Ransomware attacks have continued to increase in Q2, 2019, according to a new report from ransomware recovery service provider Coveware. When businesses experience a ransomware attack, Coveware helps firms recover their data, either through free remediation options or by negotiating with the attackers.

Coveware studied anonymized data on ransomware attacks experienced by its clients and found that ransomware payments have increased by 184% during the second quarter of 2019. The average ransom payment in Q1 was $12,762. In Quarter 2, the average payment was $36,295.

In Q2, 2019, the most common method of attack was via RDP ports, which were the attack vector in 59.1% of ransomware attacks. Coveware notes that there has been a sharp quarter-over-quarter increase in email-based attacks, which accounted for 34.1% of incidents in Q2. Software vulnerabilities were exploited in 6.8% of attacks. The software vulnerabilities were exploited by the Sodinokibi ransomware threat actors, who used vulnerabilities in managed service provider (MSP) backend integrations (Webroot/Kaseya) to gain access to MSP systems and those of their clients.

There is naturally downtime following a ransomware attack regardless of whether the ransom is paid or files are restored from backups. The average duration of downtime increased from 7.3 days to 9.6 days in Q2.

One of the main reasons for the increase in recovery time was an increase in attacks on MSPs. In addition to the attackers infecting the MSP, the ransomware was spread to all MSP clients through their remote connections to their clients’ systems. Such extensive attacks naturally take longer to resolve.

Coveware notes that there has been an increase in attacks by affiliates under the ransomware-as-a-service model. Many ransomware developers run their own campaigns like a military operation and communicate quickly with victims. Affiliates tend to be more disorganized, which can cause problems during negotiations and can cause issues when trying to decrypt data. That inevitably leads to a delay in recovery. The threat actors behind the Ryuk ransomware attacks sent a viable decryptor within 3 hours of the ransom being paid, and the Sodinokibi attackers similarly sent decryptors through quickly.

No one wants to pay someone that has just attacked their business, but many companies are left with little choice. If backups have not been made or data cannot otherwise be recovered, paying the ransom is the only option other major data loss.

The cost of recovery from a ransomware attack can be split into two parts. The first are the costs of mitigating the attack which include the cost of a forensic analysis, rebuilding servers and workstations, eradicating the ransomware, and file recovery. The ransom, if paid, is also a mitigation cost. Ransom payments were highest for Ryuk ransomware attacks. The average payment was $267,742.

All of those costs, including the ransom payment, come to a fraction of the total cost of recovery. The main cost is downtime. With systems out of action, productivity falls dramatically, and the business loses revenue opportunities. Coveware’s figures show that the losses due to downtime are between 5 and 10 times the cost of the ransom payment.

A quick recovery will keep the costs to a minimum, but payment of the ransom does not guarantee file recovery. Out of the clients that paid the ransom, 96% were able to decrypt their data. 4% paid the ransom and couldn’t recover their files.

Even if the decryptor works there is likely to be some data loss.  This happens when the encryption process is flawed and some files were only partially encrypted and corrupted or, in some cases, files are deleted during the encryption or recovery process. On average, file recovery using the decryptors resulted in 8% file loss and 13% file loss with Ryuk ransomware. Sodinokibi is a more polished ransomware variant and the recovery rate was close to 100%.

Ryuk ransomware was used in 23.9% of attacks, Phobos in 17% of attacks, Dharma in 13.6% of attacks, and Sodinokibi in 12.5% of attacks.  Ryuk ransomware attacks were mostly on medium to large organizations with an average of 3,187 employees. Sodinokibi ransomware attacks were mostly on small MSPs, with an average of 79 employees.

Attacks on large organizations are increasing. In Q1, breached firms had an average of 141 employees. The average jumped to 925 employees in Q2.

The post Study Reveals Increase in Ransomware Attacks and 3x Hike in Ransom Demands appeared first on HIPAA Journal.

San Francisco, CA-based Vitagene, a health tech company that provides direct-to-consumer DNA-testing services, has inadvertently exposed the personal and genealogy information of thousands of customers to unauthorized access over the Internet.

The Vitagene DNA testing service is part of a DNA-based personalized health and wellness platform. Individuals undergo genetic testing to determine their likelihood of developing certain diseases. Vitagene then develops a personalized health and wellness action plan tailored to the individual.

During beta testing, patient records were uploaded to Amazon Web Services cloud servers, but security controls had not been configured correctly. The files could be viewed by anyone without the need for any authentication. Vitagene became aware of the problem in late June and by July 1, external access to customer files was blocked.

A spokesperson for Vitagene confirmed that the breach had impacted a small number of its customers who had used its DNA-testing service between 2015 and 2017. The exposed records contained information such as names, addresses, telephone numbers, and personal and work email addresses.

Approximately 300 files contained raw genotype data. Members of the public could have viewed the information, but it would have been difficult for anyone to understand the data unless they had an understanding of genomics.

Approximately 3,000 individuals are believed to have been affected. Those individuals will be notified once the breach investigation has been completed. Vitagene is currently trying to determine whether any customer information was accessed during the time it was available online.

“We updated our security protocols in 2018 and have engaged an outside security firm to run external and internal penetration testing across our application,” said Chief Executive Officer Mehdi Maghsoodnia. “As a team we acknowledge our mistake and will keep ourselves accountable. We hope over time to prove that we are worthy of the trust that is given to us every day.”

Direct-to-consumer DNA testing services are not classed as covered entities under HIPAA and are therefore not subject to its regulations. Many consumers do not realize these types of services are not covered by HIPAA and that they do not have the same rights with respect to their data.

There have been calls for HIPAA’s reach to be extended to include DNA testing services. A bipartisan group of senators has introduced a bill that aims to address the current security gaps and help ensure that consumers privacy is protected when using direct-to-consumer genetic testing services and health apps.

The Department of Health and Human Services’ Office for Civil Rights cannot take action over the breach, but the Federal Trade Commission (FTC) could issue a fine and state attorneys could take action if there have been violations of state laws.

The post Direct-to-Consumer DNA Testing Company Exposed Personal Information Online appeared first on HIPAA Journal.