Latest cybersecurity reporting from selected sources.

Newcomer 'Insomnia' Appears to Favor US Healthcare-Related EntitiesA new cybercriminal gang, Insomnia, appears to have its eyes wide open for potential healthcare-related targets. Since surfacing on the darkweb in recent weeks, the apparent data theft group has chalked up 18 alleged victims on its data leak site, with more than half having ties to healthcare.

PLUS: Texas sues alleged TV spies; The Cloud is full of holes; Hospital leaked its own data; And more Infosec In Brief Google will soon end its “Dark Web Report”, an email service that alerts users when their personal information appears on the internet’s dark underbelly.…

Ransomware Gang Rhysida Leaks 3.7TB of Data Stolen From Maryland Hospital SystemMaryland-based MedStar Health, which operates 10 hospitals, is notifying patients about a data theft incident affecting their personal information. Ransomware group Rhysida claims on its darkweb leak site to have 3.7 terabytes of MedStar's data, including "over 7 million pieces of patient data."

Class Members Can Claim Up to $5K Each for Documented Losses Tied to BreachA small, rural county-owned Georgia community hospital has agreed to settle consolidated class action litigation involving a 2024 hacking incident in which ransomware gang Embargo claimed to have stolen 1.15 terabytes of the organization's data and leaked it on the darkweb.

Data of Nearly 470,000 Patients and Employees May Have Been Leaked on Dark WebOmni Family Health, a California nonprofit network of community health centers, has agreed to pay $6.5 million to settle proposed class action lawsuits related to a 2024 hack that may have exposed the personal information of nearly 470,000 current and former patients and employees on the dark web.

2022 Ransomware Attack, Data Theft Affected 3.4 Million PatientsA California-based network of nine affiliated physician practices will pay nearly $50 million to settle consolidated class action litigation involving a 2022 ransomware and data theft attack that affected more than 3.4 million patients. Plaintiffs claimed their data was leaked on the darkweb.

Cybercriminals Demanded Ransom Payments Directly From Some Affected PatientsAn Oklahoma health system will pay $30 million to settle class action litigation involving a 2023 data theft hack that affected 2.4 million people. Some of the patients - including minors - have received blackmail demands directly from cybercriminals threatening to sell their data on the darkweb.

Medusa Group Tied to Attack on SimonMed and Threats to Leak Stolen DataTwo radiology practices are notifying nearly 1.5 million people of separate hacking incidents compromising their sensitive health information. Cybercrime gang Medusa claimed credit for attacking Arizona-based SimonMed Imaging in January and threatened to leak the stolen data of nearly 1.3 million patients on the darkweb.

Medusa Group Tied to Attack on SimonMed and Threats to Leak Stolen DataTwo radiology practices are notifying nearly 1.5 million people of separate hacking incidents compromising their sensitive health information. Cybercrime gang Medusa claimed credit for attacking Arizona-based SimonMed Imaging in January and threatened to leak the stolen data of nearly 1.3 million patients on the darkweb.

Ransomware Gang Nova Poised to Leak Patient Data, Lab Stays Mum on NegotiationsWith ransomware gang Nova threatening to leak patient data on the darkweb, a Dutch laboratory that performs cervical cancer tests for a government screening program is mum about the ransom negotiations, but it says the cyberattack in July has affected 941,000 patients.

Firm Admits Paying Ransom in Exchange of Hacker's Promise to Delete Stolen InfoTwo Florida-based law firms with offices in other states are notifying 282,100 people whose healthcare and other information was potentially compromised in separate data theft incidents. One of the firms admitted to paying a ransom to prevent its data from being leaked on the dark web.

Cybercriminal Gang Money Message Claims Credit, Publishes Stolen RecordsA Massachusetts hospital is notifying 316,000 people that their information was compromised in a cyberattack discovered nearly a year ago on Christmas 2023. Cybercriminal group Money Message had claimed that it stole 600 gigabytes data, posting patient and employee records on the dark web.

Boston Children's Health Physicians Says Incident Involved Unnamed IT VendorRansomware gang BianLian has listed Boston Children's Health Physicians - a pediatric group that practices in New York and Connecticut - on its dark web site, threatening to release stolen patient and employee data. The practice said the September incident involved an IT vendor.

Ransomware Gang Could Have Axis Health's Mental Health, Drug Abuse RecordsRansomware gang Rhysida is threatening to dump data on the dark web that belongs to a Colorado provider of mental health, substance abuse and other healthcare services unless it pays nearly $1.5 million. The group is leaking records it claims to have stolen from a Mississippi nursing home.

Ransomware Gang Daixin Claims It Published Sensitive Patient Info on Dark Web SiteA Louisiana-based ambulance company that provides emergency medical care services in four states is notifying nearly 3 million people that their sensitive health information was potentially stolen in a June hack. Ransomware gang Daixin claims to have published the data on its dark web leak site.

Cybercriminal Group Claims to Have Published 100 Gigabytes of Agency's Stolen DataTwo months after RansomHub claimed to have published 100GBs of its stolen data on the dark web, the Florida Department of Health is notifying citizens that their sensitive information has been compromised. The attack affected the vital statistics system used to issue birth and death certificates.

Court Filing: Threat Actor Stole Admin Credentials From IT Service Desk ContractorMedibank's lack of MFA on its global VPN allowed a hacker to use credentials stolen from an IT services desk contractor to access the private health insurer's IT systems in 2022, leading to a dark web data leak affecting 9.7 million individuals, Australian regulators said in court documents.

Canadian Retail Pharmacy Chain Says It's Reviewing Exposed Data on Gang's Leak SiteLockBit has begun to leak on its dark web site files of data the Russian-speaking cybercriminal gang claims to have stolen in an April attack on London Drugs. The group had threatened to publish the exfiltrated data if the Canadian retail pharmacy chain does not pay a $25 million ransom demand.

MediSecure confirmed that limited health data of customers was posted onto a dark web forum, with a 6.5TB dataset reportedly put up for sale

One Month Later, Lurie Children's Hospital Still Recovering From Ransomware AttackRansomware group Rhysida is offering to sell "exclusive data" stolen from a Chicago children's hospital for $3.4 million on the dark web, while the hospital is still struggling to recover its IT systems, including its electronic health records and patient portal, one month after the attack.