Latest coverage for Critical Infrastructure

ICSpector Is Now on GitHub, Scans PLCs, Extracts Info and Detects Malicious CodeMicrosoft has released a new open-source security tool to close gaps in threat analysis for industrial control systems and help address increased nation-state attacks on critical infrastructure. ICSpector, available on GitHub, can scan PLCs, extract information and detect malicious code.

Heads of OpenAI, Microsoft, Alphabet Join Inaugural AI Safety and Security BoardThe heads of technology giants Alphabet and Microsoft and leading artificial intelligence firm OpenAI are joining a federal AI safety and security board aimed at securing U.S. critical infrastructure against emerging AI risks, the Department of Homeland Security announced Friday.

Calls for More Aid to Providers Come as Parent Company UHG Grapples With BreachTwenty-two state attorneys general and some industry groups are urging Change Healthcare's parent company and regulators to be transparent and give more financial aid to providers as the firm recovers from a highly disruptive cyberattack and the industry braces for massive breach notifications.

Ouch! Millions of Kaiser Permanente patients' data was likely shared with Google, Microsoft Bing, X/Twitter, and other third-parties, according to the American healthcare giant.…

CISA’s RVWP program sent 1754 ransomware vulnerability notifications to government and critical infrastructure entities in 2023, leading to 852 devices being secured

The targeted operation utilized CVE-2017-8570 as the initial vector and employed a notable custom loader for Cobalt Strike, yet attribution to any known threat actor remains elusive.

Healthcare service provider Kaiser Permanente disclosed a data security incident that may impact 13.4 million people in the United States. [...]

Incident Involves Health Plans' Prior Use of Online Tech in Websites, Mobile AppsKaiser Foundation Health Plan has reported to regulators a health data breach affecting 13.4 million people stemming from the previous use of web trackers. Aside from reports expected from the Change Healthcare mega hack, the incident is the largest health data breach reported so far in 2024.

How the CISO of Kenvue, a consumer healthcare company spun out from Johnson & Johnson, combined tools and new ideas to build out the security program.

A state-sponsored hacking team employed a clever masquerade and elaborate back-end infrastructure as part of a five-year info-stealing campaign that compromised the US State and Treasury Departments, and hundreds of thousands of accounts overall.

Their holiday options are now far more restricted The US has charged and sanctioned four Iranian nationals for their alleged roles in various attacks on US companies and government departments, all of whom are claimed to have worked for fake companies linked to Iran's military.…

Experts Advise Health Sector to Take Steps as UnitedHealth Group Cleans Up MessUnitedHealth Group's admission that information for "a substantial portion" of the American population was compromised in its Change Healthcare cyberattack sets into motion the likelihood the incident will become the largest health data breach ever reported in U.S. What other details are emerging?

Microsoft Warns APT28's GooseEgg Tool Enables Credential TheftRussian military intelligence hackers are using an 18 month-old vulnerability in the Windows print spooler utility to deploy a custom tool that elevates privileges and steals credentials. Microsoft says it's seen post-compromise activities against Ukrainian, European and North American governments.

Millions of Americans may be impacted by the Change Healthcare data breach as UnitedHealth confirms exposed data includes personal and health information

That said, good old US healthcare system so elaborately costly some are forced to avoid altogether UnitedHealth Group, the parent of ransomware-struck Change Healthcare, delivered some very unwelcome news for customers today as it continues to recover from the massively expensive side and disruptive digital break-in.…

Breach 'Could Cover a Substantial Proportion of People in America,' Company WarnsHackers who hit Change Healthcare stole sensitive personal and medical details that "could cover a substantial proportion of people in America," parent company UnitedHealth Group warned. The company faces mounting regulatory scrutiny and lawsuits due widespread disruptions caused by the attack.

Notorious APT44 group Sandworm launched a major campaign against Ukrainian critical infrastructure in March

HHS OCR Says the Company Has Not Yet Filed HIPAA Breach Reports to the AgencyThe Department of Health and Human Services has not yet received HIPAA breach reports from Change Healthcare or parent company UnitedHealth Group about their massive cyberattack. HHS is telling HIPAA-covered firms and their vendors to do their duty if a breach affects protected health information.

Finalizes HIPAA Privacy Rule Changes Involving PHI Related to Reproductive CareHealthcare providers are prohibited from disclosing protected health information related to lawful reproductive healthcare, according to a final rule released Monday by federal regulators. The new HIPAA rule is designed to protect women who cross state lines seeking an abortion, and their providers.

Attorney Rachel Rose on Navigating the Intensifying Scrutiny of Federal RegulatorsThe federal government is cracking down on healthcare fraud in all forms including kickbacks, lapses in cybersecurity and privacy, lack of fairness in Medicare Advantage policies, and inflated pharmacy claims. Regulatory attorney Rachel Rose outlines seven key tips for meeting compliance mandates.