a-service (RaaS) operations and may be linked with the Fivehands group. Read more on…