Healthcare Cybersecurity

CISA Issues Guidance for Proactively Defending Against Insider Threats

Posted by Steve Alder

Insider threats are one of the leading causes of data breaches in healthcare, more so than in many other industry sectors. A 2018 study by Verizon found insider incidents outnumbered incidents involving external parties, with 56% of healthcare data breaches due to insiders and 43% due to external actors. A study by the cybersecurity firm Metomic found that the percentage of healthcare organizations reporting no insider incidents has declined from 34% in 2019 to 24% in 2024.

Insider incidents can stem from a lack of knowledge about HIPAA or disregard for patient privacy, such as when healthcare employees snoop on medical records. Negligent insiders can easily expose patient data by failing to follow the organization’s policies and procedures, and malicious insiders steal patient information for financial gain or revenge. Copying patient information to take to a new practice or employer is also common.

Due to the high risk of insider threats in healthcare and other critical infrastructure sectors, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) is urging critical infrastructure organizations to take decisive action against insider threats, and has published a new resource specifically developed for critical infrastructure organizations and state, local, tribal, and territorial (SLTT) governments to help them assemble a multi-disciplinary insider threat management team. The guidance includes proven strategies for proactively preventing, detecting, mitigating, and responding to insider threats.

Insiders have institutional knowledge and legitimate access rights, allowing them to easily access and steal sensitive data, and detecting insider breaches can be a challenge. Insider incidents can cause significant harm to healthcare organizations, including reputational damage, revenue loss, and harm to people and key assets. “Whether driven by intent or accident, insider threats pose one of the most serious risks to organizational security and resilience- demanding proactive measures to detect, prevent, and respond,” explained CISA.

“Insider threats remain one of the most serious challenges to organizational security because they can erode trust and disrupt critical operations,” said Acting CISA Director Dr. Madhu Gottumukkala. “CISA is committed to helping organizations confront this risk head-on by delivering practical strategies, expert guidance, and actionable resources that empower leaders to act decisively — building resilient, multi-disciplinary teams, fostering accountability, and safeguarding the systems Americans rely on every day.”

Combating insider threats requires an insider threat mitigation program that includes physical security, cybersecurity, personnel awareness, and partnerships with the community, and assembling a multi-disciplinary insider threat management team is a critical part of that process. The threat management team should oversee the insider threat management program, monitor for potential threats, and act quickly to mitigate the consequences of negligent and malicious insider actions. With an effective insider threat management team in place, organizations can reduce the damage and frequency of insider threat incidents.

A threat management team will be far more effective than any one individual, with teams able to be scaled and adjusted in scope and capability as the organization matures and evolves. Having a range of insider threat subject matter experts will allow the organization to obtain varied perspectives and generate more accurate and holistic threat assessments. Team members should include threat analysts, general counsel, human resources, the CISO, CSO, as well as external parties, including investigators, law enforcement, and medical or mental health counselors.

In the guidance, CISA offers a framework consisting of four stages – Plan, Organize, Execute, and Maintain (POEM). The Plan stage allows the organization to structure and scope the role of the threat management team. The Organize phase involves the team guiding employee awareness, creating a culture of reporting, and providing the necessary support to relevant departments to identify potential insider threat activity. The Execute phase involves upholding the insider threat mitigation program, and the Maintain phase is concerned with developing the threat management team to ensure it remains effective over time.

“Insider threats can disrupt operations, compromise safety, and cause reputational damage without warning. Organizations with mature insider threat programs are more resilient to disruptions, should they occur. People are the first and best line of defense against malicious insider threats, and organizations should act now to safeguard their people and assets,” said CISA Executive Assistant Director for Infrastructure Security Steve Casapulla.

The post CISA Issues Guidance for Proactively Defending Against Insider Threats appeared first on The HIPAA Journal.

U.S. Data Compromises Hit Record High in 2025

Posted by Steve Alder

An unwanted new record was set in 2025 for data compromises, which increased by 4% from the record-breaking total in 2024, according to the Identity Theft Resource Center (ITRC). The ITRC is a non-profit organization dedicated to helping victims of data breaches, scams, and identity theft. ITRC also offers education to help consumers protect themselves against identity theft and fraud. ITRC tracks data compromises, which include data breaches, data leaks, and accidental exposures of sensitive consumer data.

The record total of 3,332 data compromises in a year represents a 79% increase in just five years, and the third successive year when more than 3,000 data compromises have been identified. While the historic high is concerning, there is at least some good news, as the number of individuals affected by data compromises has fallen sharply to the lowest annual total since 2014. Across the 3,332 data compromises, 278.8 million individuals were affected, down from 2024’s shockingly high total of 1.36 billion. The relatively low total is due to a lack of mega data breaches, which have been a regular feature over the past few years.

