Microsoft Issues Emergency Patch for Actively Exploited Office Vulnerability

Posted by Steve Alder

Microsoft has issued an out-of-band security update to fix an actively exploited zero-day vulnerability in Microsoft Office. The vulnerability is tracked as CVE-2026-21509 and has a CVSS v3.1 base score of 7.8 out of 10. The vulnerability is due to reliance on untrusted inputs in a security decision in Microsoft Office, which could allow an unauthorized actor to bypass a security feature locally.

In order to exploit the vulnerability, user interaction is required. An attacker would need to send a specially crafted Microsoft Office file and convince the user to open it, such as via email, using social engineering techniques to trick the user into opening the file. The security bypass vulnerability affects multiple Microsoft Office versions, including Office 2021 and later, and Microsoft 365 Apps for Enterprise. Some of the affected Office versions are automatically protected via a server-side change, although in order to be protected, Office applications will need to be restarted.

Affected office versions that require an update to be applied are listed below, along with the update version that must be installed.

Affected Microsoft Office Version Update Version
Microsoft Office 2019 (32-bit edition) 16.0.10417.20095
Microsoft Office 2019 (64-bit edition) 16.0.10417.20095
Microsoft Office 2016 (32-bit edition) 16.0.5539.1001
Microsoft Office 2016 (64-bit edition) 16.0.5539.1001

If the update cannot be installed immediately, Microsoft has recommended mitigations to reduce the risk of exploitation. Those mitigations are:

  • Close all Office applications
  • Create a backup of the Windows Registry – Creating a backup of the Registry is important, as incorrect Windows Registry changes can cause serious problems.
  • Open the Registry Editor (Start Menu > type regedit > press enter)
  • Locate the appropriate registry key, and add a subkey per Microsoft’s Security Advisory
    • A better explanation of the steps that should be taken has been published by Bleeping Computer
  • Exit Registry Editor and start the Office application

Microsoft has not shared information about the extent to which the vulnerability is being exploited in the wild; however, since an out-of-band update has been published to fix the vulnerability, it should be assumed that the risk of exploitation is high, and the patch or mitigations should be applied as soon as possible.

The post Microsoft Issues Emergency Patch for Actively Exploited Office Vulnerability appeared first on The HIPAA Journal.

MACT Health Board Patients Affected by November 2025 Ransomware Attack

Posted by Steve Alder

MACT Health Board has confirmed that patient data was stolen in a November 2025 cyberattack, for which the INC Ransom ransomware group claimed credit. Data breaches have also been announced by TriCity Family Services in Illinois, HAP (Health Alliance Plan) in Michigan, and Zenflow in California.

MACT Health Board, California

MACT Health Board, a provider of healthcare services to the American Indian and Alaskan Native population in Mariposa, Amador, Alpine, Calaveras & Tuolumne counties in California, has notified individuals affected by a November 2025 security incident. MACT Health board launched an investigation into a potential security breach when it experienced disruption to its IT systems. The investigation confirmed that an unauthorized third party had access to its computer network from November 12, 2025, to November 20, 2025. A review of the exposed files commenced on November 25, 2025, and was completed on January 9, 2026.

Patient information compromised in the incident included names in combination with one or more of the following: diagnoses, test results, medical images, treatment information, doctors’ names, and or Social Security numbers. Notification letters started to be mailed to the affected individuals on January 23, 2026, and individuals whose Social Security numbers were involved have been offered complimentary credit monitoring and identity theft protection services. Additional safeguards and technical security measures have been implemented to prevent similar incidents in the future.  The data breach is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

TriCity Family Services, Illinois

TriCity Family Services, a provider of counseling and mental health services to residents in Kane County, Illinois, has started notifying 2,511 patients about a data security incident.  In the spring of 2025, suspicious activity was identified within its computer network. An investigation was launched, and it was confirmed that an unauthorized actor had access to its computer network from November 11, 2024, to May 14, 2025. During that time, sensitive data was exfiltrated from its network.

