Latest cybersecurity reporting from selected sources.

HHS OCR Breach Investigators Again Find All-Too-Common Risk Analysis FailuresFaulty or non-existent security risk analyses cost a medical imaging provider, a women's healthcare group, a health plan and a third-party insurance administrator a collective $1.7 million in fines after federal regulators concluded they didn't do enough to prevent ransomware attacks.

HHS OCR Breach Investigators Again Find All-Too-Common Risk Analysis FailuresFaulty or non-existent security risk analyses cost a medical imaging provider, a women's healthcare group, a health plan and a third-party insurance administrator a collective $1.7 million in fines after federal regulators concluded they didn't do enough to prevent ransomware attacks.

Iowa Seeking Civil Monetary Fines, Damages for Alleged ViolationsIowa's state attorney general is seeking financial damages, civil penalties and improvements to UnitedHealth Group's data security practices for alleged violations of state and federal laws and other claims involving the 2024 ransomware attack on its Change Healthcare unit.

The U.S. Department of Justice (DoJ) said a Russian national has been sentenced to two years in prison for managing a botnet that was used to launch ransomware attacks against U.S. companies

Also, CIRO Phishing Breach, Ingram Micro Ransomware and CVE SurgeThis week, DOGE posted sensitive data on an outside server. A phishing attack affected 750,000 Canadians. A hacktivism warning from the U.K. NCSC. An Ingram Micro breach. CVEs surged in 2025. SK Telecom challenged a fine. Researchers disclosed Chainlit flaws. North Korean hackers abused VS Code.

Settlement Includes Corrective Action Plan Focused on Improving Risk AnalysisAn investigation into a ransomware breach reported in 2020 as affecting the protected personal information of 170,000 people led to a $175,000 fine against a certified public accounting and consulting firm. Regulators also required the company to implement a corrective action plan in the settlement.

2021 Pysa Hack Compromised PHI of Nearly 25,000 PatientsA HIPAA breach investigation into a 2021 attack involving a variant of Pysa ransomware resulted in a $250,000 fine for an upstate New York specialty surgery practice, which also agreed to a corrective action plan that will be monitored by federal regulators for the next two years.

2021 Pysa Hack Compromised PHI of Nearly 25,000 PatientsA HIPAA breach investigation into a 2021 attack involving a variant of Pysa ransomware resulted in a $250,000 fine for an upstate New York specialty surgery practice, which also agreed to a corrective action plan that will be monitored by federal regulators for the next two years.

The suspect faces three charges for his alleged crimes that could earn him up to five years in federal prison, and a heap of fines.

Settlement Follows Federal Investigation Into Data Leak and Ransomware AttackA Texas mental healthcare provider's failure to conduct a comprehensive risk analysis resulted in a $225,000 federal fine after regulators investigated a data leak followed by a ransomware attack in 2023. Deer Oaks Behavioral Health also must implement a corrective action plan.

The ICO has decided not to fine the British Library for a 2023 ransomware breach

Enforcement Action Is Latest Under Agency's Ransomware, Risk Analysis InitiativesFederal regulators fined a New York neurology practice $25,000 following an investigation into a 2020 ransomware breach affecting nearly 7,000 individuals. Comprehensive Neurology failed to conduct an accurate and thorough risk analysis, regulators said.

Firm Failed to Close Outdated User Account, Waited 43 Days to Notify RegulatorsThe U.K. Information Commissioner's Office imposed a fine of 60,000 pounds against Liverpool-based law firm DDP Law for GDPR violations relating to a 2022 ransomware hack and data leak that exposed sensitive information including the details of its clients' cases.

Data stolen included checklist for medics on how to get into vulnerable people's homes The UK's data protection watchdog is dishing out a £3.07 million ($3.95 million) fine to Advanced Computer Software Group, whose subsidiary's security failings led to a ransomware attack affecting NHS care.…

UK ICO Says Advanced's Security Measures 'Fell Seriously Short'A British IT service company must pay a 3.07 million pound fine for a 2022 ransomware hack that exposed medical records of tens of thousands of National Health Service patients. Hackers breached the Advanced system through a user account that did not have multifactor authentication in place.

The UK Information Commissioner's Office (ICO) has fined Advanced Computer Software Group Ltd £3.07 million over a 2022 ransomware attack that exposed the sensitive personal data of 79,404 people, including National Health Service (NHS) patients. [...]

Enzo Biochem Previously Paid Three States $4.5M in Fines for Same BreachBiotech firm Enzo Biochem has agreed to pay $7.5 million to settle a consolidated proposed class action lawsuit involving a 2023 ransomware attack affecting 2.5 million people. The company has already paid $4.5 million in fines to three state attorneys general for the same incident.

That's in addition to the $4.5M fine paid to three state AGs last year Enzo Biochem has settled a consolidated class-action lawsuit relating to its 2023 ransomware incident for $7.5 million.…

Agency Kicks Off New Year With First HIPAA Enforcement Actions, $170K in FinesA Massachusetts firm that provides billing and other services to home health agencies and a Virginia-based data hosting and cloud provider are the latest companies paying federal regulators settlements. HHS levied $170,000 in fines following investigations into ransomware breaches.

Indiana Attorney General Fines Westend Dental $350K in 2020 Ransomware HackAn Indiana dental practice agreed to pay the state $350,000 and implement a long list of data security improvements following an alleged 2020 ransomware breach "cover up" that came to light when state regulators investigated a patient complaint about unfulfilled requests for dental X-rays.