An ITRC poll of 1,000 U.S. consumers revealed 80% received at least one breach notice in the past year, and two-fifths received between three and five different notices. Out of the individuals who received a notice about a data breach, 88% said they experienced one or more negative consequences, such as an account takeover, an increase in spam emails and phishing attempts, or mental health issues.

Worryingly, the frequency with which data breach notices are being received is leading to breach fatigue. Out of the people who did nothing after receiving a notice, 48.3% said they had breach fatigue from so many notices, 46.1% said they had feelings of helplessness because they felt they couldn’t do anything about it, 41.6% said they did nothing because they felt from the language of the notification that the breach was not serious to warrant any action, and 36% said they didn’t trust the notice and thought it was a scam.

Out of the 3,332 data compromises, 2,928 were data breaches, involving 232,726,796 victim notices, 24 were data exposures involving 527,894 victim notices, and there were 366 unknown compromises, involving 1,584,024 victim notices. Four of the data compromises involved previously compromised data. The largest confirmed data compromises of the year (based on victim notices) occurred at PowerSchool (71.9 million), AT&T (44 million), Aflac (22.7 million), Prosper Funding (17.6 million), and Conduent Business Services. The number of individuals affected by the Conduent data breach has yet to be confirmed, but it was a massive data breach, affecting 14.7 million individuals in Texas alone.

Financial services remained the most targeted sector, with 739 confirmed data compromises, and the healthcare sector took second spot, with 534 confirmed compromises, down slightly from 2024’s 537 compromises. Professional services was the third most targeted sector with 478 compromises, followed by manufacturing (299) and education (188).

ITRC draws attention to a five-year trend of threat actors increasingly targeting static identifiers, which facilitate long-term fraud. Social Security numbers were involved in two-thirds of data breach reports in 2025, with one-third involving either bank accounts or driver’s license numbers. Between 2021 and 2025, the number of compromises involving Social Security numbers almost doubled, driver’s license data breaches increased by 139% over the same period, and bank account information breaches increased by 168%.

ITRC warns of the increasing risk from supply chain data breaches, which in the space of a year almost doubled from 660 affected entities in 2024 to 1,251 affected entities in 2025, despite the number of attacks only increasing by one year-over-year. From 2021 to 2025, supply chain breaches doubled and now account for 30% of all breaches involving at least one third party.

For several years, ITRC has highlighted the growing trend of breached entities failing to provide consumers with adequate information about a data breach, preventing them from making an informed decision about the amount of risk they face from their data being exposed. For instance, a healthcare provider states in a breach notice that there has been a data incident involving protected health information, which was potentially subject to unauthorized access, when the reality is that a ransomware group has not only exfiltrated their data, but also posted the data on the dark web, where it can be downloaded free of charge by anyone.

ITRC said that in 2020, almost 100% of data breach notifications provided the root cause of the data breach in their notices, whereas in 2025, only 30% did. In the space of a year, the percentage of notices withholding the attack vector details increased from 65% in 2024 to 70% in 2025. “Businesses should prioritize transparency over liability mitigation,” urged James Lee, ITRC president.

The post U.S. Data Compromises Hit Record High in 2025 appeared first on The HIPAA Journal.

HHS-OIG Report Highlights Key HHS Cybersecurity Challenges

Posted by Steve Alder

The U.S. Department of Health and Human Services Office of Inspector General has published its annual report on the Top Management and Performance Challenges Facing HHS to help the department improve the effectiveness and efficiency of its programs. The report highlights some of the cybersecurity challenges faced by HHS, including a lack of standardized governance and controls, which complicates HHS’s preparedness efforts to prevent and respond to cybersecurity threats.

The HHS is a large department with disparate organizational approaches to cybersecurity across its various divisions and programs. While the department has taken steps to consolidate cybersecurity functions and improve cybersecurity, HHS-OIG says overall progress is often still dependent on each division and program. In addition, the HHS has an army of contractors, grantees, and other external entities that number in the thousands. Cybersecurity solutions must be implemented within the HHS, but also by each contractor, grantee, and external entity. That makes cybersecurity improvements especially challenging, and the ability of the HHS to mitigate cybersecurity threats is often dependent on those entities implementing cybersecurity solutions specific to their operations. “Protecting technology and data requires broader efforts beyond implementing technical fixes, such as establishing clear expectations; modernizing program rules; and conducting effective oversight of the Department’s contractors, grantees, and other external entities,” HHS-OIG said.

The healthcare sector remains a key target for cyber actors. Ransomware attacks continue in volume, as financially motivated threat actors encrypt and steal data to use as leverage to obtain ransom payments. Cyberattacks are growing in sophistication and are continually evolving, and the HHS must be able to respond quickly, alert the sector about vulnerabilities under exploitation, and help prepare the sector for evolving threats.

