June 22 — CHI St. Luke’s Health-Memorial Lufkin announced today that it has taken action after becoming aware of an incident that took place on April 23, 2020 in which an unapproved third party gained access to patient information. Though we have no evidence to confirm that information was actually viewed or obtained by the…
Vermont’s Amendments to Data Breach Law and New Student Privacy Law Effective July 1, 2020
From Hunton Andrews Kurth: On July 1, 2020, amendments to Vermont’s data breach notification law, signed into law earlier this year, will take effect along with Vermont’s new student privacy law. Security Breach Notice Act The amendments to Vermont’s Security Breach Notice Act include expanding the definition of Personally Identifiable Information (“PII”), expanding the definition of a…
Citing NY’s SHIELD Act, NYSBA Approves Cybersecurity CLE Requirement for All Attorneys
Caroline Morgan of Fox Rothschild reports that the New York State Bar Association (NYSBA) has approved a new requirement that New York attorneys take one cybsersecurity CLE credit. The proposal is presently before the New York CLE board for consideration. Read more on Privacy Compliance & Data Security.
Ryuk ransomware deployed two weeks after Trickbot infection
Ionut Ilascu reports: Researchers at SetinelOne have detailed the activity observed from logs on a Cobalt Strike server that TrickBot used to profile networks and systems. Once the actor took interest in a compromised network, they used modules from Cobalt Strike threat emulation software for red teams and penetration testers. One component is the DACheck script to check…
Phishing attacks impersonate QuickBooks invoices ahead of July 15 tax deadline
Heads up! Lance Whitney describes the type of campaign CEOs and employees need to remain vigilant about: The campaign analyzed was aimed at a cutting-edge technology company, a tempting target for cybercriminals looking for maximum profits. In the first wave, the cybercriminals spoofed QuickBooks, a product commonly being used in advance of the July 15…
Nefilim Ransomware Gang Tied to Citrix Gateway Hacks
Mathew Schwartz reports: A crime gang seeking “ransomware attack opportunities” is targeting organizations that use unpatched or poorly secured Citrix remote-access technology, then stealing data, unleashing crypto-locking malware and using the threat of exfiltrated data being publicly dumped to try to force payment, New Zealand’s national computer emergency response team warns. In an alert issued…