What the FTC Is Signaling in Recent Data Privacy Cases

Marianne Kolbasuk McGee • March 17, 2023

The Federal Trade Commission's recent actions against two companies in separate health data privacy cases are significant developments signaling the FTC's "aggressive push" to enforce violations involving disclosures of consumer health data to third parties, said attorney Kirk Nahra of WilmerHale.

Governance & Risk Management

HHS OCR Asks Congress for Big Funding Boost

Latest

Cyberwarfare / Nation-State Attacks

It's Raining Zero Days In Cyberspace

Mihir Bagwe • March 20, 2023

Last year was another bonanza in zero days for Chinese state hackers, say security researchers in a report predicting a permanent uptick in nation-state exploitation of yet-unpatched vulnerabilities. "Attackers seek stealth and ease of exploitation," writes cybersecurity firm Mandiant.

Breach Notification

FBI Says It Arrested BreachForums Mastermind 'Pompompurin'

Prajeet Nair • March 18, 2023

Federal agents arrested the alleged administrator of criminal underground forum BreachedForums, tracing him to a small town in New York's Hudson Valley. FBI agents say Conor Brian Fitzpatrick, resident of Peekskill, confessed to being "pompompurin."

Governance & Risk Management

European Digital Identity Bill Heads to Final Negotiations

Akshaya Asokan • March 17, 2023

The European Parliament approved Thursday legislation creating a continentwide framework for digital identity that European leaders hope will diminish the role of big tech companies such as Google and Apple. Members of the European Parliament have pushed for additional privacy measures.

Attack Surface Management

Chinese Hackers Targeting Security and Network Appliances

Prajeet Nair • March 17, 2023

Chinese threat actors are turning security appliances into penetration pathways, forcing firewall maker Fortinet to again attempt to fend off hackers with a patch. Mandiant researchers say suspected Beijing hackers it tracks as UNC3886 has been targeting chip-based firewall and virtualization boxes.

Finance & Banking

ISMG Editors: Will SVB Crash Kill Cybersecurity Innovation?

Anna Delaney • March 17, 2023

In the latest weekly update, ISMG editors discuss how the Silicon Valley Bank crash will affect innovation in the cybersecurity space, why the SEC fined cloud provider Blackbaud $3 million for its "erroneous" breach details, and why the feds fined a web hosting firm in a kids' insurance site hack.

Finance & Banking

SVB Parent Company Seeks Bankruptcy Amid Asset Sale Process

Michael Novinson • March 17, 2023

The former parent company of Silicon Valley Bank filed for Chapter 11 bankruptcy protection Friday in an effort to streamline the sale of its assets. Silicon Valley Bank itself isn't included in the reorganization filing since the FDIC took over the commercial banking business on March 10.

Fraud Management & Cybercrime

Magniber Ransomware Group Exploiting Microsoft Zero-Day

Akshaya Asokan • March 16, 2023

A financially motivated hacking group has been exploiting a now-patched zero-day vulnerability in the Windows operating system to deliver ransomware. Google Threat Analysis Group attributed the campaign to Magniber ransomware group. Microsoft issued a patch in its March dump of fixes.

Fraud Management & Cybercrime

Breach Roundup: Med Devices, Hospitals and a Death Registry

Mihir Bagwe • March 16, 2023

In this week's data breach roundup: medical device manufacturer Zoll, CHU University hospitals, Australian company Latitude Financial, Hawaiian death registry, Los Angeles Housing Authority, Indian Railway ticketing app, updates on U.S. Marshals Service and Congress, and a new ransomware decryptor!

Endpoint Security

Microsoft, CrowdStrike Lead Endpoint Protection Gartner MQ

Michael Novinson • March 16, 2023

Microsoft and CrowdStrike once again dominate Gartner's Magic Quadrant for Endpoint Protection. Cybereason has risen to the leaders quadrant and Trellix has fallen to a niche player. The endpoint protection market has rapidly matured in recent years - 50% of organizations have already adopted EDR.

General Data Protection Regulation (GDPR)

What Does the UK Version of GDPR Mean for Businesses?

Anna Delaney • March 16, 2023

The U.K. government recently embarked on a plan to create its own version of the EU's General Data Protection Regulation, but attorney Jonathan Armstrong says he is "pretty skeptical" that this second attempt at privacy reform will successfully make it through the country's Parliament.

Cyberwarfare / Nation-State Attacks

Microsoft Fixes Russia-Exploited Zero-Day

Prajeet Nair • March 15, 2023

Microsoft's March dump of patches fixes two actively exploited zero-day vulnerabilities, including a critical issue in Outlook that Russian threat actor APT28 has used to target European companies. The vulnerability can be exploited before a user views the email in the Preview Pane.

Fraud Management & Cybercrime

Rapid7 Buys Ransomware Prevention Firm Minerva Labs for $38M

Michael Novinson • March 15, 2023

Rapid7 has purchased a ransomware prevention vendor founded by a former Israel Defense Forces captain to strengthen its managed detection and response muscle. The Minerva Labs purchase will allow Rapid7 to deliver advanced ransomware prevention across cloud resources and traditional infrastructure.