The HHS plays a key role in improving cybersecurity across the sector and responding to threats, yet the diffuse nature of HHS cybersecurity authorities and responsibilities is complicating HHS’s response efforts. The HHS has limited resources for improving cybersecurity across the healthcare and public health sector, such as the sector’s reliance on legacy technology and workforce challenges. Further, privacy and security are governed by HIPAA, which is more than two decades old. HHS-OIG warned that the HIPAA Privacy Rule and the HIPAA Security Rule may not be sufficient to address contemporary privacy concerns and the increasing cybersecurity risks to electronic protected health information. As such, HHS-OIG said the HHS must adapt as privacy and security needs evolve.

Further regulation could help in this regard; however, the HHS has been slow to enact updates to the HIPAA Rules. A Privacy Rule update was proposed by HHS under the previous Trump administration in late 2020, yet a final rule has still not been published more than five years after the update was first proposed. The update is still on the HHS’s agenda, but there has been no indication when a final rule will be published. An extensive update to modernize the HIPAA Security Rule to strengthen cybersecurity across the sector was proposed in the final days of the Biden administration. While there is an urgent need to improve cybersecurity across the sector, it is currently unclear if the HHS, under the Trump administration, plans on implementing the proposed rule.

HHS-OIG said the HHS has taken action to address the challenges it highlights in the report, but there are considerable opportunities for further progress, and until the HIPAA Rules are updated, HHS must continue to work within the statutory authorities established by HIPAA in 1996, the HIPAA Privacy Rule in 2000, and the HIPAA Security Rule in 2003.

The post HHS-OIG Report Highlights Key HHS Cybersecurity Challenges appeared first on The HIPAA Journal.

OCR Advises HIPAA-Regulated Entities to Take Steps to Harden System Security

Posted by Steve Alder

In the first of its 2026 quarterly cybersecurity newsletters, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) urged HIPAA-regulated entities to take steps to harden system security and make it more difficult for hackers to gain access to their networks and sensitive patient and health plan member data.

The HIPAA Security Rule requires HIPAA-regulated entities to ensure the confidentiality, integrity, and availability of electronic protected health information that the regulated entity creates, receives, maintains, or transmits, which must include identifying risks and vulnerabilities to ePHI and taking timely action to reduce those risks and vulnerabilities to a low and acceptable level. OCR Director Paula Stannard has already stated this year that OCR will be looking closely at HIPAA Security Rule compliance. OCR will continue with its risk analysis enforcement initiative, which will evolve to include risk management to ensure that regulated entities are taking prompt action to reduce risks and vulnerabilities to ePHI identified by their risk analyses.

OCR explained in the newsletter that risks can be reduced by creating a set of standardized security controls and settings for different types of electronic information systems, addressing security weaknesses and vulnerabilities, and customizing electronic information systems to reduce the attack surface.

OCR reminded medical device manufacturers that they have an obligation to ensure that their devices include accurate labelling to allow users to take steps to ensure the security of the devices throughout the product lifecycle, and the importance of following Food and Drug Administration (FDA) guidance on security risk management, security architecture, and security testing. Healthcare providers need to read the labelling on their devices carefully and ensure they understand how the devices should be configured to remain safe and effective through the entire product lifecycle.

OCR highlighted three key areas for hardening system security, all of which are vital for HIPAA Security Rule compliance. Threat actors search for known vulnerabilities that can be exploited to gain a foothold in a network, including vulnerabilities in operating systems, software, and device firmware. Whether the device is brand new or has been in use for some time, patches must be applied to fix known vulnerabilities. It may not be possible to patch vulnerabilities as soon as they are discovered; however, other remedial actions should be taken, as recommended by vendors, to reduce the risk of exploitation until patches are released and can be applied. A comprehensive and accurate IT asset inventory should be maintained, and policies and procedures developed and implemented to ensure a good patching cadence for all operating systems, software, and devices.

All organizations should take steps to reduce the attack surface by removing unnecessary software and devices, including software and devices that are no longer used, software features included in operating systems that serve no purpose for the regulated entity, and generic and service accounts created during the installation process. Accounts created during installation may have default passwords, which must be changed. OCR explained that in many of its investigations, accounts have been found for well-known databases, networking software, and anti-malware solutions that still have default passwords that provide privileged access.

Many cyberattacks occur as a result of misconfigurations. HIPAA-regulated entities must ensure security measures are installed, enabled, and properly configured. “Security measures often found in operating systems, as well as some other software, intersect with some of the technical safeguard standards and implementation specifications of the HIPAA Security Rule, such as, for example, access controls, encryption, audit controls, and authentication,” explained OCR. “A regulated entity’s risk analysis and risk management plan can inform its decisions regarding the implementation of these and other security measures.”

As OCR will be scrutinizing risk management and has advised regulated entities of their responsibilities to harden system security, all regulated entities should ensure they take the advice on board. “Defining, creating, and applying system hardening techniques is not a one-and-done exercise,” explained OCR. “Evaluating the ongoing effectiveness of implemented security measures is important to ensure such measures remain effective over time,” and is essential for HIPAA Security Rule compliance.

