Cyberattacks Reported by UT Health Science Center; SysInformation Healthcare Services; Jackson Medical Center

Posted by Steve Alder

Cyberattacks have been reported by the University of Tennessee Health Science Center, SysInformation Healthcare Services (EqualizeRCM/1st Credentialing), and Jackson Medical Center. Moveable Feast has discovered the improper disposal of documents containing PHI.

University of Tennessee Health Science Center – Ransomware Attack

The University of Tennessee Health Science Center (UT-HSC) said a cyberattack on one of its vendors has resulted in the exposure and possible theft of the protected health information of 19,353 patients who received obstetrics and gynecology (OB/GYN) services at Regional One Health (ROH).

UT-HSC contracted with a company called KMJ Health Solutions which provided patient handoff software that is used to support OB/GYN patients and ensure they receive the appropriate care when they are transferred to another healthcare provider. UT-HSC was notified by KMJ on or around November 29, 2023, about a security incident discovered while investigating a server outage. KMJ erased and reformatted the server and hired a cybersecurity firm to investigate the incident but was unable to make a definitive determination about whether there had been unauthorized access. On January 18, 2024, KMJ’s hosting provider, Liquid Web, found evidence of a ransomware attack but could not determine whether the attackers downloaded a copy of the data stored in the eDocList.

The potentially affected individuals had received OB/GYN services at ROH between November 2014 and November 2023. The information potentially compromised included first and last name, medical record number, age, date of admission, allergies, service, resident assigned, parity, diagnoses, prenatal provider, laboratory results, medications, fetal or delivery details, contraception, type of infant feeding, and information regarding follow up care.

KMJ has implemented new technical safeguards including vulnerability scans, penetration testing, and configuration reviews. Due to the nature of the exposed data, UT-HSC does not believe there is any significant risk of identity theft or harm to credit; however, the affected individuals have been advised to be on the lookout for any letters, emails, or phone calls, and other communications from unknown individuals wanting to discuss any of the services received from ROH.

SysInformation Healthcare Services (EqualizeRCM/1st Credentialing) – Cyberattack

SysInformation Healthcare Services (SysInformation), an Austin, TX-based provider of revenue cycle support to medical billing companies and hospitals that does business as EqualizeRCM and 1st Credentialing, has experienced a cyberattack that caused a network outage. SysInformation said suspicious activity was detected within its network in June 2023. IT systems were secured, and third-party forensics experts were engaged to investigate the incident. The investigation revealed unauthorized access to its network between June 3, 2023, and June 18, 2023, and certain files had been exfiltrated.

SysInformation said an extensive review was conducted to determine the types of information involved and the individuals affected and notification letters were mailed to the affected individuals on April 17, 2024. The types of data involved varied from individual to individual and may have included one or more of the following: name, government identification number, date of birth, Driver’s license number, employer identification number, electronic signature, financial account information, health insurance information, medical history/treatment information, login information, mother’s maiden name, government-issued identification number, passport information, Social Security number, and/or tax identification number.

Complimentary credit monitoring services have been offered to the affected individuals, security policies and procedures have been reviewed, and additional safeguards have been implemented to prevent similar incidents in the future. The breach has been reported to regulators; however, it is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

Jackson Medical Center – Cyberattack

Jackson Medical Center in Alabama has notified 509 patients about the exposure of some of their protected health information in a cyberattack that disrupted some of its IT systems. The attack was detected on February 22, 2024, and third-party forensics experts were engaged to investigate the incident and confirmed that an unauthorized third party had access to its network between February 17, 2024, and February 22, 2024. During that time, files were accessed or removed from its network.

A review of the affected files confirmed on March 8, 2024, that they contained patients’ protected health information including names and one or more of the following: contact information, dates of birth, driver’s license or state identification numbers, diagnoses, treatment information, and/or health insurance information. Notification letters have been mailed to the affected individuals and complimentary identity monitoring services have been offered to patients whose Social Security numbers, driver’s license numbers, or state identification numbers were potentially involved. Jackson Medical Center said additional safeguards and technical security measures have been implemented to further protect and monitor its systems.

Moveable Feast – Improper Disposal of Documents

Moveable Feast, a Baltimore, MD-based non-profit that provides care to individuals living with HIV/AIDS and other life-threatening illnesses, has discovered that documents containing sensitive data were disposed of incorrectly. Moveable Feast’s policies require sensitive documents to be placed in shredding bins, but some were inadvertently disposed of in regular recycling bins. The HIPAA violation was discovered when a recycling bin awaiting curb pickup was blown over, scattering its contents.

Staff collected most of the documents, but some pages could not be retrieved. The missing pages contained the information of 568 individuals such as their client number, name, gender, race, and age, and for a subset of Moveable Feast clients, the last 4 digits of their Social Security numbers. Notification letters have been sent to all affected individuals and 12 months of credit monitoring services have been made available at no cost. Staff members have also been retrained on handling sensitive information.

The post Cyberattacks Reported by UT Health Science Center; SysInformation Healthcare Services; Jackson Medical Center appeared first on HIPAA Journal.

