CYBER SECURITY NEWS – WEEK OF FEBRUARY 26, 2024

Hack at Services Firm Hits 2.4 Million Patients

• Medical Management Resource Group, which operates as American Vision Partners and provides administrative services to about a dozen ophthalmology practice in several states is notifying nearly 2.4 million patients of a November hacking incident that may have compromised its sensitive information.
• The Tempe, Arizona-based firm said that on Nov. 14 it had detected unauthorized activity on certain parts of its network. The incident involved the hack of a network server and affected more than 2.35 million individuals, the company said in a Feb. 6 report to the Department of Health and Human Services.
• The compromised information varies among patients but may include names, contact information, birthdates and medical information including services received, clinical records and medications. For some individuals, the hack also affected Social Security numbers and insurance information.

*Source

 

DC-area school system says data of 100,000 people affected in ransomware attack

• A school district in the Washington, D.C., suburbs says the personal information of nearly 100,000 people was breached by a ransomware gang right before classes started in the fall. Prince George’s County Public Schools (PGCPS) finished its review of the incident earlier this year and determined that “personal information was included in the potentially impacted data set.”
• The ransomware attack, discovered August 14 last year and publicy reported soon afterward, resulted in a network outage for the Maryland district, which serves about 130,000 students. “The information present in the files that may have been viewed or acquired as a result of this incident varies per person, and includes individuals’ names, financial account information, and Social Security Number,” PGCPS said.
• In total, 99,543 people were affected in the August breach, according to the regulatory filing. The paperwork does not mention any specific cybercrime group.

*Source

 

Breach at Aussie Telecom Tangerine Affects 232,000 Customers

• Australian telecom company Tangerine is blaming the compromise of a third-party contractor’s credentials for exposing personal information of approximately 232,000 customers, which had been stored in a legacy database.
• The telecommunications company confirmed on Wednesday that the breach had occurred on Sunday and exposed customers’ names, birthdates, mobile numbers, email addresses, postal addresses and Tangerine account numbers.
• The provider said it had learned about the incident on Tuesday, immediately blocked the compromised user account’s access to the network and systems, and shut off access to the affected legacy database.

*Source

 

Insider Steals 80,000 Email Addresses From District Councils

• A former council worker has been cautioned by police after admitting taking tens of thousands of residents’ emails from a database in order to promote a business, it has been revealed.
• The data breach took place in November last year when 79,000 email addresses were copied from a garden waste collection database. A separate database of email addresses from Warwick District Council were also impacted by the breach.
• They were taken by an employee, now no longer working for the council, “with the purpose of promoting a business not related to the council,” the local authority said.

*Source

 

Quik Pawn Shop Falls Victim to Alleged Cyberattack by Akira Ransomware Group

• The Akira ransomware group has allegedly claimed the Quik Pawn Shop cyberattack on the dark web, adding yet another victim to their list. The cyberattack on Quik Pawn Shop, which offers a range of financial services, occurred on February 22, 2024 and has left Quik Pawn Shop grappling with the aftermath of a data breach.
• The cybercriminals behind the attack have claimed to have obtained 140 GB of files from Quik Pawn Shop’s systems, along with a database containing extensive customer information. This data includes millions of records containing sensitive details such as dates of birth, addresses, Social Security numbers, and financial transaction histories.
• The company’s website appears to be offline and visitors to the site are met with an error message stating, “This site can’t be reached. Check if there is a typo in quikpawnshop.com.” This outage has hindered communication with the organization, leaving customers in the dark about the extent of the breach and its implications.

*Source

 

US health tech giant Change Healthcare hit by cyberattack

• U.S. healthcare technology giant Change Healthcare has confirmed a cyberattack on its systems. In a brief statement Wednesday, the company said it was “experiencing a network interruption related to a cyber security issue.” The specific nature of the cybersecurity incident was not disclosed.
• Change Healthcare is one of the largest healthcare technology companies in the United States and handles patient payments across the U.S. healthcare system. The tech giant boasts on its website that it handles 15 billion healthcare transactions annually and that one-in-three U.S. patient records are “touched by our clinical connectivity solutions.”
• In 2022, health insurance giant UnitedHealth Group completed its merger of U.S. healthcare services giant Optum and Change Healthcare in a $7.8 billion deal, which allowed Optum broad access to patient records on tens of millions of Americans. Both Optum and Change Healthcare are owned by health insurance giant UnitedHealth Group.

*Source

SECUREFACT ARCHIVE >