The post OCR Advises HIPAA-Regulated Entities to Take Steps to Harden System Security appeared first on The HIPAA Journal.

Ransomware Attacks Increased by 58% in 2025

Posted by Steve Alder

The threat from ransomware is greater than ever, according to a new report from GuidePoint Security. The cybersecurity firm recorded a 58% year-over-year increase in victims, making 2025 the most active year ever reported by GuidePoint Security. In 2025, GuidePoint Security tracked 2,287 unique victims in Q4, 2025 alone – the largest number of victims in any quarter tracked by the GuidePoint Research and Intelligence Team (GRIT). December was the most active month in terms of claimed victims, which increased 42% year-over-year to 814 attacks. On average, 145 new victims were added to dark web data leak sites every week in 2025, with the year ending with 7,515 claimed victims.

Law enforcement operations have targeted the most active groups, and there have been notable successes; however, they have had little effect on the number of victims, which continues to increase. Rather than the ransomware-as-a-service (RaaS) landscape being dominated by one or two major actors, law enforcement operations have helped create a highly fragmented ecosystem, with smaller groups conducting attacks in high volume, using repeatable operations. In 2025, GRIT tracked 124 distinct named ransomware groups – a 46% increase from 2024 and the highest number of groups ever recorded in a single year.

While ransomware attacks are conducted globally, as in previous years, ransomware actors are primarily focused on the United States, where 55% of attacks were conducted last year, followed by Canada, which accounted for 4.5% of attacks. The manufacturing sector was the most heavily targeted, accounting for 14% of attacks, followed by the technology sector (9%), and retail/wholesale (7%). Healthcare ranked in fourth spot, with more than 500 victims in 2025.

Qilin, the most prolific RaaS group in 2025, disproportionately targets the healthcare sector. The group, which emerged in June 2024, is based in Eastern Europe and is thought to be a rebrand of the Agenda ransomware group. In 2024, the group added 154 victims to its dark web data leak site, increasing that tally by 578% to 1,044 victims in 2025, most likely by increasing its number of affiliates, many of whom are thought to have previously worked with the RansomHub group that shut down operations in April 2025. The large number of affiliates, each with their own specialties, means the group uses diverse tactics in its attacks. To put the volume of attacks into perspective, in 2025, Qilin conducted more attacks than LockBit did at its peak.

Qilin has claimed more healthcare victims than any other ransomware group, one of the most notable of which was UK pathology lab Synnovis. That single attack has reportedly caused more than $40 million in losses. The group is expected to continue as the most dominant group in 2026, although expanding operations to such an extent will make it a target for law enforcement. INC Ransom was the second biggest threat to healthcare organizations in 2025, followed by SafePay. While SafePay has been observed targeting small to mid-sized organizations, the group claimed responsibility for the ransomware attack on Conduent Business Services, which recently confirmed that 14.7 million individuals in Texas alone had their data compromised in the attack.

A relatively new ransomware group called Sinobi has conducted several attacks on healthcare organizations since it emerged in mid-2025. The group picked up the pace in Q4, adding 149 victims to its data leak site. GRIT notes that such a significant increase in tempo just a few months after forming is indicative of an established rather than an emerging or developing RaaS group, indicating the group may be a rebrand or at least has some highly experienced affiliates. In 2026, Sinobi is expected to pose a significant threat to the healthcare sector. LockBit has also returned since the law enforcement disruption in 2024, adding 106 new victims to its data leak site in December. LockBit similarly has no qualms about attacking the healthcare sector and is likely to be a significant threat in 2026.

There is growing evidence that ransomware groups are incorporating AI into their operations, most commonly for social engineering to overcome language barriers, personalize social engineering, and craft contextually appropriate lures that bypass traditional detection methods. They are also thought to have adopted AI to analyze the vast amounts of data they exfiltrate in their attacks to identify high-value data and determine appropriate ransom demands. While there are fears of AI-powered attacks, that has yet to be observed, with threat actors using AI to augment existing capabilities, rather than create fully autonomous and AI-coded malware, although both could become accessible enough for broader adoption in 2026.

“The year 2026 will likely see continued convergence of criminal innovation and AI capabilities, demanding that defenders adopt equally sophisticated technologies and intelligence-led approaches,” concluded GRIT. “The organizations best positioned to withstand this evolution will be those that prioritize rapid detection and response, implement comprehensive identity and access controls, and integrate AI-powered defenses as essential components of their security architecture rather than experimental additions.”

The post Ransomware Attacks Increased by 58% in 2025 appeared first on The HIPAA Journal.