CISA & Partners Share New Threat Intelligence on Akira Ransomware

Posted by Steve Alder

The Cybersecurity & Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Europol’s European Cybercrime Centre (EC3), and the Netherlands’ National Cyber Security Centre (NCSC-NL) have issued a joint cybersecurity advisory about the Akira ransomware operation, which has conducted more than 250 attacks and has been paid around $42 million in ransom payments. The group’s operators are highly skilled and are associated with the infamous Conti ransomware operation.

Akira is a relatively new ransomware group that emerged in April 2023 that mostly targets small- to medium-sized businesses and demands ransom payments from around $200,000 to millions of dollars. The group has attacked many verticals including finance, real estate, manufacturing, and healthcare. Attacks on healthcare targets prompted the Health Sector Cybersecurity Coordination Center to issue a Sector Alert about Akira ransomware in September 2023. The latest cybersecurity advisory from CISA and Partners shares information on the latest tactics, techniques, and procedures (TTPs) used by the group, updated indicators of compromise (IoCs), and recommended mitigations for network defenders.

Akira has been observed gaining initial access to victims’ networks through a Virtual Private Network (VPN) service without multifactor authentication, primarily through the exploitation of the Cisco vulnerabilities CVE-20203259 and CVE-2023-20269. The group also targets external facing services including Remote Desktop Protocol (RDP), abuses valid credentials, and conducts spear phishing attacks.

When a corporate network has been breached, the group moves laterally and attempts to obtain Windows domain credentials, then deploys ransomware to encrypt files. The group engages in double extortion tactics, stealing sensitive data from victims and demanding payment to prevent stolen data from being leaked and for the keys to decrypt files. Initially, the group only attacked Windows systems but has developed a Linux encryptor and now also targets VMware ESXi virtual machines. The group uses Kerberoasting techniques and Mimikatz to obtain credentials, LaZagne to help with privilege escalation, PowerTool to exploit the Zemana AntiMalware driver and terminate antivirus-related processes, and FileZilla, WinRAR, WinSCP, and RClone for data exfiltration.

The cybersecurity advisory includes several recommended mitigations to prevent and reduce the impact of Akira ransomware attacks, some of the most important of which are ensuring that patches are applied to fix known exploited vulnerabilities – especially CVE-20203259 and CVE-2023-20269, enforcing phishing-resistant multifactor authentication across the organizations in particular for VPNs, webmail, and accounts linked to critical systems, and ensuring that software is kept up to date.

The post CISA & Partners Share New Threat Intelligence on Akira Ransomware appeared first on HIPAA Journal.

Palo Alto Networks Updates Mitigations as Exploitation of 0Day Firewall Vulnerability Grows

Posted by Steve Alder

Exploitation of a recently disclosed zero-day vulnerability affecting Palo Alto Networks firewalls has grown since proof-of-concept exploits were released, and a previously recommended mitigation is ineffective at preventing exploitation of the flaw.

The vulnerability, tracked as CVE-2024-3400, is a command injection flaw in versions 10.2, 11.0, and 11.1 of the PAN-OS operating system that powers its firewalls. The vulnerability is thought to have been exploited since March 26, 2024, initially by a nation-state-affiliated group tracked as Operation MidnightEclipse; however, Palo Alto Networks has detected an additional 20 IP addresses attempting to exploit the flaw.

The vulnerability affects the GlobalProtect gateway or portal VPN feature on certain PAN-OS devices, and can be exploited by an unauthenticated attacker to execute arbitrary code with root privileges. The vulnerability has a maximum CVSS v3 severity score of 10. According to security researchers at Rapid7, the vulnerability is being exploited as part of an exploit chain, along with a second vulnerability that has yet to have a CVE assigned. The second vulnerability is a file creation vulnerability in the GlobalProtect web server.

Initially, Palo Alto Networks said PAN-OS firewalls are vulnerable to attack if GlobalProtect gateway and device telemetry are both enabled. Palo Alto Networks released an initial security advisory about the flaw on Friday, along with recommended mitigations. A secondary mitigation action suggested by Palo Alto Networks was disabling device telemetry; however, Palo Alto has now confirmed that the mitigation is no longer effective, as vulnerable firewalls do not need device telemetry to be enabled to be exposed to attacks.

According to SharowServer, around 156,000 vulnerable Palo Alto Networks devices are exposed to the Internet, although it is unclear how many of those devices have been patched. To remediate the vulnerability, customers should ensure a hotfix is applied. Rapid7 has confirmed that the hotfixes released by Palo Alto networks are effective at preventing the exploitation of CVE-2024-3400.

The hotfixes are PAN-OS 10.2.9-h1, PAN-OS 11.0.4-h1, PAN-OS 11.1.2-h3, and all later versions. On Thursday and Friday, Palo Alto Networks released hotfixes for other commonly deployed maintenance releases, as detailed in an updated HC3 Sector Alert from the Health Sector Cybersecurity Coordination Center (HC3).

The post Palo Alto Networks Updates Mitigations as Exploitation of 0Day Firewall Vulnerability Grows appeared first on HIPAA Journal.

