Latest cybersecurity reporting from selected sources.

China’s UNC6508 hid in North American medical research networks for 2 years, stealing credentials and forwarding emails to Gmail Google’s Threat Intelligence Group published a report this week on UNC6508, a China-linked cyberespionage group that breached North American medical and military research organizations and stayed hidden for more than two years. The earliest confirmed intrusion […]

A China-linked espionage group hid inside North American medical, academic, and military research networks for more than a year, quietly stealing sensitive research and defense email

Google says the intruders were on the hunt for everything from drone tech to pathogens

Iran Expands Targeting, Including AWS, Google and Microsoft InfrastructureMichigan-based medical technology giant Stryker appears to have been hacked by a pro-Iranian group called Handala, leading to global operations being disrupted, IT devices remotely wiped and terabytes of data being stolen. Experts said Handala appears to be a "faketivist" group run by Tehran.

Several mental health mobile apps with millions of downloads on Google Play contain security vulnerabilities that could expose users' sensitive medical information. [...]

PLUS: Texas sues alleged TV spies; The Cloud is full of holes; Hospital leaked its own data; And more Infosec In Brief Google will soon end its “Dark Web Report”, an email service that alerts users when their personal information appears on the internet’s dark underbelly.…

Class Action Litigation Alleges Web Trackers Shared Patient Data With Tech FirmsKaiser Permanente has agreed to pay up to $47.5 million to settle litigation stemming from its use of tracking codes in its websites, patient portals and mobile apps. Claimants alleged the trackers unlawfully shared patients' information with third parties, including Google and Microsoft.

Settlement Ends Litigation Alleging Unlawful Sharing of Consumers' Fertility DataFlo Health, Google and Flurry have agreed to shell out millions of dollars to fund a nearly $60 million settlement for proposed class action lawsuit that accused Flo of using tracking codes in its fertility app that shared women's sensitive information with Google and Flurry without their consent.

A new AI-powered clinical decision support system developed by Google and NASA aims to help astronauts diagnose and treat medical issues during space missions - even when real-time communication with Earth is unavailable, said Chris Hein, field CTO of Google Public Sector.

A new AI-powered clinical decision support system developed by Google and NASA aims to help astronauts diagnose and treat medical issues during space missions - even when real-time communication with Earth is unavailable, said Chris Hein, field CTO of Google Public Sector.

A misconfigured tracking tool has exposed protected health information of 4.7 million Blue Shield members to Google Ads

Tech giants don't need smartphone mics to target adverts – your insurer just gives your data away, anyway US health insurance giant Blue Shield of California handed sensitive health information belonging to as many as 4.7 million members to Google's advertising empire, likely without these individuals' knowledge or consent.…

Blue Shield of California disclosed it suffered a data breach after exposing protected health information of 4.7 million members to Google's analytics and advertisement platforms. [...]

California Health Plan With 6 Million Members Blames Software Configuration ErrorBlue Shield of California is notifying health plan members that their protected health information was potentially shared for nearly three years with Google for advertising purposes because of the way Google Analytics online tracking tools were configured on the insurer's websites.

Hackers can potentially use AI to manipulate data that's generated and shared by some health apps, diminishing the data's accuracy and integrity, said Sina Yazdanmehr and Lucian Ciobotaru of cybersecurity firm Aplite, describing a recent research project involving Google Health Connect.

Also: Potential Government Policy Changes; AI-Driven Zero-Day DiscoveriesIn the latest weekly update, ISMG editors discussed how the recent election results may reshape U.S. cybersecurity policy and healthcare privacy under HIPAA and the groundbreaking role of artificial intelligence in Google’s recent discovery of a critical zero-day vulnerability.

Also: Payment Card Theft Trends, Internet Archive UpdateThis week, bulk data transfers to China, credit card theft, the Internet Archive still recovering and the Change Healthcare tally is now 100M. Ukraine fought phishers, civil society against the UN cybercrime treaty, TA866 and virtual hard drives spread malware. Google verified Sir Isaac Newton.

Some Face Hurdles in Tapping Into Free, Discounted Services From Microsoft, GoogleRural and small hospitals and other healthcare providers often complain that a lack of resources is a major factor stunting their cybersecurity maturity. But even when offered free or discounted cyber assistance, many of these organizations aren't signing up.

Vendors' Free, Discounted Services Part of Biden's Health Sector Cyber InitiativeGoogle and Microsoft have agreed to provide free or highly discounted cyber assistance to rural and critical-access hospitals to support of an evolving strategy from the White House aimed at bolstering cybersecurity in the healthcare sector in the face of rising attacks.

Ouch! Millions of Kaiser Permanente patients' data was likely shared with Google, Microsoft Bing, X/Twitter, and other third-parties, according to the American healthcare giant.…