October 2025 Healthcare Data Breach Report

Posted by Steve Alder

A delayed October 2025 healthcare data breach report due to the government shutdown for the whole of the month, which caused a significant delay at the HHS’ Office for Civil Rights, which failed to upload any data breach reports in October.  The shutdown ended on November 12, 2025, and the HHS had a considerable backlog of data breaches to add to the data breach portal. When a data breach report is received, OCR verifies the data, a process that may take up to around two weeks, before it is added to the OCR breach portal. Data breaches continued to be added for October well into December.

healthcare data breaches in the past 12 months - October 2025

Based on data obtained from OCR on December 31, 2025, OCR received 28 reports of data breaches affecting 500 or more individuals in October – the lowest monthly total of the year, the lowest total since the 28 reported data breaches in May 2020, and a 31.7% month-over-month reduction in large healthcare data breaches.

October healthcare data breaches 2020-2025

While there has been a downward trend in data breaches, the October total is suspiciously low, which could indicate the backlog of data breach reports has yet to be cleared. The totals will be better reflected in our 2025 healthcare data breach report, due for publication in late January, and our healthcare data breach statistics page.

Individuals affected by healthcare data breaches in the past 12 months - october 2025

While breach numbers are down, the number of affected individuals increased by 540% month-over month to 11,062,868 individuals – the second-highest monthly total of the year. That total is certain to increase well past April’s total, as the largest data breach of the month is still under investigation and the number of affected individuals has yet to be confirmed.

Individuals affected by October 2025 healthcare data breaches

The Largest Healthcare Data Breaches Reported in October 2025

In October, 7 healthcare data breaches were reported that affected more than 10,000 individuals, all of which were network server hacking incidents. The largest data breach of the month occurred at the business associate Conduent Business Services, a provider of back-office services to healthcare providers, health plans, and government agencies. Conduent’s client list includes major U.S. health insurers such as Humana and Premera Blue Cross.

Conduent experienced a hacking incident in May 2025, and while not stated as a ransomware attack, the SafePay ransomware group claimed responsibility. On its data leak site, SafePay claimed to have stolen 8.5 terabytes of data. Conduent notified the HHS’ Office for Civil Rights that 42,616 individuals had been affected; however, a few months later, the Oregon Attorney General was informed that more than 10.5 million individuals were affected nationwide.

Since the data for this report were compiled, there has been a further breach report from Conduent. The Texas Attorney General has been informed that the Conduent data breach affected almost 14.8 million individuals in Texas alone.

Name of Covered Entity State Covered Entity Type Individuals Affected Cause of Breach
Conduent Business Services LLC NJ Business Associate 10,515,849* Ransomware attack (Safepay)
Tri Century Eye Care PC PA Healthcare Provider 200,000 Hacking incident – Data theft confirmed
Central Jersey Medical Center NJ Healthcare Provider 88,000 Ransomware attack (Sinobi ransomware group)
Sierra Vista Hospital & Clinics NM Healthcare Provider 75,054 Hacking incident
Bosch Choice Welfare Benefit Plan MI Health Plan 55,000 Hacking incident
Heartland Health Center NE Healthcare Provider 43,728 Hacking incident
Revere Health, PC UT Healthcare Provider 10,800 Hacking incident of a third-party payment system

The HIPAA Breach Notification Rule requires data breaches to be reported to OCR within 60 days of the discovery of a data breach. If the total number of affected individuals is not known, an estimate should be provided. HIPAA-regulated entities often submit a breach report using a placeholder figure of 500 or 501 affected individuals when the data review is ongoing. In October, two data breaches were reported with suspected 501 placeholder totals.

Name of Covered Entity State Covered Entity Type Individuals Affected Cause of Breach
Saint Mary’s Home of Erie PA Healthcare Provider 501 Hacking incident
North Atlantic States Carpenters Health Benefits Fund MA Health Plan 501 Hacking incident

Causes of December 2024 Healthcare Data Breaches

As is usually the case, hacking and other IT incidents dominated the breach reports in October, accounting for 21 (75%) of the month’s data breaches and 99.8% of the affected individuals. Across the 21 data breaches, 11,037,882 individuals had their protected health information exposed or stolen. The average breach size was 525,613 individuals, and the median breach size was 6,633 individuals.

Causes of October 2025 healthcare data breaches

The next most common category of data breaches was unauthorized access/disclosure incidents. There were 7 of these incidents in October, affecting 24,986 individuals. The average breach size was 3,569 individuals, and the median breach size was 3,177 individuals.

While loss and theft incidents were among the most common types of data breaches when OCR first started publishing healthcare data breach data in 2009, along with improper disposal incidents, they are relatively rare. No loss, theft, or improper disposal incidents were reported in October. The most common location of breached protected health information in October was network servers, with email the second most common location of breached PHI.

Location of breached PHI - october 2025

Where did the Data Breaches Occur?

