On October 29, the Fourth Circuit Court of Appeals heard oral arguments in the government’s appeal of Conor Brian Fitzpatrick’s sentence. At issue was whether District Court Judge Leonie M. Brinkema had abused her discretion in sentencing Fitzpatrick and whether her sentence was “substantively unreasonable.” Judges have discretion in sentencing and courts are often reluctant…
Category: Commentaries and Analyses
FBI has conducted more than 30 disruption operations in 2024
Christian Vasquez reports: The FBI is seeing progress in the fight against ransomware gangs after conducting more than 30 disruption operations this year in which officials targeted the infrastructure used by those groups, one of the bureau’s top cybersecurity officials said Wednesday. Cynthia Kaiser, deputy assistant director of the FBI’s cyber division, said during CyberScoop’s…
HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation for $90,000
HHS OCR announced a second ransomware investigation settlement today. This one involved Bryan County Ambulance Authority (BCAA), a provider of emergency medical services in Oklahoma. The Bryan County Ambulance Authority breach occurred in November 2021, but was only first reported to HHS on May 18, 2022. It affected 14,273 patients. HHS’s press release (below) notes…
Open Letter to Prioritize Community Cybersecurity
Over on Infosec.Exchange, Wendy Nather mentioned an open letter that is noteworthy for its approach to improving cybersecurity. The letter to presidential candidates’ transition teams, relevant federal agencies, and members of Congress begins: The federal government focuses primarily on cybersecurity as it relates to national security. This priority is essential, but the framing allows many small,…
How many similar breaches can one entity have in one year before regulators do something?
How many data breaches can an entity have before either some regulator steps in with a corrective action plan or something happens to reduce the likelihood of more breaches? Consider the following: Breach # 1 On February 22, 2022, Minuteman Senior Services (MSS) identified suspicious activity related to an employee’s email account. According to the notification…
North Korean Group Collaborates with Play Ransomware in Significant Cyber Attack
Ravie Lakshmanan reports: Threat actors in North Korea have been implicated in a recent incident that deployed a known ransomware family called Play, underscoring their financial motivations. The activity, observed between May and September 2024, has been attributed to a threat actor tracked as Jumpy Pisces, which is also known as Andariel, APT45, DarkSeoul, Nickel Hyatt,…