Two of the more well-known Russian-language forums have “arbitration” or “complaint” sections where members can present complaints and evidence against other members involving financial disputes or claims. Those disputes, with evidence provided non-publicly to the moderators/arbitrators, often provide interesting insights into threat actors’ methods or relationships. In the past few weeks, there have been two…
Category: Commentaries and Analyses
After going up, up, up, will ransom payments in healthcare and education sectors start dropping?
Key points: More than half of ransomware victims reportedly pay ransom, but there is an absence of quality data and reporting that would enable better analyses. As payouts have increased, the number of customers electing to have cyberinsurance coverage (the take-up rate) has increased, although SMBs lag behind mid- to large-sized entities. As payouts have…
One Employee’s Accidental Email Leads To A Significant Data Breach Ruling in Federal Appeals Court
Jeffrey Csercsevits of Fisher Phillips writes: A federal appeals court recently addressed whether employees had standing to bring a lawsuit when their personally identifiable information (PII) was inadvertently circulated to other employees at the company, with no indication of misuse or external disclosure. In McMorris v. Carlos Lopez & Associates, LLC, the 2nd Circuit Court of…
Having your ePHI dumped on the dark web by threat actors doesn’t necessarily give you standing to sue
In May, 2020, Assured Imaging in Arizona experienced a ransomware attack that they revealed in August, 2020.The incident reportedly impacted 244,813 patients. The data dump by the Pysa threat actors contained a lot of ePHI that appeared to be mostly mammography pre-screening histories or forms with data types such as medical record number, names, addresses,…
AEON Clinical Laboratories (Peachstate) Pays $25,000 to Settle Potential HIPAA Security Rule Violations
Peachstate Health Management, LLC, doing business as AEON Clinical Laboratories (Peachstate), has agreed to pay $25,000 to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) and to implement a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. …
Indonesian government bans Raid Forums after leak, in talks over data protection bill
Ursula Florene reports: After the alleged leak of personal data of more than 200 million Indonesians, the Communications and Information Ministry has ordered internet service providers to block access to data sharing site Raid Forums. Hackers have used the site to sell information in multiple cases, including those involving e-commerce platforms Tokopedia and Bukalapak. “Raid Forums has…