Michigan’s Largest FQHC Suffers Ransomware Attack Affecting 184,000 Patients

Posted by Steve Alder

Cherry Street Services, Inc., which operates as Cherry Health Services, fell victim to a ransomware attack in December 2023. Cherry Health is the largest federally qualified health center in Michigan, with 20 healthcare facilities in six counties in the state, and provides healthcare services to underserved communities, regardless of insurance status or their ability to pay for healthcare.

The Grand Rapids, MI-based healthcare provider said it experienced network disruption on December 21, 2024, that prevented access to some of its computer systems. Third-party cybersecurity specialists were engaged to investigate the incident and determined that unauthorized individuals had accessed certain files on its network. The review of the affected files was completed on March 25, 2024, and confirmed that protected health information was exposed in the attack, including names, addresses, phone numbers, dates of birth, health insurance information, health insurance ID number, patient ID number, provider name, service date, diagnosis/treatment information, prescription information, financial account information and/or Social Security numbers. The types of information exposed varied from individual to individual.

While healthcare data was potentially stolen in the attack, Cherry Health said it is unaware of any instances of actual or attempted misuse of patient data; however, as a precaution, the affected individuals have been offered 12 months of complimentary credit monitoring services, which includes monitoring of the dark web for the publication or sale of sensitive personal information, a $1 million identity theft insurance policy, and identity theft identity recovery services. Cherry Street said it has already taken steps to improve its technical safeguards to prevent similar incidents in the future. The incident has recently been reported to the Maine Attorney General as affecting 184,372 individuals.

The post Michigan’s Largest FQHC Suffers Ransomware Attack Affecting 184,000 Patients appeared first on HIPAA Journal.

Ransomware Attacks Up 20% YoY with 55% Increase in Active Ransomware Groups

Posted by Steve Alder

An analysis of ransomware activity by GuidePoint Security’s Research and Intelligence Team (GRIT) shows a 55% year-over-year increase in active ransomware groups and an almost 20% increase in ransomware victims (1,024) compared to Q1, 2023.

According to Guidepoint Security’s Q1 2024 Ransomware Report, the industries most impacted by ransomware attacks were manufacturing, retail and wholesale, and healthcare. While there was a 7.4% increase in posted victims from February to March, there was a decline in attacks on healthcare organizations, which fell from 32 new additions to data leak sites in February to just 20 in March. There was a similar reduction in attacks on law firms, which decreased from 20 in February to 10 in March. In Q1, 2024, more than half of all victims (537 attacks) were based in the United States – The first time since Q2, 2023, that more than 50% of attacks were conducted in the US. The United Kingdom was the second most targeted country (60 attacks).

In Q1, 2023, GRIT identified 29 distinct, active ransomware groups whereas 45 groups were detected in Q1, 2024. The most active ransomware group in Q1, 2024 was LockBit. Even with the law enforcement disruption of the LockBit ransomware group in February 2024, LockBit retained the top spot claiming 219 victims in the quarter, although this was below the typical number of attacks the group conducts. Prior to the law enforcement operation that disrupted its operation on February 20, 2024, LockBit was averaging 3 attacks a day. From February 24 through the end of March, the group dropped to an average of 2 attacks a day. The group now appears to be back up to full speed, claiming 97 victims in March alone. The next most active group was Blackbasta which conducted 73 attacks in Q1, 2024, up 151% from the previous quarter, followed by Play with 71 attacks, down 37% from Q4, 2023. While the Qilin ransomware-as-a-service group conducted relatively few attacks (44) in 2023, it has increased activity considerably in 2024 claiming 34 victims in the quarter.

There has been significant law enforcement activity against ransomware groups in recent months. LockBit survived the attempted takedown by the Operation Cronos Task Force, which only caused a few days of severe disruption but ransomware attacks have been conducted at a lower volume in the weeks since. In late December, law enforcement disrupted the ALPHV/Blackcat ransomware group, which was the second most prolific ransomware group in 2023. The group responded by removing virtually all restrictions for affiliates and actively encouraged attacks on healthcare organizations until the attack on Change Healthcare, after which the group appeared to pocket the full ransom payment as part of an exit scam and shut down its operation.

Even with the disruption of LockBit and the ALPHV shutdown, there was still a 19.2% increase in reported victims in the quarter with a minimum of 50 victims added to data leak sites each week and a high of 125 victims posted one week in March. GRIT identified attempts by several groups to attract new affiliates in Q1, including the Medusa, Cloak, and RansomHub groups, which were advertising their RaaS operations on deep and dark web forums in January and February 2024, with RansomHub activity appearing to have increased in the weeks since. Three new ransomware groups emerged in Q1 – Killsec, Donex, and Redransomware. While these groups only conducted a small number of attacks (22) in March, activity is likely to increase. Attacks fell from 1,117 in Q4, 2023 to 1,024 in Q1, 2024, and with the shutdown of the ALPHV operation, Q2 may see attacks continue to decline; however, the affiliates who worked for ALPHV are likely to switch ransomware operations, with other groups likely to increase activity to fill the gap.

The post Ransomware Attacks Up 20% YoY with 55% Increase in Active Ransomware Groups appeared first on HIPAA Journal.