Medical Group Pays $240K Fine for 3 Ransomware Attacks

Marianne Kolbasuk McGee • October 4, 2024

Federal regulators have hit a California physician services organization with a $240,000 HIPAA civil penalty following an investigation into three ransomware attacks that occurred within a three-week span in early 2018, compromising the sensitive information of 85,000 patients.

Breach Notification

Sophos: Attacks Drop in Nearly All Sectors But Healthcare

Latest

Governance & Risk Management

Illumio, ColorTokens, Cisco Lead Microsegmentation Rankings

Michael Novinson • October 4, 2024

Illumio and Akamai remained atop Forrester's microsegmentation rankings, while ColorTokens and Cisco climbed into the leader space.The microsegmentation market has expanded beyond traditional on-premises networks to address modern public cloud workloads.

General Data Protection Regulation (GDPR)

Meta Hit Again With Targeted Advertising Limits In Europe

David Perera • October 4, 2024

Targeted advertising may face additional restrictions following a ruling by the top European Union court that social media giant Meta cannot indefinitely retain user data. Nor can it use data for advertising "without distinction as to type of data," the European Court of Justice said Friday.

Big Data Security Analytics

Ex-CEO Adam Geller Returns to Product Leadership at Zscaler

Michael Novinson • October 4, 2024

Adam Geller discusses his shift from Exabeam CEO back to product leadership at Zscaler, where he plans to use the company's vast data insights and security operations to drive growth. Geller emphasizes the importance of CXO-level visibility and robust customer adoption strategies.

Governance & Risk Management

Ivanti Confirms Exploitation of an Old Critical Vuln

Prajeet Nair • October 4, 2024

Ivanti confirmed that hackers are exploiting an SQL injection vulnerability in its Ivanti Endpoint Manager enabling remote code execution, despite the company addressing the issue with a patch in May. The flaw allows unauthenticated attackers within the same network to execute arbitrary code.

Fraud Management & Cybercrime

ISMG Editors: Russian Cybercrime Syndicates Under Siege

Anna Delaney • October 4, 2024

In the latest weekly update, ISMG editors discussed recent international law enforcement efforts against Russian cybercrime organizations, the latest U.S. cybersecurity bill aimed at protecting the healthcare sector and key takeaways from ISMG's Canada Summit.

API Security

Security Needs to Be Simple and Secure By Default: Google

Brian Pereira • October 4, 2024

Google asserts that platformization and consolidation can help contain today's sophisticated threats. Embedding generative AI into security is also required as the industry moves from assisted AI to semi-autonomous and, eventually, to autonomous security, with the goal of security by default.

Cybercrime

Breach Roundup: AI 'Nudify' Sites Serve Malware

Anviksha More • October 3, 2024

This week, AI nudify sites spread malware, BEC scammers head to prison, London man charged with hacking, and a Spanish insurance company with a breach. Also, a North Korean hacking group and a West African crackdown on online scammers. And, a Schrödinger Windows vulnerability: Is it real?

Artificial Intelligence & Machine Learning

ENISA 2024: Ransomware and AI Are Posing New Cyberthreats

Anna Delaney • October 3, 2024

While the number of ransomware attacks stayed about the same in the past year, cybercriminals are using more effective tactics such as weaponizing breach disclosure deadlines to extract higher ransoms, according to ENISA's 2024 Threat Landscape report.

Cyberwarfare / Nation-State Attacks

US, Microsoft Seize Domains Used in Russian Spear-Phishing

David Perera • October 3, 2024

The U.S. Department of Justice and Microsoft seized more than 100 websites allegedly used by a Russian intelligence cyberespionage operation with a fondness for spear phishing. Targets include the national security apparatus and journalists, think tanks, and non-governmental organizations.

Encryption & Key Management

Quantum Breakthroughs Drive New Encryption Strategies

Suparna Goswami • October 3, 2024

Quantum computing has been evolving for decades and holds immense promise. Companies have invested billions of dollars in this technology, which will eventually solve complex business problems. But for now the use cases are limited, said Kawin Boonyapredee, chief strategy officer at Applied Quantum.

Governance & Risk Management

CISA Preparing to Assess Federal Zero Trust Progress

Chris Riotta • October 3, 2024

A top official from the U.S. Cybersecurity and Infrastructure Security Agency said Thursday the agency is planning to review updated federal implementation plans and ensure agencies are aligning with zero trust security objectives and addressing any funding gaps or technical challenges.

Geo Focus: The United Kingdom

UK ICO Fines Police Service of Northern Ireland 750,000 Pounds

Akshaya Asokan • October 2, 2024

The U.K. data regulator fined the Northern Ireland's Police Service 750,000 pounds following a 2023 data breach that exposed personal details of the entire workforce. The U.K. Information Commissioner's Office determined the breach occurred when police attempted to respond to two open records requests.