Revenue Cycle Vendor Notifying 400,000 Patients of Hack

Marianne Kolbasuk McGee • October 14, 2024

A Texas-based revenue cycle management firm is notifying about 400,000 individuals of a hacking incident it says originated with another third party. The incident is among a growing list of major breaches implicating vendors and cumulatively affecting tens of millions of patients so far this year.

Breach Notification

Medical Group Pays $240K Fine for 3 Ransomware Attacks

Latest

Application Security

Black Duck's Blueprint for Growth as an Independent Company

Michael Novinson • October 14, 2024

CEO Jason Schmitt explains the rationale behind the revival of the Black Duck brand following Francisco Partners and Clearlake's $2.1 billion acquisition and discusses the future of the company, focusing on profitable growth, application security challenges and the role of AI in code generation.

Critical Infrastructure Security

Most EU Nations to Miss Upcoming NIS2 Deadline

Akshaya Asokan • October 14, 2024

Most European countries are set to miss a trading bloc deadline for implementing a key cybersecurity regulation that requires measures such as mandatory security auditing for essential services such as hospitals and banks. Just six countries have integrated the NIS2 directive into national law.

Fraud Management & Cybercrime

Star Health Refused to Pay $68,000 Ransom to Stop Data Leak

Jayant Chakravarti • October 14, 2024

The feud between Indian insurer Star Health & Allied Insurance Co. and a hacker who claims to have the data of 31.2 million insurance customers took another turn this weekend. The insurer revealed that the hacker demanded a $68,000 ransom before posting the data on a leak website.

Cyberwarfare / Nation-State Attacks

Congress Seeks Urgent Action After Chinese Telecom Hack

Chris Riotta • October 14, 2024

Congress is demanding answers from AT&T, Verizon, and Lumen after reports revealed that Chinese hackers breached U.S. telecom infrastructure, targeting systems linked to court-authorized wiretaps, as the FBI and the Cybersecurity and Infrastructure Security Agency investigate the Salt Typhoon group.

Artificial Intelligence & Machine Learning

LLMs Fail Middle School Word Problems, Say Apple Researchers

Rashmi Ramesh • October 14, 2024

Cutting-edge large language models would fail eighth grade math, say artificial intelligence researchers at Apple - likely because AI is mimicking the process of reasoning rather than actually engaging in it. Researchers asked LLMs to solve math word problems.

Cyberwarfare / Nation-State Attacks

ISMG Editors: Chinese Hackers Raise Stakes in Cyberespionage

Anna Delaney • October 11, 2024

In the latest weekly update, ISMG editors discussed the implications of the U.S. investigation into Chinese hackers targeting telecom wiretap systems, the catastrophic risks of AI and the recent veto of an AI safety bill in the U.S., and the latest global ransomware response guidance.

Attack Surface Management

Hackers Prowling for Unencrypted BIG-IP Cookies, Warns CISA

David Perera • October 11, 2024

Unencrypted cookies tied to a suite of secure gateway technology from F5 are gateways for hackers to reach internal devices on corporate networks, warns the Cybersecurity and Infrastructure Security Agency. BIG-IP uses persistent cookies as a traffic load-balancing convenience.

Artificial Intelligence & Machine Learning

Regulating AI Catastophic Risk Isn't Easy

Rashmi Ramesh • October 11, 2024

An attempt by the California statehouse to tame the potential of artificial intelligence catastrophic risks hit a roadblock when Governor Gavin Newsom vetoed the measure late last month. One obstacle is lack of a widely-accepted definition for "catastrophic" AI risks.

Fraud Management & Cybercrime

Ransomware Task Force Details Impact of Disrupting Operators

Mathew J. Schwartz • October 11, 2024

While a Ransomware Task Force study of 2023 ransomware group disruptions finds they're often "tactical and temporary," report co-author Taylor Grossman said recent, major law enforcement actions may "really strategically pull them apart and make it harder for them to regroup."

Leadership & Executive Communication

CyberEdBoard Profiles in Leadership: Norman Kromberg

Anna Delaney • October 11, 2024

When Norman Kromberg looks back over his career as a security leader and IT audit specialist, understanding threats and vulnerabilities was just part of the reason for his success. A major factor was - and still is - understanding the business side of the organization.

Cybercrime

Hacker’s Claims About CISO Are Focus of Star Health Probe

Jayant Chakravarti • October 10, 2024

A breach at a leading Indian health insurer affecting millions of customers took an unexpected turn this week after the hacker posted samples of customer information on a leak website and accused the company's CISO of selling access to the data - and then trying to double-cross the hacker.

Fraud Management & Cybercrime

Operation Cronos Is Disrupting LockBit, Says UK Official

Akshaya Asokan • October 10, 2024

A British cybersecurity official touted Operation Cronos, an international operation against LockBit, saying multiple strikes aimed at the ransomware-as-a-service have disrupted its ability to recruit hackers. The operation has resulted in indictments, sanctions, and server takedowns.