CYBER SECURITY NEWS – WEEK OF JULY 03, 2023
Hospital cyber attacks surge, risking struggling bottom lines
- Health facilities have been hit with 226 digital incursions affecting 36 million people this year, on track to be more widespread than 2022 attacks, according to John Riggi, the national advisor for cybersecurity and risk at the American Hospital Association.
- Cyber raids on hospitals more than tripled in the past five years and have become more sophisticated, just when hospitals are coping with higher costs for labor and supplies and grappling with staff shortages.
- Health-care facilities are attractive targets for cybercriminals because they hold ample personal data on patients, Matt Fabian and Lisa Washburn of Municipal Market Analytics wrote in a research note. Staffing shortages and wide use of third-party technology make the sector particularly vulnerable.
US Patent and Trademark Office notifies filers of years-long data leak
- The federal government agency responsible for granting patents and trademarks has confirmed it inadvertently exposed about 61,000 filers’ private addresses in a years-long data spill.
- The U.S. Patent and Trademark Office (USPTO) said in a notice sent to affected trademark applicants that their private domicile address — often their home address — inadvertently appeared in public records between February 2020 and March 2023.
- U.S. law requires applicants to include their private address when submitting a trademark application in efforts to crack down on fraudulent trademark filings.
- USPTO said the issue was discovered in one of its APIs, which allows apps used by both agency staff and filers to access a system for checking the status of pending and registered trademarks.
Senior Choice, Inc. provides notice of security incident
- On April 24, 2023, Senior Choice discovered suspicious activity that affected some internal systems used for business operations. Upon becoming aware of the incident, Senior Choice immediately implemented measures to contain the situation and further safeguard the security of its computer systems.
- Over the past weeks, the Senior Choice team has been working diligently to continue its investigation, add further technical safeguards to existing protections, and bring the limited number of impacted systems back online quickly and securely.
- Immediately upon discovery of this incident, Senior Choice engaged the assistance of leading industry professionals in data privacy and security, who continue to lead the incident investigation, response and reporting to relevant government agencies, including law enforcement.
Hackers steal data of 45,000 New York City students in MOVEit breach
- The New York City Department of Education (NYC DOE) says hackers stole documents containing the sensitive personal information of up to 45,000 students from its MOVEit Transfer server.
- The managed file transfer (MFT) software was used by NYC DOE to securely transfer data and documents internally and externally to various vendors, including special education service providers.
- The affected server was taken offline after the breach was discovered, and NYC DOE is working with NYC Cyber Command to address the incident.
Siemens Energy confirms data breach after MOVEit data-theft attack
- Siemens Energy has confirmed that data was stolen during the recent Clop ransomware data-theft attacks using a zero-day vulnerability in the MOVEit Transfer platform.
- Clop listed Siemens Energy on their data leak site, indicating that data was stolen during a breach on the company.
- As part of Clop’s extortion strategy, they first begin listing a company’s name on their data leak site to apply pressure, followed by the eventual leaking of data.
- However, Siemens Energy says that no critical data was stolen, and business operations were not impacted
Fort Worth gov’t officials confirm cyber incident but deny leak of sensitive info
- A hacking group named SiegedSec took to Telegram to claim that it stole about 500,000 files from the government of the city, which has more than 935,000 residents.
- The group claimed it stole administrator credentials and made copies of work orders, employee lists, invoices, police reports, emails between employees/contractors, internal documents, camera footage and more — about 180GB of data in total.
- “The city of Fort Worth has confirmed that the posted information did originate from our computer systems. However, that data came from a website that our workers use to manage their maintenance activities and not from the city’s public facing intranet website,” city’s Chief Technology Officer Kevin Gunn said.