Latest cybersecurity reporting from selected sources.

NHS Forth Valley is the latest health board to bungle basic email data protection principles

A China-linked espionage group hid inside North American medical, academic, and military research networks for more than a year, quietly stealing sensitive research and defense email

Trellix Says Email, Identify Failures Are Among Top Vectors in Health CompromisesOf the millions of threats detected in healthcare IT environments last year, email phishing, identity failures and device vulnerabilities were among the top vectors for non-clinical IT compromises - often "cascading" and disrupting patient care, said a new report from security firm Trellix.

PLUS: Texas sues alleged TV spies; The Cloud is full of holes; Hospital leaked its own data; And more Infosec In Brief Google will soon end its “Dark Web Report”, an email service that alerts users when their personal information appears on the internet’s dark underbelly.…

Wanna know a secret? Whether you're logging into your bank, health insurance, or even your email, most services today do not live by passwords alone. Now commonplace, multifactor authentication (MFA) requires users to enter a second or third proof of identity. However, not all forms of MFA are created equal, and the one-time passwords orgs send to your phone have holes so big you could drive a truck through them.…

Mindpath Health Settles Claim for $3.5M; Delta Dental Notifies 146,000 of BreachEmail breaches continue to plague the healthcare sector, resulting in data compromises that often affect the sensitive information of scores of patients. Two recent incidents illustrate the risks email breaches pose to patients, and the potential legal fallout for providers.

Multimillion Dollar Deal Resolves 27 Lawsuits After 2023 Email Storage HackA Tennessee federal court has approved a multimillion dollar settlement in consolidated class action litigation against HCA Healthcare in the wake of a 2023 email data theft hack that the publicly traded company reported as affecting nearly 11.3 million individuals.

Medication Tech Firm Says Hacking Incident Contained to One Employee Email AccountA Florida firm that offers medication therapy management services to health plans is notifying nearly 150,000 individuals that their information was potentially compromised in a phishing attack affecting one employee's email account for only about an hour. Why do users still fall for phishing scams?

Compromised data includes personal data such as patients’ full names, ages, phone numbers and email addresses

Organizations in 12 States Hit by 2024 Integrated Oncology Network Phishing CaseAt least two dozen cancer care centers and oncology practices in 12 states are reporting to federal regulators that nearly 123,000 patients were affected by a 2024 email phishing breach involving its parent organization, Integrated Oncology Network, which is owned by Cardinal Health.

Alerts Come on the Heels of Recent Attacks on InsurersU.S. federal authorities are warning the public and healthcare sector entities of email and fax phishing scams by fraudsters seeking to steal personal information about patients or payments. The warnings come as three large U.S. insurers continue to recover from recent cyberattacks.

Breach Affects Pediatric, Orthodontic and Dental Surgery Practices in 6 StatesA Nashville, Tennessee firm that provides HR and finance services to dozens of specialty dental practices across six states is notifying more than 173,400 people of a 2024 email hacking incident affecting children and other patients. The company already faces several lawsuits related to the breach.

Large Health Data Breach Started With Phishing Lure in Employees' EmailTennessee-based Numotion, one of the largest U.S. providers of wheelchairs and other health-related mobility products is notifying nearly 500,000 people of a 2024 email hacking incident that potentially compromised their personal and health-related information.

Incidents at Pain Management Firm, Pediatric Hospital Affect 50,000 PeopleAn insider breach at a Florida pain management firm and an email breach at a Colorado pediatric hospital have resulted in more than $1.7 million in fines for HIPAA violations found by federal investigators. The two incidents affected fewer than 50,000 people.

'Wirte' Threat Actor Used Wiper That Checks if Victim Is Located in IsraelHackers likely connected to Palestinian militants Hamas were behind wiper attacks detected in October against Israeli organizations including hospitals and municipalities. Israeli cybersecurity firm Check Point on Tuesday attributed the attacks to a group tracked as Wirte.

Agency Spells Out Measures to Avoid Falling Victim to Costly SchemesHealthcare organizations should take steps to avoid falling victim to evolving threats involving costly business email compromise scams and related phishing schemes fueled by social engineering, warned the Department of Health and Human Services' Health Sector Cybersecurity Coordination Center.

HHS: Bot-Driven Attacks Can Overwhelm Email Servers, Networks and Disrupt WorkflowFederal authorities are warning healthcare and public health sector entities of email bomb attacks, a type of denial-of-service attack that can overwhelm email systems and networks and distract victims from other nefarious activities. The incidents can also disrupt clinical and business workflow.

FBI Says It Received Most Attack Reports From Healthcare, Critical ManufacturingCybercrime reports submitted by victims to the FBI's Internet Crime Complaint Center surged last year, and the total reported losses exceeded $12.5 billion. Investment fraud and business email compromise losses dominated, and ransomware attacks spared almost no critical infrastructure sector.

Cyberattacks on Pediatric Facilities Are Rare But Considered Especially EgregiousNetwork systems - including phones, email, electronic health records and patient portals - remain offline at a Chicago children's hospital and research center nearly a week after it was hit by a cyberattack. Such incidents targeting entities that cater to kids are especially egregious, experts say.

The City of Philadelphia is investigating a data breach after attackers "may have gained access" to City email accounts containing personal and protected health information five months ago, in May. [...]