Latest cybersecurity reporting from selected sources.

Diagnostics Lab Reported 10.3M Patients Affected by Collection Agency's HackMedical laboratory testing giant Labcorp has agreed to pay $35 million to settle class action litigation stemming from a 2018 hacking incident on now-defunct American Medical Collections Agency. Labcorp reported the vendor breach in 2019 as affecting nearly 10.3 million patients.

CareCloud: Intruder Accessed Systems for 8 Hours, Still Assessing Extent of BreachElectronic health records vendor CareCloud has notified the U.S. Securities and Exchange Commission of a cyber incident earlier this month that temporarily disrupted the software and accessed one of its EHR environments. The company is assessing whether patient data was accessed or stolen.

Police Fanned Out Early Sunday Brandishing an Advisory of a CVSS 10 VulnerabilityPolice officers across Germany roused corporate IT administrators during the early hours of Sunday morning. Their message to bleary-eyed admins was to immediately patch a critical vulnerability in popular product lifecycle management software from U.S. vendor PTC.

HIPAA Settlement Small Compared to Many OthersU.S. federal regulators fined a dental practice software vendor with a seemingly lowball financial penalty for a high-stakes 2020 hack affecting 15 million individuals that the company failed to report. Maryland-based MMG Fusion agreed to $10,000.

Binding Directive Requires Inventories and ReplacementsU.S. federal agencies have 12 months to start replacing risky network appliances running past their vendor support cutoff date under a directive published Thursday by U.S. Cybersecurity and Infrastructure Security Agency.

Conduent Gets Sued; US Government's Cyber Shutdown Woes; Hacktivist Hits RiseThe latest ISMG Editors' Panel tackles: post-hack legal fallout for Conduent after it suffered the year's biggest health data breach, the U.S. government's shutdown complicating its response to the breach of vendor F5 and the rise in attacks targeting Western critical national infrastructure.

SEC Filing Reveals Telecom Vendor Was Compromised for Nearly a YearA nation-state threat actor carried out a supply chain attack targeting Ribbon Communications, a leading U.S. provider of telecom and networking infrastructure, and may have maintained access within its systems for nearly a year. Ribbon said it became aware of the activity in early September.

Also: Clorox Sues IT Vendor Over Password BlunderThis week, XSS forum admin arrested, Clorox sued Cognizant, Lumma Stealer is back, NY regulates water, U.S. maritime cybersecurity rules in effect, new Coyote banking Trojan, a hacker nabbed details of Mexico City auxiliary police, Latin America cyberattacks, and World Leaks stole synthetic data.

Also: Clorox Sues IT Vendor Over Password BlunderThis week, XSS forum admin arrested, Clorox sued Cognizant, Lumma Stealer is back, NY regulates water, U.S. maritime cybersecurity rules in effect, new Coyote banking Trojan, a hacker nabbed details of Mexico City auxiliary police, Latin America cyberattacks, and World Leaks stole synthetic data.

How OpenAI Lost, Google Hedged and Cognition AI Bought AI Coding Start-Up WindsurfAs with any story about AI start-ups, the acquisition of Windsurf AI happened at lightning speed. In just a couple of weeks, major Silicon Valley players took a close look at the four-year-old AI-assisted coding vendor, and ultimately Google and Cognition AI ended up with parts of the company.

345 Major HIPAA Breaches Reported to Feds So Far This Year, Affecting 29.9 MillionMidway through 2025, the federal website listing major health data breaches in the U.S. shows a familiar scene: Many hacking incidents including ransomware, dozens of third-party vendor incidents, and millions of individuals affected by compromised personal data.

Analysts Warn White House IT Plan Could Conflict With Deregulation DirectivesExperts warn a new strategy that aims to centralize federal IT procurement under the General Services Administration with standardized terms and deep vendor discounts may actually undermine deregulation goals while excluding small vendors and clashing with agency-specific cybersecurity mandates.

Jury Slams NSO With $167M Verdict for WhatsApp HackMeta has secured a $167 million punitive damages verdict against Israeli spyware vendor NSO Group, with a U.S. jury finding the firm illegally used Pegasus malware to hack 1,400 WhatsApp accounts tied to diplomats, dissidents and journalists using encrypted messaging platforms.

Panelists Discuss Deepfake, Trust Frameworks, AI Skepticism, Venture Capital WoesFrom RSAC Conference 2025 in San Francisco, ISMG editors wrapped up coverage discussing the impact of U.S. government funding cutbacks, growing deepfake threats, trust challenges in AI adoption and venture capital pressures affecting the cybersecurity vendor market.

Also: Zero-Days Affect Financial Markets, SailPoint IPO Signals Market TrendsIn this week's update, ISMG editors discussed the latest "Modern Bank Heists" report and the evolving threats to financial institutions, fallout from the U.S. Department of Government Efficiency's AI-driven government shake-up, and what SailPoint's IPO signals for the cybersecurity vendor market.

IntelliVision Settles With Federal Trade Commission Over Facial Recognition ClaimsFacial recognition software maker IntelliVision has reached a settlement with the U.S. Federal Trade Commission after the regulator accused the AI-powered software vendor of deceptive marketing claims, including that its tools have "zero gender or racial bias" and market-leading levels of accuracy.

InfoSys McCamish Systems Earlier Alerted 57,000 Bank of America Clients of BreachInfosys McCamish Systems, an insurance software product and services vendor, is notifying nearly 6.1 million people of a 2023 ransomware incident that potentially comprised their sensitive data, including Social Security numbers, medical treatment, and financial and biometric information.

London Incident Is Latest Major Ongoing Outage From Recent Ransomware AttacksA cyberattack on a U.K. laboratory services provider is disrupting patient care and testing services at several London-based NHS hospitals and other care facilities. Meanwhile, in the U.S., Ascension is providing a restoration timeline for its hospital EHRs in the wake of its attack.

Technology Giants Vie for Public Sector Customers Amid Microsoft's Recent BreachesGoogle is aiming to poach Microsoft's public sector customers by attacking its competitor over recent high-profile breaches and offering new incentives for federal agencies to reduce the U.S. government's "overreliance on a single technology vendor."

Report: 2.6 Billion Personal Records Exposed in the Last 2 YearsThe number of data breaches in the U.S. has hit an all-time high, amid mounting attacks against third-party vendors and aggressive ransomware attacks, says a report from Apple and a Massachusetts Institute of Technology researcher. Breaches have more than tripled between 2013 and 2022.