The UT investigated the decision-making process of victims who had to pay ransoms during ransomware attacks. UT researcher Tom Meurs and his colleagues analyzed 481 ransomware attacks, data from the Dutch police and a Dutch incident response party. Organizations with recoverable backups in particular were often better able to avoid paying ransoms. Data exfiltration led…
Category: Breach Incidents
Primary Health & Wellness Center, LLC’s public notice of ransomware incident
In the process of researching breach reports submitted to HHS, DataBreaches came across a public notice for an incident affecting Primary Health & Wellness Center, LLC in Maryland. The covered entity is to be commended for the details and transparency in their notice, although they do not name the threat actor/group involved or any details…
CISA pushes federal agencies to patch Citrix RCE within a week
Sergiu Gatlan reports: Today, CISA ordered U.S. federal agencies to secure their systems against three recently patched Citrix NetScaler and Google Chrome zero-days actively exploited in attacks, pushing for a Citrix RCE bug to be patched within a week. The cybersecurity agency added the flaws to its Known Exploited Vulnerabilities Catalog today, saying that such vulnerabilities are “frequent attack…
HMSA member data possibly compromised after data breach
Emily Cervantes reports: Hawaii Medical Service Administration employee information may be compromised after their vendor partner fell victim to a cyber attack. In early Sept. 2023, HMSA’s health management service vendor, Navvis, announced they experienced a data privacy event that compromised the personal and protected health information for former and current employees. Navvis immediately launched…
Bluewater Health getting new, more secure hospital info system
Tyler Kula reports: Bluewater Health, hardest hit by a cyberattack on five Southwestern Ontario hospitals last fall, had a relatively dated system for storing and sharing patient information at the time, Bluewater Health’s board chairperson says. “It did make a difference,” said Margaret Dragan, about the hospital group’s 20-plus-year-old hospital information system that’s been eyed for…
Fred Hutch failed to reveal threats of potential swatting attacks until this site revealed the threat. Should they have disclosed it themselves?
On December 28, DataBreaches published snippets from a chat with a threat actor (TA) who claimed to have involvement with both the Fred Hutch cyberattack and the Integris cyberattack. In the course of that exchange, the TA surprised DataBreaches by claiming that they had threatened Fred Hutch with swatting patients. From DataBreaches’ previous reporting: “So…