Healthcare providers reported 20 data breaches in October (472,481 affected individuals), 4 data breaches were reported by health plans (60,358 affected individuals), and four data breaches were reported by business associates of HIPAA-covered entities (10,530,029 affected individuals)

When a data breach occurs at a HIPAA business associate, the business associate must report the data breach to each affected covered entity, and the covered entity must decide who should send out individual notifications and notify OCR and the media. Some covered entities choose to report business associate breaches to OCR and issue their own notifications, while others delegate that responsibility to the business associate. If a business associate works with multiple covered entities, some of their covered entity clients may report the breach, while others delegate the responsibility to the business associate.

The consequence of that is that business associate data breaches are often underrepresented in many healthcare data breach reports. The HIPAA Journal calculates where the breach occurred rather than the entity that reported the breach to ensure business associate data breaches are reported accurately. As you can see from the pie chart below, while 4 data breaches were reported by business associates, 9 of the month’s data breaches occurred at business associates.

data breaches at HIPAA-regulated entities - october 2025

October 2025 healthcare data breaches - individuals affected by hipaa-regulated entity

Geographic Distribution of Healthcare Data Breaches

HIPAA-regulated entities in 18 U.S. states reported data breaches in October. Florida and Texas were the worst-affected states in October, with three large healthcare data breaches reported by entities headquartered in each of those states.

States Breaches
Florida & Texas 3
Alaska, Arizona, California, Illinois, New Jersey & Pennsylvania 2
Kentucky, Massachusetts, Michigan, Missouri, Montana, Nebraska, New Mexico, Ohio, Oklahoma & Utah 1

While Florida and Texas had the highest number of data breaches, each affected a relatively low number of individuals. Unsurprisingly, given the scale of the data breach at Conduent Business Services, New Jersey was the worst-affected state, although that total includes individuals across the United States.

State Individuals Affected
New Jersey 10,603,849
Pennsylvania 200,501
New Mexico 75,054
Michigan 55,000
Nebraska 43,728
Texas 14,233
Utah 10,800
California 9,700
Kentucky 9,536
Illinois 9,405
Florida 8,503
Oklahoma 6,633
Montana 5,617
Arizona 4,177
Alaska 2,641
Missouri 1,680
Ohio 1,310
Massachusetts 501

HIPAA Enforcement Activity in October 2025

The government shutdown for the entire month of October meant all but the most critical workflows ground to a halt at the Department of Health and Human Services. As such, there were no announcements about HIPAA settlements and civil monetary penalties, and no penalties were announced by state attorneys general in October.

The post October 2025 Healthcare Data Breach Report appeared first on The HIPAA Journal.

High Severity Vulnerabilities Patched in Mirion Medical EC2 Software NMIS BioDose

Posted by Steve Alder

Mirion Medical has issued patches to fix five high-severity vulnerabilities in its EC2 Software NMIS BioDose software. Successful exploitation of the vulnerabilities could allow an attacker to gain unauthorized access to the application, modify program executables, access sensitive information, and potentially remotely execute code.

Mirion Medical EC2 Software NMIS BioDose is tracking software used by healthcare providers to keep track of inventory, doses, patient information, and billing. The vulnerabilities affect software versions prior to v23.0. Users have been urged to update to v23.0 or later versions to prevent the vulnerabilities from being exploited. Users with an active support contract can update to the latest version via the software. At the time of issuing the updated version, there had been no known exploitation of the vulnerabilities in the wild.

CVE-2025-64298 – CVSS v3.1: 8.4 | CVSS v4: 8.6

NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQL Server Express is used are exposed in the Windows share accessed by clients in networked installs. The directory has insecure directory paths by default, allowing access to the SQL Server database and configurations, which may contain sensitive data.

CVE-2025-61940 – CVSS v3.1: 8.3 | CVSS v4: 8.7

NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database, and while users must supply a password in the client software, the underlying database connection always has access. An option has been added to use Windows user authentication with the database to restrict the database connection.

CVE-2025-62575 – CVSS v3.1: 8.3 | CVSS v4: 8.7

NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account – nmdbuser – and other created accounts have the sysadmin role, which could lead to remote code execution through the use of certain built-in stored procedures.

CVE-2025-64642 – CVSS v3.1: 8.0 | CVSS v4: 7.1

In NMIS/BioDose V22.02 and previous versions, installation directory paths have insecure file permissions by default. In certain deployments, this can allow users to modify program executables and libraries.

CVE-2025-64778 – CVSS v3.1: 7.3 | CVSS v4: 8.4

NMIS/BioDose software V22.02 and previous versions have executable binaries with plaintext hard-coded passwords, which could be exploited to gain unauthorized access to the application and database.

The post High Severity Vulnerabilities Patched in Mirion Medical EC2 Software NMIS BioDose appeared first on The HIPAA Journal.

