Feds Issues Advisory About SafePay Ransomware Group

Posted by Steve Alder

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Secret Service (USSS), and cybersecurity agencies in Germany and the United Kingdom have issued a joint cybersecurity advisory about the SafePay ransomware group.

SafePay is a financially motivated threat group that has been in operation since August 2024 and targets businesses and critical infrastructure entities in North and South America, Europe, and Australia. The group engages in double extortion tactics, exfiltrating data, encrypting files with ransomware, and issuing ransom demands, payment of which is required to unlock files and prevent stolen data from being leaked online.

Just two months after the group was first identified, it attacked the U.S. business service provider Conduent Business Services and exfiltrated 8.5 terabytes of data. Conduent reported the incident as affecting 62.2 million individuals. The incident ranks as the third-largest U.S. healthcare data breach of all time. The group has accelerated attacks and is now one of the most prolific ransomware groups, having attacked more than 600 entities from multiple critical infrastructure sectors.

The security advisory includes the latest tactics, techniques, and procedures (TTPs) observed by the authoring agencies and security researchers. SafePay actors use a variety of techniques for initial access, including brute force password attacks, credential exposure, and vulnerability exploitation for edge devices, including the Cisco Adaptive Security Appliance vulnerabilities CVE-2023-20269 and CVE-2020-3259; the Veeam Backup & Replication vulnerabilities CVE-2023-27532 & CVE-2024-40711; and the SonicWall SonicOS vulnerability CVE-2024-40766. VPNs are also targeted, especially the Mullvad VPN provider, using phished account profiles.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Once networks are compromised, SafePay actors take over existing accounts or create new ones and use legitimate system tools for credential theft, network scanning, lateral movement, and data exfiltration. Valuable files are identified and exfiltrated, security protections are disabled, files are encrypted, and ransom notes are dropped.

The authorizing agencies recommend regularly patching and updating systems, prioritizing patches for the above-mentioned vulnerabilities and other known exploited vulnerabilities (KEVs). Administrative tools and privileges should be restricted, and the Zero Trust Principle should be implemented. Account security should be strengthened by implementing identity, credential, and access management (ICAM) policies and multifactor authentication. Indicators of Compromise (IoCs), detailed TTPs, and further recommendations are detailed in the security advisory.

The post Feds Issues Advisory About SafePay Ransomware Group appeared first on The HIPAA Journal.

California Settles 23andMe Data Breach Lawsuit for $6 Million

Posted by Steve Alder

In July, a coalition of 42 state attorneys general agreed to an $18 million settlement with 23andMe to resolve claims that the company violated state laws by failing to implement appropriate data security measures to prevent credential-based attacks. California did not participate in the action, having opted to pursue its own legal claims against the company. A settlement has now been agreed between 23andMe and California to resolve the alleged violations of California laws.

The data breach, covered by the HIPAA Journal in this post, exposed the personal information and genetic information of approximately 6.9 million individuals, including 855,000 California residents. While the attack involved credential stuffing and took advantage of 23andMe customers’ poor password security practices, the states argued that the company should have been aware that there was a risk of customer accounts being targeted, and the company should therefore have implemented security measures for detecting and blocking attacks on customer accounts.

Following the security incident, 23andMe filed for bankruptcy protection and the company was bought for $305 million by TTAM Research Institute, a non-profit controlled by 23andMe co-founder Anne Wojcicki. California attempted to block the sale of the company, claiming it violated the California Genetic Information Privacy Act because 23andMe customers had not given their consent to the sale, which involved the transfer of their personal and genetic information to TTAM Research Institute. The state’s attempt to block the sale was unsuccessful, and a bankruptcy court judge ruled that California could not sue TTAM Research Institute over the data breach to recover money.

California planned to appeal the ruling; however, under the data breach settlement agreement, the state has agreed to drop further appeals. Under the terms of the settlement, California will be paid $6 million. While the sale of the company and transfer of customer data to TTAM Research Institute will go ahead, 23andMe customers have the right to request that their personal and genetic data be deleted.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

“I am proud to fight for the privacy rights of Californians and to deliver this settlement for consumers ​who put their trust in 23andMe,” said California Attorney General Rob Bonta. “I want to remind Californians that customers of 23andMe can delete their private, genetic data — no matter who owns it.” In addition to the $24 million in settlements, 23andMe agreed to settle class action data breach litigation and will pay $46.75 million to its customers. The settlement was approved by the court in July 2026.

The post California Settles 23andMe Data Breach Lawsuit for $6 Million appeared first on The HIPAA Journal.