The Department of Health and Human Services Sept. 18 alerted the health care sector to a critical vulnerability in ManageEngine products that allows an attacker to perform remote code execution and which a North Korean state-sponsored actor is reportedly using to target health care entities in Europe and the United States.
Cybersecurity News
Latest
The Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center (HC3) yesterday alerted the sector to a ransomware group that has claimed over 60 victims since March, demanding payments ranging from $200,000 to $4 million.
The U.S. Treasury Department, in coordination with the United Kingdom, Sept. 7 sanctioned 11 individuals who are part of the Russia-based Trickbot cybercrime group, whose targets have included hospitals and other critical infrastructure organizations.
The Federal Bureau of Investigations, amid one of the largest-ever U.S.-led enforcement actions against a botnet, Aug. 29 announced the successful takedown of QakBot, the botnet infrastructure used by cybercriminals for ransomware, financial fraud and other criminal activity.
A new resource from the Cybersecurity and Infrastructure Security Agency, National Security Agency and the National Institute of Standards and Technology is helping hospitals and other critical infrastructure organizations get up to speed on the impacts of quantum capabilities in cybersecurity and assist their early planning for migration to post-quantum cryptographic standards.
The Joint Commission yesterday released an alert reviewing how health care organizations can prepare to deliver safe patient care in the event of a cyberattack, calling the potential to experience a cyberattack that adversely affects operations not an “if” but a “when” question. John Riggi, AHA’s national director for cybersecurity and risk, provided expert advice to TJC as it developed the resource.
U.S. and other allied nations’ cybersecurity agencies urged software vendors to implement secure design practices and organizations to implement a centralized patch management system and apply timely patches, noting that malicious actors in 2022 most often targeted known vulnerabilities.
HHS alerts organizations to Rhysida ransomware.
U.S. and Australian cybersecurity agencies July 27 warned organizations using web applications about vulnerabilities that enable malicious actors to modify, delete or access sensitive data and urged them to implement recommendations to protect their data from compromise.
A May data breach involving MOVEit Transfer software on Medicare contractor Maximus Federal Services’ corporate network may have exposed an estimated 612,000 Medicare beneficiaries’ personally identifiable information and/or protected health information, the Centers for Medicare & Medicaid Services announced July 28.
Malicious actors recently exploited a Citrix vulnerability to steal active directory data from a critical infrastructure organization, the Cybersecurity and Infrastructure Security Agency reported recently, urging organizations to take certain steps to detect a potential system compromise and apply patches.
The Department of Health and Human Services’ Office for Civil Rights and Federal Trade Commission yesterday sent a letter to about 130 hospital systems and telehealth providers reminding them to comply with HIPAA Privacy, Security and Breach Notification Rules, the FTC Act and FTC Health Breach Notification Rule when using technologies that can track a user’s online activities, such as Meta/Facebook Pixel and Google Analytics.
Microsoft announced plans to offer government and commercial customers free access to additional cloud security logs beginning in September, prompting applause from the Cybersecurity and Infrastructure Security Agency.
The White House the week of July 10 released a federal plan for collaborating with the private sector and others to implement the National Cybersecurity Strategy.
In response to recent malicious activity identified in a federal civilian agency’s Microsoft 365 audit logs, the Cybersecurity and Infrastructure Security Agency and FBI July 12 released guidance to help health care and other critical infrastructure organizations detect similar malicious activity and secure their cloud environments.
The Homeland Security Systems Engineering and Development Institute, sponsored by the Department of Homeland Security and operated by MITRE, recently announced this year’s Top 25 Most Dangerous Software Weaknesses, which an attacker could use to control a system, steal data and prevent applications from working.
The Cybersecurity & Infrastructure Security Agency is warning of a significant, high-risk vulnerability in Medtronic’s Paceart Optima System, which is used to compile and manage patients’ cardiac device data.
A Department of Justice expert discusses the Cybersecurity Information Sharing Act of 2015 and how the relatively unknown law can be a valuable tool for protection.
The Department of Health and Human Services Friday alerted the health sector to a recent ransomware attack on a U.S. cancer center that reduced cancer treatment capability, rendered digital services unavailable and threatened exposure of patient personal health information.
The Cybersecurity and Infrastructure Security Agency yesterday urged organizations to apply Progress Software updates to the MOVEit Transfer web application to prevent ransomware attackers from exploiting a critical vulnerability used to steal data