Europol Takes Down Illegal Crypto Mixing Laundering Service Used by Ransomware Actors

Posted by Steve Alder

A cryptocurrency mixing service used by criminals to launder the proceeds from their illegal activities has been shut down by Europol, Eurojust, and law enforcement agencies in Switzerland and Germany.

Cybercriminals, such as ransomware actors, typically receive payment for their attacks in cryptocurrency. Cryptocurrency transactions are not anonymous, as all transactions are recorded on the public blockchain and can be traced to the wallets receiving the funds. That means the proceeds from cybercrime can be traced to individuals if the wallet address is linked to a real-world identity. Cybercriminals use cryptocurrency mixing services to launder the proceeds from their attacks, then redirect their anonymized funds to cryptocurrency exchanges to cash out.

The law enforcement operation was a week-long effort – Operation Olympia – between November 24 and November 26, targeting Cryptomixer, an illegal cryptocurrency mixing service that law enforcement agencies have been trying to shut down since its creation in 2016. According to Europol, Cryptomixer was the mixing service of choice for cybercriminals, and was used by ransomware gangs, payment card fraudsters, drug and weapons traffickers, and nation state hackers such as North Korea’s Lazarus Group to launder funds from their illegal activities. Since 2016, more than €1.3 billion in Bitcoin ($1.5 billion) has passed through Cryptomixer infrastructure.

Funds were deposited in the mixing service, pooled for a long and randomized period, then redistributed to destination addresses at random times. Mixing services such as Cryptomixer make pseudonymous cryptocurrency transactions anonymous, concealing the origin of cryptocurrency by making it difficult to trace specific coins, allowing cybercriminals to launder funds from their activities without the risk of being identified. More than €25 million ($28 million) in Bitcoin was confiscated, three servers in Switzerland and the cryptomixer.io clear web domain were seized, along with more than 12 terabytes of data.

The operation was part of a broader international effort by law enforcement agencies to tackle cybercrime by targeting the services that cybercriminals use to hide their financial transactions. Operation Olympia mirrors a similar effort in 2023 by Europol and law enforcement agencies in the United States and Germany that resulted in the seizure of the infrastructure behind the ChipMixer mixing service, which at the time was the go-to mixing service for cybercriminals, through which more than $3 billion in cryptocurrency had passed. In that operation, as well as seizing the infrastructure, more than $50 billion in Bitcoin was confiscated.

The post Europol Takes Down Illegal Crypto Mixing Laundering Service Used by Ransomware Actors appeared first on The HIPAA Journal.

Editorial: Cryptocurrencies’ Central Role in Healthcare Ransomware Attacks

Posted by Steve Alder

One of the benefits of cryptocurrencies is greater financial accessibility for unbanked populations, which includes individuals in remote areas who do not have access to banking infrastructure, but also cybercriminals, who cannot directly put the proceeds from their illegal activities directly through banks, at least not without raising red flags about the source of those funds.

Cryptocurrencies have been a godsend for cybercriminals and have played a central role in the massive rise in cybercriminal activity over the past decade, fueling the current ransomware epidemic. The first cryptocurrency, Bitcoin, was invented in 2008 and launched in 2009, and rapidly became a major currency in black market activities, including the first modern dark net market, the Silk Road, which exclusively adopted Bitcoin as payment in 2011.

A brief history of ransomware

While the earliest form of ransomware, widely thought to be the AIDS Trojan, was first distributed in 1989, the modern ransomware phenomenon started with CryptoLocker, a particularly successful ransomware variant that first appeared in 2013. Cryptolocker used strong, industry-standard encryption, requiring a decryption key to recover data. The Cryptolocker campaign was relatively short-lived, running from September 2013 until May 2014, when the command-and-control infrastructure was seized by law enforcement. During that short period of activity, the ransomware generated millions of dollars in ransom payments.

Businesses could recover from Cryptolocker ransomware attacks without paying the ransom, provided they had an effective backup strategy and had a valid backup of their data stored securely offline; however, tactics changed in late 2019, when the Maze ransomware group combined data theft with encryption. Data could still be recovered from backups, but if the ransom was not paid, the stolen data would be leaked online or sold. This double extortion tactic proved highly effective and has since been adopted by most major ransomware players.

The Cryptolocker campaign in 2013/2014 saw ransom demands issued of 10 Bitcoin, which at the time was worth around $2,000. Today, according to Sophos, the average ransom demand is around $1 million. According to Chainalysis, at least $813.55 million was paid to ransomware groups in 2024, and Verizon reports that 44% of cyberattacks involved ransomware in 2024, compared to 10% of attacks in 2021.

The ransomware remediation firm Coveware reports that in Q1, 2018, 85% of victims of ransomware attacks paid the ransom to recover their files and prevent the release of stolen data. The percentage of victims paying the ransom has been steadily falling, dropping to 23% in Q3, 2025. Despite this drop off, ransomware remains a major threat, with attacks increasing in 2025.