The file review confirmed that the following information was included in the exfiltrated files: names, dates of birth, presenting health issues, requested treatment, treatment location, and provider names. Its electronic medical record system was not accessed in the attack. TriCity Family Services said it is reviewing its policies, procedures, and processes related to the storage and access of sensitive information and will take steps to improve security to prevent similar incidents in the future.

While the nature of the incident was not disclosed, the INC Ransom ransomware group claimed responsibility for the attack and added TriCity Family Services to its dark web data leak site. INC Ransom claimed to have exfiltrated 22 GB of data in the attack.

HAP (Health Alliance Plan), Michigan

HAP (Health Alliance Plan) in Michigan has notified 1,059 individuals about the exposure of some of their protected health information as a result of a phishing attack. On October 24, 2025, an employee responded to a phishing email and inadvertently disclosed their credentials, allowing the threat actor to access their account. The investigation was unable to determine if any member information was accessed or acquired in the incident, so notification letters were sent to all potentially affected individuals. Protected health information in the account was limited to names, addresses, dates of birth, and HAP ID numbers, and for a limited number of individuals, Social Security numbers. The affected individuals have been offered two years of complimentary identity theft protection services as a precaution.

Zenflow, California

Zenflow, a San Francisco-based medical device company, has recently notified individuals about a security incident. Limited information about the incident has been released to date, such as when the incident occurred, the nature of the security breach, or for how long its computer systems were subject to unauthorized access. The data breach notice submitted to the Massachusetts Attorney General indicates that names and Social Security numbers were involved, and that single-bureau credit monitoring and identity theft protection services have been offered to the affected individuals for 24 months. It is currently unclear how many individuals have been affected.

The post MACT Health Board Patients Affected by November 2025 Ransomware Attack appeared first on The HIPAA Journal.

More than 100K Munson Healthcare Patient Affected by Cerner Cyberattack

Posted by Steve Alder

Munson Healthcare, the largest health system in Northern Michigan, has recently notified patients about unauthorized access to its electronic medical record system. The unauthorized access started as early as January 22, 2025, and was detected by its EHR vendor Cerner on February 20, 2025. Cerner, now Oracle Health, confirmed that a hacker gained access to two legacy Cerner servers and potentially stole a range of personal and health information. Munson Healthcare has confirmed that the stolen data included names, Social Security numbers, and information typically found in electronic medical records, such as medical record numbers, diagnoses, medications, test results, care and treatment information, and doctors’ names. The data on the servers was awaiting migration to the Oracle Cloud at the time of the data breach.

Munson Healthcare said Cerner took action to prevent further unauthorized access, engaged third-party cybersecurity experts to investigate the data breach, and notified law enforcement about the cyberattack. While Oracle Health publicly confirmed the cyberattack in March 2025, it has taken months for the affected healthcare providers to be notified, and many patients have only recently learned that their personal and health information was stolen in the incident. Munson Healthcare attributed the delay in issuing notifications to Cerner, which has previously stated that the delay was at the request of law enforcement so as not to interfere with the investigation.

Oracle Health has not confirmed exactly how many of its healthcare provider clients have been affected, nor the number of affected individuals. Multiple class action lawsuits have been filed in response to the data breach, and as part of the litigation, the company’s attorneys said up to 80 hospitals may have been affected. Munson Healthcare was one of the worst-affected clients, as 1,01,891 current and former patients have been affected. Munson Healthcare has confirmed that the affected individuals have been offered complimentary credit monitoring and identity theft protection services for two years.

Munson Healthcare’s Chief Legal Officer, Rachel Roe, and Michigan Attorney General Dana Nessel issued a consumer alert about the data breach last week. Attorney General Nessel is pushing for stronger consumer data protection laws to be enacted. New legislation was passed by the Senate last summer, but has yet to be passed by the House of Representatives. “These [notification] delays put consumers at higher risk of identity theft, and our state needs stronger laws to better protect Michiganders from bad actors,” said AG Nessel. “I urge anyone who receives a notice that their personal information may have been compromised to consider taking advantage of the free credit monitoring resources being offered.”

The post More than 100K Munson Healthcare Patient Affected by Cerner Cyberattack appeared first on The HIPAA Journal.