Magellan Health is notifying an undisclosed number of employees who information may have been exfiltrated in a ransomware attack. The attack began with a phishing attack on April 6 that impersonated a Magellan client. On April 11, Magellan discovered the breach, and called in Mandiant to investigate. Their investigation revealed that the attackers had exfiltrated…
Maze Team under the spotlight
Maze has seemingly done such a good job getting media attention that we’re also seeing more analyses of their methods. This week, check out this report from FireEye: Navigating the MAZE: Tactics, Techniques and Procedures Associated With MAZE Ransomware Incidents and this report from Sophos: Maze ransomware: extorting victims for 1 year and counting In…
Paying the Ransom Doubles Cost of Recovering from a Ransomware Attack, According to Sophos
One of the interesting things I learned this past week at the Privacy+Security Forum Spring Academy was that 75% of a prominent law firm’s clients were able to recover from a ransomware attack without having to pay ransom. I was surprised to hear that statistic, as I would have guessed a higher percentage paid ransom….
Aeries Student Information System discloses breach (with updates)
Aeries Software recently announced a data breach. I didn’t see it, but a reader kindly stuck it under my cybernose today so that I could share it with you. The software firm’s notice of April 27 applies to hosted customers of their Aeries Student Information System. From their notice: What Happened? In late November 2019,…
Washington, D.C. Adds Security Requirements in New Data Breach Notification Law
Rachel Marmor of Davis Wright Tremaine writes: Washington, D.C. amended its data breach notification law (D.C. Act 23-268) on March 26, 2020, expanding the definition of personal information covered by the law and requiring businesses collecting data from D.C. residents to implement “reasonable security safeguards.” Because D.C. law already provides a private right of action…
Vegas woman charged with running ID theft lab
A Las Vegas woman is charged with operating an identity theft lab after police said they found a cache of stolen mail, medical records from cancer patients and Social Security numbers in her possession. Las Vegas Justice Court records show that Diane Dove, 40, faces a single felony count of establishing or possessing a financial…