A cybercrime epidemic fueled by cryptocurrencies

The ransomware epidemic would not have been possible without cryptocurrencies. Prior to Bitcoin, extortion of companies through hacking, ransomware, and data theft was relatively unheard of; however, cryptocurrencies have allowed cybercriminals to easily profit from their activities with relatively little risk.

Security and transparency are often touted as key benefits of cryptocurrencies. All cryptocurrency transactions are recorded on a public, distributed ledger (blockchain), secured with advanced cryptography. While each transaction is recorded and publicly available, cryptocurrencies provide a high degree of anonymity for cybercriminals.

Cryptocurrencies do not provide full anonymity, as most public blockchains use public keys or wallet addresses as identification; however, it is difficult to link a wallet address to a real-world identity. Further, cybercriminals use mixing services that make it difficult to track the origins of funds, as well as privacy coins that encrypt transactions and make tracing funds more problematic.

In addition to giving cybercriminals an easy way to profit from their attacks, cryptocurrencies have helped cybercriminal groups sell their products and services. Cybercriminals develop malware and ransomware and offer it as a paid service along with the infrastructure that supports it, all paid for in relatively anonymous cryptocurrency.  Ransomware-as-a-service groups provide the encryptor and tools to allow their affiliates to conduct attacks for a percentage of the profits, naturally paid in cryptocurrency.

While cryptocurrency has helped to create the current ransomware epidemic and benefits cybercriminals greatly, it is not cryptocurrencies that are the problem. There are important benefits to cryptocurrencies. They are free from government interference and are managed by a distributed network of users, making them resilient to any single point of failure. There is global accessibility, and the limited supply helps to protect against inflation, compared to traditional currencies. These and other benefits mean cryptocurrencies are here to stay and will likely become ubiquitous.

Governments and law enforcement are grappling with how to disrupt cybercriminals’ business model to make attacks less profitable, and organizations must ensure that they have the defenses in place to prevent, detect, and quickly recover from attacks. That means better cybersecurity infrastructure and training for staff, and well-tested incident response plans to ensure recovery in the fastest possible time frame.

Improving defenses against ransomware attacks

The increase in both the volume and sophistication of ransomware attacks is forcing companies to invest more in cybersecurity. According to Gartner, spending on cybersecurity is expected to rise to $207 billion in 2025, up from $165 billion last year, to deal with the increased threat.

In many industries, especially healthcare, there has been a massive expansion of the attack surface, with increasing numbers of portable electronic devices connecting to networks, and rapidly growing numbers of IoT and IoMT devices, often coupled with incomplete and out-of-date inventories. Devices are connected to networks that are not supplied with a software bill of materials (SBOM) that lists all third-party components, and increasing numbers of vulnerabilities are being discovered, growing the patching burden considerably.

Cybercriminals have embraced artificial intelligence tools and are using AI to accelerate malware development and improve the effectiveness of their social engineering and phishing campaigns. With cybercriminals’ use of AI tools outpacing defensive use at many healthcare organizations, this is an area where investment needs to increase.

According to the IBM Cost of a Data Breach report, organizations with many defense tools that have AI capabilities are able to identify a breach 30% faster than organizations that do not, potentially allowing ransomware attacks to be thwarted before data theft and encryption, or at least in time to limit the impact of an attack.

Prompt patching is important to decrease the window of opportunity for exploitation; however, organizations must maintain an accurate and up-to-date asset inventory; otherwise, devices are likely to be missed from patching schedules. Regular risk analyses must be conducted to identify risks and vulnerabilities to ePHI, and these also need to be based on an accurate and up-to-date asset inventory.

For small and medium-sized healthcare organizations with limited budgets for cybersecurity, every dollar needs to be spent wisely. To get the best returns for each dollar spent, the HHS cybersecurity performance goals (HPH CPGs) are a good place to start. The CPGs include high-impact measures proven to be effective at decreasing risk, strengthening cybersecurity against the most common access vectors.

It is also important not to neglect cybersecurity awareness training. Many attacks target employees, the weakest link in the cybersecurity chain. While turning every employee into a cybersecurity titan may be a lofty goal, employees should be made aware of the threats that they are likely to encounter and be taught cybersecurity best practices to minimize risk.

Even with the most robust cybersecurity defenses, it is impossible to completely eradicate risk. A mistake by an employee, a missed patch, or a zero-day vulnerability could easily lead to a successful attack. It is vital to prepare for such an attack and have an incident response plan to ensure business continuity and a fast recovery. Plans for different types of attacks should be developed and tested with tabletop exercises to ensure that everyone is aware of their responsibilities and the plans are effective.

Steve Alder, Editor-in-Chief, The HIPAA Journal

The post Editorial: Cryptocurrencies’ Central Role in Healthcare Ransomware Attacks appeared first on The HIPAA Journal.